<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Web Application Scanning

## nuclei CLI

| Command | Description |
|---|---|
| `nuclei -u <url> -tags <tags>` | Scan URL with template tags |
| `nuclei -l <urls.txt> -severity critical,high` | Bulk scan from URL list |
| `nuclei -u <url> -t <template-dir>` | Scan with custom templates |
| `nuclei -update-templates` | Update template repository |
| `nuclei -stats -json` | Output with statistics in JSON |

## OWASP ZAP Docker

| Command | Description |
|---|---|
| `zap-baseline.py -t <url>` | Passive-only baseline scan |
| `zap-full-scan.py -t <url>` | Full active + passive scan |
| `zap-api-scan.py -t <spec> -f openapi` | API scan from OpenAPI spec |
| `-J <file>` | JSON report output |
| `-n <context.xml>` | Authentication context file |

## Nikto CLI

| Command | Description |
|---|---|
| `nikto -h <target>` | Basic scan |
| `nikto -h <target> -ssl` | Force SSL |
| `nikto -h <target> -Tuning <N>` | Category-specific testing |
| `nikto -h <target> -Format json` | JSON output format |

## Agent Script

```bash
# nuclei OWASP scan
node agent.js nuclei https://target.example.com --tags owasp-top-10

# ZAP baseline
node agent.js zap https://target.example.com

# Nikto scan
node agent.js nikto https://target.example.com --tuning 1234

# Parse results
node agent.js parse nuclei_web.json
```
