Skip to content

v2.3.0 — Security pillar: shift-left scanner, OWASP coverage, auth recording

Latest
Latest

Choose a tag to compare

View all tags
@thomas-stegemann thomas-stegemann released this 17 Jul 06:38
v2.3.0
5337d42

v2.3 turns Bowire into a real API security tool. bowire scan now runs the full OWASP API Security Top 10 — including protocol-specific probes for gRPC, GraphQL, WebSocket, SignalR, Socket.IO, SSE, MCP and MQTT — with a per-scan compliance overview (OWASP / CWE / CVSS). An opt-in active probe tier goes beyond passive checks into deliberately-mutating attacks (MQTT retained-message poisoning, WebSocket compression-bomb / slow-loris, gRPC concurrent-stream fork-bomb, SSE slow-consumption, MCP tool-call injection). A complete out-of-band (OAST) stack lands: an interactsh-compatible client, bowire scan --oast-server, a self-hosted bowire oast serve server, and a manual pen-test panel — so blind SSRF / RCE / XXE that leave nothing in the response can finally be proven. The curated template corpus becomes usable with bowire vulndb update / list, and the AI-assisted layer (threat model, JWT analyzer, OWASP panel, one-button scan, SARIF report) rounds out the lane.

Alongside the security work, the mock server reaches WireMock feature parity (request matchers, body predicates, response templating, scenarios, selective upstream proxy, fault injection, HTTPS, admin CRUD, verification) and a new Monitoring surface runs saved recordings as scheduled health probes with Slack / PagerDuty / OTLP signalers.

196 commits since v2.2.1. No breaking changes — every existing workspace, collection, recording, benchmark and flow loads identically, and all new surfaces are additive and opt-in.

Highlights

OWASP API Security Top 10 — the full suite (#173, #106, #381, #184)

bowire scan --suite owasp-api exercises all ten OWASP API Security Top 10 (2023) entries and rolls the result up per entry: exercised / clean / vulnerable, with the concrete probe behind each. Coverage reaches 10/10 including API6 (business-flow) and API10 (unsafe consumption). Protocol-specific probes go past HTTP: GraphQL introspection + query-depth / complexity / alias-batching, gRPC server-reflection + transport-auth, WebSocket message-size, SSE stream guards, MCP resource-traversal, and MQTT checks. A Compliance tab turns any scan into an OWASP / CWE / CVSS overview with a severity histogram and peak-CVSS readout.

Active probe tier — opt-in, mutating attacks (#395–#400)

Passive checks tell you what a target discloses; the new --active tier tells you what it does under attack. Off by default and gated behind explicit opt-in, it adds MQTT retained-message poisoning + wildcard-subscribe privilege + will-message abuse, WebSocket compression-bomb amplification + slow-loris, SSE slow-consumption, and a gRPC concurrent-stream fork-bomb — each namespacing and cleaning up its own side effects, with an honest verdict about how far it got. Budgets (--active-duration, --active-concurrency, --active-expected-topic) keep it bounded.

Out-of-band detection (OAST) — end to end (#35 Phase 2f)

Blind SSRF / RCE / XXE leave nothing in the response; the only proof is the target reaching out to a host you planted. v2.3 ships the whole chain:

  • bowire scan --oast-server <url> plants callback hosts into Nuclei OAST templates ({{interactsh-url}}, part: interactsh_protocol) and proves a finding only when a genuine callback lands — failing closed when no server is configured, never reporting an unproven blind finding.
  • bowire oast serve is a self-hosted, interactsh-wire-compatible interaction server (DNS + HTTP catchers + register/poll API) — no third-party service, no Go binary. --token gates it; --oast-token authenticates the client.
  • A manual OAST panel in the Security rail generates callback payloads to paste by hand and shows a live feed of what hit the catcher — the interactive counterpart for pen-testing, self-hosted.

The crypto (RSA-OAEP + AES-CTR) is pinned against the NIST SP 800-38A vectors and the client↔server pairing is tested against the real server, not in isolation.

bowire vulndb — the template cache (#26)

bowire vulndb update fetches the curated Kuestenlogik/Bowire.VulnDb template set into ~/.bowire/vulndb (latest GitHub release by default; --source for a checkout / tarball / URL and --ref to pin, for air-gapped and reproducible installs). bowire scan reads that cache by default, so an operator runs one update and then scans without repeating --templates. bowire vulndb list shows what's cached.

Monitoring — scheduled health probes (#102)

bowire monitor run <probes> runs saved recordings on a schedule, records every outcome to an append-only ledger, and signals on pass↔fail transitions through opt-in Slack, PagerDuty, and OTLP channels (bowire.monitoring.* instruments). A read-only Monitoring rail renders the live ledger — per-probe status, a latency sparkline, and the outcome history. Sessions resume their cadence across restarts.

Mock server — WireMock feature parity (#401–#411, #430)

The standalone mock server grows from happy-path replay into a full mocking tool: request-matching predicates (query / header / cookie, regex / glob paths, stub priority), body matchers (equalToJson / JSONPath / XPath / JSON-schema / regex), response templating (helpers / math / faker + bodyFileName + a transformer hook), a named scenario state machine, selective upstream proxy (proxyBaseUrl — mock some routes, forward the rest), fault injection (malformed chunks, faults on unmatched requests), HTTPS/TLS (+ a Docker image), per-stub admin CRUD on a running server, and a verification API (verify / findAll / near-misses).

AI-assisted security (#104–#107)

With Kuestenlogik.Bowire.Ai in the process, the Security rail gains an AI threat model (rank endpoints by attack surface), a JWT analyzer (deterministic claim-by-claim flags + an AI narrative), an OWASP API Top 10 panel (per-method status + a concrete probe per risk), a one-button scan that chains threat-model → templates → fuzz → triage → report, and a markdown security report from SARIF with diff-vs-baseline. The deterministic core always runs; the AI layer degrades gracefully when no model is connected.

Scanner foundations

Rounding out the lane: a headless auth-flow runner (bowire scan --auth-flow — login → token chain injected into every probe, secrets from {{env.NAME}}), CVE lookup against discovered server banners, HAR import (Chrome DevTools network tab → recordings, with secret redaction), an endpoint spider with confirm/ignore triage, a schema-aware mutation engine (bowire scan mutate), and Nuclei template compatibility including the Phase 2g DNS-transport translator. bowire scan treats SignalR / Socket.IO / MCP / gRPC / gRPC-Web as HTTP-class transports so their templates run.

Breaking changes

None. v2.3 is purely additive; every new surface is opt-in.

Acknowledgements

Thanks to everyone who exercised the security lane against real targets and reported sharp edges during the 2.3 cycle.

The full commit list, contributors, and compare-URL diff are auto-generated below.

What's Changed

Full Changelog: v2.2.1...v2.3.0

Contributors

dependabot and thomas-stegemann
Assets 75
Loading
0 Join discussion