`vulkro probe`

Pro

vulkro probe is part of Pro: Runtime probe (probe), confirm a finding against the running application. On Free it stops before doing any work, prints what it needs and where to get it, and exits 1. See Pricing.

Active testing: authorization required

vulkro probe is a DAST tool. It sends real attack traffic to --base-url, including payload injection (reflected XSS, SSTI, parameter pollution, JWT alg=none) and, with --allow-mutations, state-mutating attacks (HTTP request smuggling, prototype pollution, NoSQL $ne, race replay). It can alter data and can trip rate limits or WAF blocks.

Run it ONLY against a non-production target you are authorized to test. Use --safe for the read-only subset. --allow-mutations additionally requires --i-understand-this-is-active (or an interactive confirmation), and is refused outright when run non-interactively without it.

Active runtime confirmation of static findings. Hits each discovered endpoint of a running app to confirm auth bypass, CORS reflection, IDOR shape, SSTI, reflected XSS, JWT alg-confusion, prototype pollution, NoSQL operator injection, GraphQL schema leakage, HTTP request smuggling (CL.TE / TE.CL / TE.TE), DNS rebinding, race-replay, and parameter pollution.

13 probes ship with Vulkro.

Usage

vulkro probe . --base-url http://localhost:3000 [FLAGS]

Flags

Flag	Description
`--base-url <URL>`	Required. Base URL of the running app.
`--auth-header <HEADER>`	Whole `Authorization: Bearer ...` header for IDOR-shape probing.
`--safe`	Read-only subset: only the benign confirmation probes (auth-bypass, CORS, IDOR shape). Skips every payload-injection probe. Cannot be combined with `--allow-mutations`.
`--allow-mutations`	Allow POST / PUT / PATCH / DELETE and the state-mutating attack classes. Off by default. Requires `--i-understand-this-is-active` (or interactive confirmation).
`--i-understand-this-is-active`	Confirm you are authorized to send active, state-mutating traffic. Required (non-interactively) with `--allow-mutations`.
`--rate-limit-ms <MS>`	Minimum delay between per-endpoint probe bursts. Default `100`. Set `0` to disable.
`--format <FMT>`	`table`, `json`, `sarif`, `junit`, etc. Same set as `scan`.

Safety

vulkro probe is active DAST. Treat it as a penetration test: only run it against a target you are authorized to test, and prefer a non-production environment.

Authorization gate. A destructive run (--allow-mutations) does not start until it is acknowledged:

On a terminal, you are prompted to type yes before any traffic is sent.
Non-interactively (CI, scripts), the run is refused with exit code 2 unless you pass --i-understand-this-is-active.
The read-only default and --safe runs do not require the acknowledgement, but you still need authorization to test the host.

--safe mode runs only the three benign confirmation probes (auth-bypass, CORS reflection, IDOR shape) and sends no attack payloads. Recommended against an unfamiliar target.

Built-in guard rails. Even with --allow-mutations, request bodies are empty and destructive-looking paths (/delete, /drop, /purge, /wipe, /destroy) are always skipped. Hard limits: 5 s per request, 60 s total wall-clock. A default 100 ms rate-limit backoff (--rate-limit-ms) spaces out per-endpoint bursts so the probe does not hammer the target.

Don't point this at production unless you own it. Don't point it at hosts you don't own, ever.

How it interacts with `scan`

probe reads endpoints from the same static extraction pass as scan, then attempts to confirm each statically-flagged issue. A successful probe upgrades the finding to:

confidence_reason = "runtime-confirmed via active probe"

This is the highest-confidence tier in the engine. Findings that the probe disconfirms (e.g. an [Unprotected]-tagged endpoint that actually returns 401) are suppressed.

Probe catalogue

#	Probe	What it checks
1	`auth_bypass`	Hit Unprotected endpoints with no auth header - 2xx/3xx confirms the gap
2	`cors_reflection`	Send `Origin: https://attacker.example` and detect reflected ACAO
3	`idor_shape`	With auth set, fetch with two synthetic IDs (1, 999999); both 200 with comparable bodies => no per-user scoping
4	`reflected_xss`	Reflect an unencoded SVG canary into HTML responses
5	`ssti`	Inject `{{7*7}}` and confirm template evaluation
6	`param_pollution`	Send duplicate query params and detect a behavioural delta
7	`smuggling`	Raw-`TcpStream` HTTP/1.1 client; TE-only, CL-only, dual-framing variants
8	`proto_pollution`	POST/PUT JSON with `__proto__.polluted = true`; follow-up GET checks for the polluted property
9	`graphql_suggestions`	Send a malformed query and detect schema names leaking via "Did you mean..."
10	`nosql_injection`	Login-shaped paths only; operator-injection payload (`{"$ne":null}`) returning 2xx where baseline returned 4xx
11	`jwt_confusion`	Forge `alg=none` from the user's token; finding fires when accepted
12	`dns_rebinding`	Informational unless `VULKRO_DNS_REBIND_DOMAIN` points at a controlled host
13	`race_replay`	Payment / state-mutating paths only; fire N parallel POSTs and flag if more than one returns 2xx

Probes 7, 8, 10, 13 require --allow-mutations. --safe mode runs only probes 1-3 (auth-bypass, CORS, IDOR shape); probes 4-12 send attack payloads and are skipped in safe mode.

vulkro scan

Command reference

Generated from vulkro help probe on vulkro 0.26.0. This block is the authoritative flag, usage, and exit-code reference for this command; the prose above is the friendly explanation. Do not edit this block by hand; run npm run docs:cli after a release.

[Pro] Confirm static findings against a running copy of the app (opt-in).

[Pro] Active probing: opt-in runtime confirmation of static findings. Active DAST: probe a LIVE app to runtime-confirm findings.

WARNING: sends real attack traffic to `--base-url` (auth-bypass, CORS, IDOR, plus XSS / SSTI / parameter-pollution / JWT / GraphQL probes; and with `--allow-mutations` also request smuggling, prototype pollution, NoSQL injection, and race replay). It may alter data and may trip rate limits. Run it ONLY against a non-production target you are AUTHORIZED to test. Use `--safe` for the read-only subset; `--allow-mutations` additionally requires `--i-understand-this-is-active`.

Exit codes: `0` no probe-confirmed issues, `1` probe-confirmed issues reported (the runtime equivalent of `scan --fail-on`), `2` arg error, refused or aborted destructive run, network setup failure, or internal crash.

Usage: vulkro probe [OPTIONS] --base-url <URL> [PATH]

Arguments:
  [PATH]
          Path to the project root (default: current directory)
          
          [default: .]

Options:
      --base-url <URL>
          Base URL of the running app - e.g. http://localhost:3000

      --offline
          Hard-disable every outbound network call for this run (sets VULKRO_OFFLINE=1). Blocks the CVE feed, the license heartbeat, the update check, webhooks, and any cloud AI endpoint; a loopback model (http://127.0.0.1, http://localhost) is still allowed. Equivalent to exporting VULKRO_OFFLINE=1, and the flag wins when both are set

      --auth-header <HEADER>
          Optional auth header to send for IDOR-shape probing. Format: `Authorization: Bearer eyJ…` (entire header)

      --allow-mutations
          Allow sending POST/PUT/PATCH/DELETE requests during the probe. Off by default to prevent accidental writes; even with this flag, request bodies are empty and destructive-looking paths (`/delete`, `/drop`, `/purge`) are skipped. Requires `--i-understand-this-is-active` (or interactive confirmation)

      --safe
          Read-only subset: run only the benign confirmation probes (auth-bypass, CORS reflection, IDOR shape) and skip every attack-payload injection. Recommended against an unfamiliar target. Cannot be combined with `--allow-mutations`

      --i-understand-this-is-active
          Confirm you are authorized to send active, state-mutating attack traffic to `--base-url`. Required (non-interactively) when `--allow-mutations` is set; on a terminal you are prompted instead

      --rate-limit-ms <MS>
          Minimum delay in milliseconds between per-endpoint probe bursts (rate-limit backoff). Default 100. Set 0 to disable
          
          [default: 100]

  -f, --format <FORMAT>
          Output format

          Possible values:
          - table
          - json
          - sarif
          - gh-pr
          - gh-pr-inline-comments: GitHub PR per-finding **inline review comments**. NDJSON, one `{path, line, side, severity, rule_id, fingerprint, body}` object per line. Designed to be piped straight to a `gh api` loop so `vulkro gate` can drop comments next to the offending line on the Files Changed tab without going through a GitHub App. See the GitHub CLI integration guide at vulkro.com/docs
          - github-annotations:    GitHub Actions / GitLab CI **PR annotations**. One workflow-command line per finding (`::error file=...,line=...,endLine=...,title=<rule id>::<message> (<helpUri>)`). Printed straight to a CI job's stdout, GitHub turns each line into an inline annotation pinned to `file:line` on the Files Changed tab; GitLab CI's annotation parser reads the same grammar. When run against a baseline (`--gate-vs` / a `gate` flow) only NEW findings are annotated so a first run does not paper the PR
          - gitlab-mr:             GitLab Merge-Request comment: GitLab-flavored Markdown with collapsible blocks
          - bitbucket-pr:          Bitbucket Pull-Request comment: flat Markdown (Bitbucket does not render `<details>`)
          - azure-pr:              Azure DevOps Pull-Request comment: flat Markdown (shared with Bitbucket)
          - junit
          - csv
          - cyclonedx:             CycloneDX 1.6 JSON SBOM (uses `ScanResult.packages`)
          - cyclonedx-1.7:         CycloneDX 1.7 JSON SBOM. Same component shape as `cyclonedx`; emits the newer `specVersion`. Offered alongside 1.6 (which stays default)
          - spdx:                  SPDX 2.3 JSON SBOM
          - spdx3:                 SPDX 3.0.1 JSON-LD SBOM (`@context` + `@graph` of typed elements). Offered alongside SPDX 2.3, which stays the default for `--format spdx`
          - cbom:                  CycloneDX 1.6 CBOM (Cryptographic Bill of Materials): one `cryptographic-asset` component per detected weak algorithm (MD5, SHA-1, ECB, RC4, DES, static IV, insecure RNG), with file:line occurrences inlined under `evidence.occurrences`. Compliance buyers (FedRAMP, post-quantum readiness reviews) ask for this as a distinct artefact from the library SBOM
          - openvex:               OpenVEX 0.2.0 exploitability statements for each dependency CVE (`affected` / `not_affected` / `under_investigation`), with `not_affected` backed by reachability analysis. Pairs with an SBOM
          - cyclonedx-vex:         CycloneDX 1.6 VEX: the same exploitability verdicts as `openvex`, in a CycloneDX `vulnerabilities[].analysis` document
          - cbom-1.7:              CycloneDX 1.7 CBOM. Same crypto-asset grouping as `cbom` plus a richer post-quantum descriptor. Offered alongside 1.6 (default)
          - pdf:                   PDF render of the executive HTML report (requires `wkhtmltopdf` on PATH)
          - ropa-md:               GDPR Article 30 Records-of-Processing template - Markdown
          - ropa-html:             GDPR Article 30 Records-of-Processing template - HTML
          - ndjson:                Newline-delimited JSON: one finding per line plus a trailing summary line. Designed for SIEM ingestion and `jq` filter pipelines
          - evidence-graph:        Evidence-graph JSON (`evidence-graph/1.0`): a stable, versioned, AI-consumable document that composes endpoints, taint source -> sink flows, reachability verdicts, findings, and the dependency SBOM into one graph. Meant to be handed to an external AI agent as deterministic ground truth (Vulkro embeds no model; the agent brings its own). Pairs with `vulkro aggregate` for cross-repo linking. See `docs/ai-tool/`
          
          [default: table]

  -h, --help
          Print help (see a summary with '-h')

Usage​

Flags​

Safety​

How it interacts with scan​

Probe catalogue​

Related​

Command reference​