flags is a static class attribute, AST-preloaded by module_loader before any config is resolved. Some modules only touch the target in certain configurations, so a single static flag list can't describe them accurately.
wayback is declared flags = ["safe", "passive", "subdomain-enum"], but:
urls=False (default): queries archive.org's CDX API and emits DNS_NAMEs. Passive.urls=True: sends one HEAD / per discovered host to check liveness before emitting its URLs. Active.
Flags drive module selection (-f passive, -rf, --exclude-flags active), so -f passive -c modules.wayback.urls=true produces target traffic in a scan the user expects to be passive.
Separately, wayback.py:259 calls _is_http_wildcard_host() on every DNS_NAME regardless of urls, so it already probes targets in its default config.
Other modules with behavior-changing options may have the same problem; not audited.
flagsis a static class attribute, AST-preloaded bymodule_loaderbefore any config is resolved. Some modules only touch the target in certain configurations, so a single static flag list can't describe them accurately.waybackis declaredflags = ["safe", "passive", "subdomain-enum"], but:urls=False(default): queries archive.org's CDX API and emitsDNS_NAMEs. Passive.urls=True: sends oneHEAD /per discovered host to check liveness before emitting its URLs. Active.Flags drive module selection (
-f passive,-rf,--exclude-flags active), so-f passive -c modules.wayback.urls=trueproduces target traffic in a scan the user expects to be passive.Separately,
wayback.py:259calls_is_http_wildcard_host()on everyDNS_NAMEregardless ofurls, so it already probes targets in its default config.Other modules with behavior-changing options may have the same problem; not audited.