Skip to content
hbs-tool.
Documentation03 of 07

Extractor reference

Every flag, exit code, and the strict read-only guarantee of the hbs-extractor binary.

≈ 2 min read

Build

cd extractor
cargo build               # debug (includes the hidden --dev-insecure-key)
cargo build --release     # LTO, stripped, panic=abort, opt-level=z

Command-line flags

FlagMeaning
--list-checksPrint every registered testcase (id, severity, category, title) and exit
--only <IDS>Run only these check IDs (comma-separated)
--category <NAME>Run only one category (e.g. SSH, Account Policy, Server Config)
--min-severity <LEVEL>Skip checks below critical | high | medium | low | informational
--out <PATH>Report path. Default: beside the extractor binary, never the CWD
--push <URL>Also POST the sealed report to a dashboard (http(s)://…/api/ingest)
--push-token-file <PATH>Read-only file with the push token (mutually exclusive with HBS_PUSH_TOKEN)
--elevateAsk once for elevation to run admin-only checks (Windows UAC; Linux guidance)
--no-elevateNever request elevation
--no-pauseDo not pause at the end (scripted/CI runs)
--quietSuppress progress output (machine-readable lines)

Note

Hidden/internal: --elevated-child (relaunch guard) and, debug builds only, --dev-insecure-key <64-hex> - never present in release builds.

Environment variables

VariableEffect
HBS_PUSH_TOKENPush token (only read when --push is used)

Supplying both HBS_PUSH_TOKEN and --push-token-file is an error. The token never appears in argv, the URL, logs, the self-audit, the report, or the keyslot.

Output & exit codes

  • Output: one sealed .hbs file, written next to the extractor binary by default, or to --out. It is the only file written on the target.
  • 0 - success
  • 2 - unissued/placeholder or expired keyslot
  • 3 - no checks matched the filters, sealing/write failure, or push-token configuration error
  • A network push failure does not fail the scan: the local report is kept and the summary shows a push-failed status.

Least privilege

Scans always start unprivileged. Admin-only checks run only under an explicit --elevate (a single Windows UAC consent; Linux never invokes sudo). Declined elevation does not abort: remaining checks use read-only fallbacks and unresolved results become DegradedPartial.

Strict read-only guarantee

Only query-style, allowlisted commands run; secedit /export, temp-file exports, redirects, shell interpreters, and state-changing or network-capable probes are rejected before spawn. DNS/remote forms are refused. The single write on the target is the sealed report. Every attempted read/command is recorded before it happens and included in the report.