vulkro probe
Confirms static findings by sending requests to a running copy of your app.
probe sends real attack traffic to --base-url. It can change data and trip rate limits. Run it only against a non-production target you are authorized to test.
vulkro probe . --base-url http://localhost:3000 --safe
vulkro probe . --base-url http://localhost:3000
It reads endpoints from the same extraction as scan, then tries to confirm each flagged issue. A confirmed finding is marked "runtime-confirmed via active probe". A disconfirmed one (for example an endpoint flagged unprotected that returns 401) is suppressed.
Flags
| Flag | Description |
|---|---|
--base-url <URL> | The running app. Required. |
--safe | Read-only: only auth bypass, CORS reflection and IDOR shape. No attack payloads. |
--auth-header <HEADER> | Full header, for example Authorization: Bearer ..., for IDOR probing. |
--allow-mutations | Allow POST, PUT, PATCH and DELETE, and the state-changing probes. |
--i-understand-this-is-active | Confirms authorization. Required with --allow-mutations when not on a terminal. |
--rate-limit-ms <MS> | Delay between per-endpoint bursts. Default 100. |
-f, --format <FORMAT> | Same formats as scan. |
Even with --allow-mutations, request bodies are empty and paths like /delete, /drop and /purge are skipped.
Probes
| Probe | Mode |
|---|---|
| Auth bypass, CORS reflection, IDOR shape | All modes, including --safe |
Reflected XSS, SSTI, parameter pollution, GraphQL suggestions, JWT alg=none, DNS rebinding | Default (not --safe) |
| Request smuggling, prototype pollution, NoSQL operator injection, race replay | --allow-mutations only |
Exit codes
0 nothing confirmed. 1 confirmed issues. 2 bad arguments, a refused or aborted destructive run, a network setup failure or a crash.
See also: vulkro prove, vulkro scan.