CLI Reference

The VulnScan CLI provides the same core scanning engine as the Web UI. Use it for automation, scheduled jobs, CI/security pipelines, repeatable analyst workflows, offline preparation, and scripted report export. For interactive triage and team collaboration, use the Web UI first and then automate stable workflows with the CLI.

Command Overview

Command	Purpose
`activate`	Activate a license key or offline activation file.
`license`	Show current license status and limits.
`fingerprint`	Print the host identifier for offline activation.
`deactivate`	Release the license activation from the current machine.
`web`	Start the Web UI server.
`scan`	Run a vulnerability scan and export CSV, JSON, or PDF.
`subdomain`	Enumerate subdomains for a domain.
`prep-offline`	Prepare scanner artifacts and vulnerability intelligence for restricted environments.
`update`	Update the VulnScan application and data where supported.
`version`	Print version information.

Global Flags

Flag	Description
`-c, --config`	Path to the configuration file. Default: `./configs/default.yaml`.
`--log-level`	Log level: `debug`, `info`, `warn`, or `error`.
`-v, --verbose`	Enable verbose output.

Use the same configuration file for Web UI and CLI workflows when CLI scan results should appear in the same workspace database.

Activate

Online activation:

vulnscan activate --license CYSTACK-XXXX-XXXX-XXXX-XXXX

Offline activation:

vulnscan fingerprint
vulnscan activate --file activation.dat

Flags:

Flag	Description
`--license`	License key supplied by CyStack.
`--file`	Offline activation file supplied by CyStack.

Run vulnscan license after activation to verify target scope, expiration, activation count, and feature availability.

License, Fingerprint, and Deactivation

Show license status:

vulnscan license

Print the host identifier:

vulnscan fingerprint

Deactivate the current machine:

vulnscan deactivate

Deactivate before permanently moving VulnScan to another host so the activation can be reused according to the license policy.

Start the Web UI

Start on the default local address:

vulnscan web

Bind to a shared interface and set the data directory:

vulnscan web --bind 0.0.0.0:8080 --data-dir /var/lib/cystack-vulnscan

Flags:

Flag	Description
`--bind`	Address and port for the Web UI server.
`--data-dir`	Workspace data directory for database, reports, license state, and runtime files.

On first run, open the printed URL and create the initial administrator account.

Scan

The scan command runs discovery, fingerprinting, vulnerability detection, enrichment, deduplication, risk scoring, persistence, and report export.

Scan One Target

vulnscan scan --target https://app.acme.com --output ./reports --format json,csv --lang en

Scan Multiple Targets

vulnscan scan --target https://app.acme.com --target https://api.acme.com --output ./reports --format json,csv

Scan From a Target File

Create targets.txt:

https://app.acme.com
https://api.acme.com
203.0.113.21
203.0.113.0/28

Run:

vulnscan scan --target-file ./targets.txt --output ./reports --format json,csv

Include Subdomains

vulnscan scan --target acme.com --include-subdomains --output ./reports --format json,csv

Use this for licensed root domains where you want broader external attack-surface coverage.

Authenticated Web Scan

Cookie-based session:

vulnscan scan --target https://portal.acme.com --cookie "session=REDACTED; tenant=acme" --output ./reports --format json,csv

Bearer token or API key:

vulnscan scan --target https://api.acme.com -H "Authorization: Bearer REDACTED" -H "X-Tenant: acme" --output ./reports --format json,csv

HTTP Basic Auth:

vulnscan scan --target https://staging.acme.com --basic-auth "scanner:REDACTED" --output ./reports --format json,csv

Use dedicated test accounts and avoid personal administrator sessions unless your assessment policy explicitly allows them.

Generate Reports

CSV and JSON:

vulnscan scan --target https://app.acme.com --output ./reports --format csv,json

PDF with English labels:

vulnscan scan --target https://app.acme.com --output ./reports --format pdf --lang en

PDF with Vietnamese labels where supported:

vulnscan scan --target https://app.acme.com --output ./reports --format pdf --lang vi

Scan Flags

Flag	Description
`--target`	Target IP, CIDR, range, domain, or URL. Repeatable.
`--target-file`	File containing one target per line.
`--include-subdomains`	Discover and include subdomains for domain targets.
`--cookie`	Cookie string used for authenticated web scanning.
`--basic-auth`	HTTP Basic Auth credentials in `user:password` format.
`-H, --header`	Custom HTTP header. Repeatable.
`-o, --output`	Output directory for report files.
`--format`	Report format list: `json`, `csv`, `pdf`.
`--lang`	Report language: `en` or `vi`.

Subdomain Discovery

Enumerate subdomains:

vulnscan subdomain --target acme.com

Return JSON:

vulnscan subdomain --target acme.com --json

Flags:

Flag	Description
`--target`	Root domain to enumerate.
`--json`	Output discovery results as JSON.

Use subdomain discovery before broad scans when you need to understand scope and target count.

Offline Preparation

Prepare scanner artifacts and vulnerability intelligence data for offline or pre-baked environments:

vulnscan prep-offline

Run this before moving an installation package into a restricted network. Offline deployments still need a valid license and update process.

Update and Version

Print version:

vulnscan version

Update VulnScan:

vulnscan update

Follow your organization’s change-management process before updating production scanners.

Automation Patterns

Nightly External Scan

vulnscan scan --target-file ./production-targets.txt --include-subdomains --output ./nightly-reports --format json,csv --lang en

CI Security Gate

vulnscan scan --target https://staging.acme.com -H "Authorization: Bearer REDACTED" --output ./ci-reports --format json --log-level warn

Vietnamese Customer Report

vulnscan scan --target https://customer-portal.acme.com --output ./customer-report --format pdf --lang vi

CLI Quality Checklist

Use licensed targets only.
Keep the CLI configuration aligned with the Web UI workspace when data consistency is required.
Prefer target files for repeatable automation.
Use dedicated test credentials for authenticated scans.
Store reports in a controlled output directory.
Use JSON for integrations and CSV for remediation tracking.
Review high-severity results in the Web UI when collaborative triage is needed.

Introduction

Getting started

Vulnerability scanning

WAF — Web Application Firewall

Automation & CLI

Security reference

Administration & operations

Command Overview

Global Flags

Activate

License, Fingerprint, and Deactivation

Start the Web UI

Scan

Scan One Target

Scan Multiple Targets

Scan From a Target File

Include Subdomains

Authenticated Web Scan

Generate Reports

Scan Flags

Subdomain Discovery

Offline Preparation

Update and Version

Automation Patterns

Nightly External Scan

CI Security Gate

Vietnamese Customer Report

CLI Quality Checklist

​Command Overview

​Global Flags

​Activate

​License, Fingerprint, and Deactivation

​Start the Web UI

​Scan

​Scan One Target

​Scan Multiple Targets

​Scan From a Target File

​Include Subdomains

​Authenticated Web Scan

​Generate Reports

​Scan Flags

​Subdomain Discovery

​Offline Preparation

​Update and Version

​Automation Patterns

​Nightly External Scan

​CI Security Gate

​Vietnamese Customer Report

​CLI Quality Checklist

Command Overview

Global Flags

Activate

License, Fingerprint, and Deactivation

Start the Web UI

Scan

Scan One Target

Scan Multiple Targets

Scan From a Target File

Include Subdomains

Authenticated Web Scan

Generate Reports

Scan Flags

Subdomain Discovery

Offline Preparation

Update and Version

Automation Patterns

Nightly External Scan

CI Security Gate

Vietnamese Customer Report

CLI Quality Checklist