v2.3.0 — Security pillar: shift-left scanner, OWASP coverage, auth recording #490
thomas-stegemann
announced in
Announcements
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
v2.3 turns Bowire into a real API security tool.
bowire scannow runs the full OWASP API Security Top 10 — including protocol-specific probes for gRPC, GraphQL, WebSocket, SignalR, Socket.IO, SSE, MCP and MQTT — with a per-scan compliance overview (OWASP / CWE / CVSS). An opt-in active probe tier goes beyond passive checks into deliberately-mutating attacks (MQTT retained-message poisoning, WebSocket compression-bomb / slow-loris, gRPC concurrent-stream fork-bomb, SSE slow-consumption, MCP tool-call injection). A complete out-of-band (OAST) stack lands: an interactsh-compatible client,bowire scan --oast-server, a self-hostedbowire oast serveserver, and a manual pen-test panel — so blind SSRF / RCE / XXE that leave nothing in the response can finally be proven. The curated template corpus becomes usable withbowire vulndb update/list, and the AI-assisted layer (threat model, JWT analyzer, OWASP panel, one-button scan, SARIF report) rounds out the lane.Alongside the security work, the mock server reaches WireMock feature parity (request matchers, body predicates, response templating, scenarios, selective upstream proxy, fault injection, HTTPS, admin CRUD, verification) and a new Monitoring surface runs saved recordings as scheduled health probes with Slack / PagerDuty / OTLP signalers.
196 commits since v2.2.1. No breaking changes — every existing workspace, collection, recording, benchmark and flow loads identically, and all new surfaces are additive and opt-in.
Highlights
OWASP API Security Top 10 — the full suite (#173, #106, #381, #184)
bowire scan --suite owasp-apiexercises all ten OWASP API Security Top 10 (2023) entries and rolls the result up per entry: exercised / clean / vulnerable, with the concrete probe behind each. Coverage reaches 10/10 including API6 (business-flow) and API10 (unsafe consumption). Protocol-specific probes go past HTTP: GraphQL introspection + query-depth / complexity / alias-batching, gRPC server-reflection + transport-auth, WebSocket message-size, SSE stream guards, MCP resource-traversal, and MQTT checks. A Compliance tab turns any scan into an OWASP / CWE / CVSS overview with a severity histogram and peak-CVSS readout.Active probe tier — opt-in, mutating attacks (#395–#400)
Passive checks tell you what a target discloses; the new
--activetier tells you what it does under attack. Off by default and gated behind explicit opt-in, it adds MQTT retained-message poisoning + wildcard-subscribe privilege + will-message abuse, WebSocket compression-bomb amplification + slow-loris, SSE slow-consumption, and a gRPC concurrent-stream fork-bomb — each namespacing and cleaning up its own side effects, with an honest verdict about how far it got. Budgets (--active-duration,--active-concurrency,--active-expected-topic) keep it bounded.Out-of-band detection (OAST) — end to end (#35 Phase 2f)
Blind SSRF / RCE / XXE leave nothing in the response; the only proof is the target reaching out to a host you planted. v2.3 ships the whole chain:
bowire scan --oast-server <url>plants callback hosts into Nuclei OAST templates ({{interactsh-url}},part: interactsh_protocol) and proves a finding only when a genuine callback lands — failing closed when no server is configured, never reporting an unproven blind finding.bowire oast serveis a self-hosted, interactsh-wire-compatible interaction server (DNS + HTTP catchers + register/poll API) — no third-party service, no Go binary.--tokengates it;--oast-tokenauthenticates the client.The crypto (RSA-OAEP + AES-CTR) is pinned against the NIST SP 800-38A vectors and the client↔server pairing is tested against the real server, not in isolation.
bowire vulndb— the template cache (#26)bowire vulndb updatefetches the curatedKuestenlogik/Bowire.VulnDbtemplate set into~/.bowire/vulndb(latest GitHub release by default;--sourcefor a checkout / tarball / URL and--refto pin, for air-gapped and reproducible installs).bowire scanreads that cache by default, so an operator runs one update and then scans without repeating--templates.bowire vulndb listshows what's cached.Monitoring — scheduled health probes (#102)
bowire monitor run <probes>runs saved recordings on a schedule, records every outcome to an append-only ledger, and signals on pass↔fail transitions through opt-in Slack, PagerDuty, and OTLP channels (bowire.monitoring.*instruments). A read-only Monitoring rail renders the live ledger — per-probe status, a latency sparkline, and the outcome history. Sessions resume their cadence across restarts.Mock server — WireMock feature parity (#401–#411, #430)
The standalone mock server grows from happy-path replay into a full mocking tool: request-matching predicates (query / header / cookie, regex / glob paths, stub priority), body matchers (
equalToJson/ JSONPath / XPath / JSON-schema / regex), response templating (helpers / math / faker +bodyFileName+ a transformer hook), a named scenario state machine, selective upstream proxy (proxyBaseUrl— mock some routes, forward the rest), fault injection (malformed chunks, faults on unmatched requests), HTTPS/TLS (+ a Docker image), per-stub admin CRUD on a running server, and a verification API (verify/findAll/ near-misses).AI-assisted security (#104–#107)
With
Kuestenlogik.Bowire.Aiin the process, the Security rail gains an AI threat model (rank endpoints by attack surface), a JWT analyzer (deterministic claim-by-claim flags + an AI narrative), an OWASP API Top 10 panel (per-method status + a concrete probe per risk), a one-button scan that chains threat-model → templates → fuzz → triage → report, and a markdown security report from SARIF with diff-vs-baseline. The deterministic core always runs; the AI layer degrades gracefully when no model is connected.Scanner foundations
Rounding out the lane: a headless auth-flow runner (
bowire scan --auth-flow— login → token chain injected into every probe, secrets from{{env.NAME}}), CVE lookup against discovered server banners, HAR import (Chrome DevTools network tab → recordings, with secret redaction), an endpoint spider with confirm/ignore triage, a schema-aware mutation engine (bowire scan mutate), and Nuclei template compatibility including the Phase 2g DNS-transport translator.bowire scantreats SignalR / Socket.IO / MCP / gRPC / gRPC-Web as HTTP-class transports so their templates run.Breaking changes
None. v2.3 is purely additive; every new surface is opt-in.
Acknowledgements
Thanks to everyone who exercised the security lane against real targets and reported sharp edges during the 2.3 cycle.
The full commit list, contributors, and compare-URL diff are auto-generated below.
What's Changed
bowire scan --auth-flow(Authentication session recording + token reuse #190) by @thomas-stegemann in feat(security): headless auth-flow runner +bowire scan --auth-flow(#190) #433Full Changelog: v2.2.1...v2.3.0
This discussion was created from the release v2.3.0 — Security pillar: shift-left scanner, OWASP coverage, auth recording.
All reactions