Class SpiderCommand

Namespace
Kuestenlogik.Bowire.Security.Scanner
Assembly
Kuestenlogik.Bowire.Security.Scanner.dll

Implementation of bowire scan spider (#176) — discover candidate endpoints from a base URL so the scanner / OWASP suite has an attack surface to work against, including endpoints the schema forgot to declare.

public static class SpiderCommand
Inheritance
SpiderCommand
Inherited Members

Remarks

Conservative by design: same-host (or --scope) only, honours robots.txt Disallow unless --no-robots, never authenticates beyond the operator's --auth-header, and caps the candidate count. Discovery sources: robots.txt, sitemap.xml, an OpenAPI/Swagger document's paths, a curated common-path HEAD sweep, and same-origin links on the base page. Candidates are surfaced for the operator to confirm or ignore — never auto-added to a schema.

Methods

CrawlAsync(SpiderOptions, HttpClient, CancellationToken)

Run every discovery source against the target and return the deduped, ordered candidates. Shared by the CLI (bowire scan spider) and the workbench endpoint (POST /api/security/spider).

public static Task<IReadOnlyList<SpiderCandidate>> CrawlAsync(SpiderOptions options, HttpClient http, CancellationToken ct)

Parameters

options SpiderOptions
http HttpClient
ct CancellationToken

Returns

Task<IReadOnlyList<SpiderCandidate>>

RunAsync(SpiderOptions, CancellationToken, TextWriter?, TextWriter?) 

public static Task<int> RunAsync(SpiderOptions options, CancellationToken ct, TextWriter? output = null, TextWriter? error = null)

Parameters

options SpiderOptions
ct CancellationToken
output TextWriter
error TextWriter

Returns

Task<int>