> ## Documentation Index > Fetch the complete documentation index at: https://docs.cystack.net/llms.txt > Use this file to discover all available pages before exploring further. # CLI Reference > Detailed command-line guide for activation, scanning, reports, Web UI startup, discovery, updates, and automation The VulnScan CLI provides the same core scanning engine as the Web UI. Use it for automation, scheduled jobs, CI/security pipelines, repeatable analyst workflows, offline preparation, and scripted report export. For interactive triage and team collaboration, use the Web UI first and then automate stable workflows with the CLI. ## Command Overview | Command | Purpose | | -------------- | ------------------------------------------------------------------------------------- | | `activate` | Activate a license key or offline activation file. | | `license` | Show current license status and limits. | | `fingerprint` | Print the host identifier for offline activation. | | `deactivate` | Release the license activation from the current machine. | | `web` | Start the Web UI server. | | `scan` | Run a vulnerability scan and export CSV, JSON, or PDF. | | `subdomain` | Enumerate subdomains for a domain. | | `prep-offline` | Prepare scanner artifacts and vulnerability intelligence for restricted environments. | | `update` | Update the VulnScan application and data where supported. | | `version` | Print version information. | ## Global Flags | Flag | Description | | --------------- | ------------------------------------------------------------------ | | `-c, --config` | Path to the configuration file. Default: `./configs/default.yaml`. | | `--log-level` | Log level: `debug`, `info`, `warn`, or `error`. | | `-v, --verbose` | Enable verbose output. | Use the same configuration file for Web UI and CLI workflows when CLI scan results should appear in the same workspace database. ## Activate Online activation: ```bash theme={null} vulnscan activate --license CYSTACK-XXXX-XXXX-XXXX-XXXX ``` Offline activation: ```bash theme={null} vulnscan fingerprint vulnscan activate --file activation.dat ``` Flags: | Flag | Description | | ----------- | -------------------------------------------- | | `--license` | License key supplied by CyStack. | | `--file` | Offline activation file supplied by CyStack. | Run `vulnscan license` after activation to verify target scope, expiration, activation count, and feature availability. ## License, Fingerprint, and Deactivation Show license status: ```bash theme={null} vulnscan license ``` Print the host identifier: ```bash theme={null} vulnscan fingerprint ``` Deactivate the current machine: ```bash theme={null} vulnscan deactivate ``` Deactivate before permanently moving VulnScan to another host so the activation can be reused according to the license policy. ## Start the Web UI Start on the default local address: ```bash theme={null} vulnscan web ``` Bind to a shared interface and set the data directory: ```bash theme={null} vulnscan web --bind 0.0.0.0:8080 --data-dir /var/lib/cystack-vulnscan ``` Flags: | Flag | Description | | ------------ | --------------------------------------------------------------------------------- | | `--bind` | Address and port for the Web UI server. | | `--data-dir` | Workspace data directory for database, reports, license state, and runtime files. | On first run, open the printed URL and create the initial administrator account. ## Scan The `scan` command runs discovery, fingerprinting, vulnerability detection, enrichment, deduplication, risk scoring, persistence, and report export. ### Scan One Target ```bash theme={null} vulnscan scan --target https://app.acme.com --output ./reports --format json,csv --lang en ``` ### Scan Multiple Targets ```bash theme={null} vulnscan scan --target https://app.acme.com --target https://api.acme.com --output ./reports --format json,csv ``` ### Scan From a Target File Create `targets.txt`: ```text theme={null} https://app.acme.com https://api.acme.com 203.0.113.21 203.0.113.0/28 ``` Run: ```bash theme={null} vulnscan scan --target-file ./targets.txt --output ./reports --format json,csv ``` ### Include Subdomains ```bash theme={null} vulnscan scan --target acme.com --include-subdomains --output ./reports --format json,csv ``` Use this for licensed root domains where you want broader external attack-surface coverage. ### Authenticated Web Scan Cookie-based session: ```bash theme={null} vulnscan scan --target https://portal.acme.com --cookie "session=REDACTED; tenant=acme" --output ./reports --format json,csv ``` Bearer token or API key: ```bash theme={null} vulnscan scan --target https://api.acme.com -H "Authorization: Bearer REDACTED" -H "X-Tenant: acme" --output ./reports --format json,csv ``` HTTP Basic Auth: ```bash theme={null} vulnscan scan --target https://staging.acme.com --basic-auth "scanner:REDACTED" --output ./reports --format json,csv ``` Use dedicated test accounts and avoid personal administrator sessions unless your assessment policy explicitly allows them. ### Generate Reports CSV and JSON: ```bash theme={null} vulnscan scan --target https://app.acme.com --output ./reports --format csv,json ``` PDF with English labels: ```bash theme={null} vulnscan scan --target https://app.acme.com --output ./reports --format pdf --lang en ``` PDF with Vietnamese labels where supported: ```bash theme={null} vulnscan scan --target https://app.acme.com --output ./reports --format pdf --lang vi ``` ### Scan Flags | Flag | Description | | ---------------------- | ------------------------------------------------------ | | `--target` | Target IP, CIDR, range, domain, or URL. Repeatable. | | `--target-file` | File containing one target per line. | | `--include-subdomains` | Discover and include subdomains for domain targets. | | `--cookie` | Cookie string used for authenticated web scanning. | | `--basic-auth` | HTTP Basic Auth credentials in `user:password` format. | | `-H, --header` | Custom HTTP header. Repeatable. | | `-o, --output` | Output directory for report files. | | `--format` | Report format list: `json`, `csv`, `pdf`. | | `--lang` | Report language: `en` or `vi`. | ## Subdomain Discovery Enumerate subdomains: ```bash theme={null} vulnscan subdomain --target acme.com ``` Return JSON: ```bash theme={null} vulnscan subdomain --target acme.com --json ``` Flags: | Flag | Description | | ---------- | --------------------------------- | | `--target` | Root domain to enumerate. | | `--json` | Output discovery results as JSON. | Use subdomain discovery before broad scans when you need to understand scope and target count. ## Offline Preparation Prepare scanner artifacts and vulnerability intelligence data for offline or pre-baked environments: ```bash theme={null} vulnscan prep-offline ``` Run this before moving an installation package into a restricted network. Offline deployments still need a valid license and update process. ## Update and Version Print version: ```bash theme={null} vulnscan version ``` Update VulnScan: ```bash theme={null} vulnscan update ``` Follow your organization's change-management process before updating production scanners. ## Automation Patterns ### Nightly External Scan ```bash theme={null} vulnscan scan --target-file ./production-targets.txt --include-subdomains --output ./nightly-reports --format json,csv --lang en ``` ### CI Security Gate ```bash theme={null} vulnscan scan --target https://staging.acme.com -H "Authorization: Bearer REDACTED" --output ./ci-reports --format json --log-level warn ``` ### Vietnamese Customer Report ```bash theme={null} vulnscan scan --target https://customer-portal.acme.com --output ./customer-report --format pdf --lang vi ``` ## CLI Quality Checklist * Use licensed targets only. * Keep the CLI configuration aligned with the Web UI workspace when data consistency is required. * Prefer target files for repeatable automation. * Use dedicated test credentials for authenticated scans. * Store reports in a controlled output directory. * Use JSON for integrations and CSV for remediation tracking. * Review high-severity results in the Web UI when collaborative triage is needed.