CLI Reference
Commands
The command layout stays explicit so the user can tell what the framework is about to do before it does it.
scan DOMAIN
Run the complete reconnaissance workflow from passive collection through findings and stored report bundles.
passive DOMAIN
Use passive sources only for a lower-noise first pass and save the result for later expansion.
ports TARGET
Run a fast connect-style validation pass without invoking the entire workflow.
portscan TARGET
Use the scanner engine directly with connect, syn, udp, ack, fin, null, xmas, window, maimon, ping, or service modes.
dns DOMAIN
Inspect naming, wildcard behavior, and DNS resolution data without broader probing.
workspace / track / viz / subs
Inspect stored workspaces, export graph views, compare changes over time, and list discovered subdomains.
keys SUBCOMMAND
Store, retrieve, list, or delete encrypted API keys used by passive sources and enrichers.
deploy / web / lab
Bring up the web control panel, local validation lab, or full local stack in one command.
about / explain / manual
Read framework guidance without leaving the terminal or switching to the website.
CLI Reference
Global Flags
These switches show up across multiple commands so the CLI feels consistent instead of fragmented.
| Flag | Meaning | Typical Use |
|---|---|---|
--threads N | Set worker concurrency | Control speed versus stability |
--format cli|txt|html|json|csv|pdf|docx|sarif|all | Select the output style | Switch between operator, report, export, or automation views |
--output PATH | Write reports to a specific location | Save a named artifact |
--monitor | Compare the run against recon memory | Track change over time |
--headless | Use browser-backed rendering where available | Handle JS-heavy targets |
--web-session | Launch the local browser control panel | Operate through the web UI |
--raw-backend auto|nping|builtin | Choose the raw TCP backend for raw-style scans | Use nping when SYN, FIN, NULL, or XMAS behavior matters |
--sudo | Attempt elevation for raw-style scan types | Let the CLI relaunch itself when raw packet access is required |
CLI Reference
Syntax Guide
The basic shape stays predictable: verb first, target second, then whatever tuning flags are needed.
shell
# General shape
$ asrfacet-rb COMMAND TARGET [--flags values]
# Examples
$ asrfacet-rb scan example.com --format html
$ asrfacet-rb passive example.com --threads 12
$ asrfacet-rb ports api.example.com --ports top100
$ asrfacet-rb portscan 192.0.2.10 --type syn --raw-backend nping --sudo
$ asrfacet-rb workspace list
$ asrfacet-rb deploy --public --web-port 8080
$ asrfacet-rb manual workflow
Operator Habit
When you are unsure, start with passive or lab before escalating to scan, and use portscan only when you need scanner-style control.