Skip to content
GitLab

Command line user interface · Changes

Page history
Updated Command-line-user-interface (markdown) authored by Tasos Laskos's avatar Tasos Laskos
Show whitespace changes
Inline Side-by-side
guides/user/Command-line-user-interface.md
View page @ 0f71221d
......@@ -110,13 +110,13 @@ in the [knowledge base](http://support.arachni-scanner.com/kb/).
* [Restrict paths (--scope-restrict-paths)](#scope-restrict-paths)
* [URL rewrite (--scope-url-rewrite)](#scope-url-rewrite)
* [HTTPS only (--scope-https-only)](#scope-https-only)
* [Auditor](#auditor)
* [Audit links (--audit-links/-g)](#audit-links)
* [Audit forms (--audit-forms/-p)](#audit-forms)
* [Audit cookies (--audit-cookies/-c)](#audit-cookies)
* [Exclude cookie (--exclude-cookie)](#exclude-cookie)
* [Exclude vector (--exclude-vector)](#exclude-vector)
* [Audit](#audit)
* [Audit links (--audit-links)](#audit-links)
* [Audit forms (--audit-forms)](#audit-forms)
* [Audit cookies (--audit-cookies)](#audit-cookies)
* [Audit headers (--audit-headers)](#audit-headers)
* [Exclude vector (--audit-exclude-vector)](#audit-exclude-vector)
* [include vector (--audit-include-vector)](#audit-include-vector)
* [Coverage](#coverage)
* [Audit cookies extensively (--audit-cookies-extensively)](#audit-cookies-extensively)
* [Fuzz methods (--fuzz-methods)](#fuzz-methods)
......@@ -601,7 +601,7 @@ This option allows you to load and run a saved profile.
**Multiple invocations?**: `yes`
Restricts the scope of the scan to resources whose URL matches any of the specified patterns.
Restricts the scope of the scan to resources whose URL matches the pattern.
<h3 id='scope-include-subdomains'><a href='#scope-include-subdomains'>Include subdomains (--scope-include-subdomains)</a></h3>
......@@ -622,7 +622,7 @@ Allow the system to include subdomains in the scan.
**Multiple invocations?**: `yes`
Excludes resources whose URL matches any of these patterns.
Excludes resources whose URL matches the pattern.
<h3 id='scope-exclude-content-pattern'><a href='#scope-exclude-content-pattern'>Exclude page by content (--scope-exclude-content-pattern)</a></h3>
......@@ -632,7 +632,7 @@ Excludes resources whose URL matches any of these patterns.
**Multiple invocations?**: `yes`
Excludes pages whose content matches any of the given patterns.
Excludes pages whose content matches the pattern.
<h3 id='scope-exclude-binaries'><a href='#scope-exclude-binaries'>Exclude binaries (--scope-exclude-binaries)</a></h3>
......@@ -789,9 +789,9 @@ Forces the system to only follow HTTPS URLs.
**Note**: The target URL must be an HTTPS one as well.
<h2 id='auditor'><a href='#auditor'>Auditor</a></h2>
<h2 id='audit'><a href='#audit'>Audit</a></h2>
<h3 id='audit-links'><a href='#audit-links'>Audit links (--audit-links/-g)</a></h3>
<h3 id='audit-links'><a href='#audit-links'>Audit links (--audit-links)</a></h3>
**Expects**: `<n/a>`
......@@ -800,9 +800,9 @@ Forces the system to only follow HTTPS URLs.
**Multiple invocations?**: `no`
Tells Arachni to audit the link elements of the page and their variables.
Enable auditing of links.
<h3 id='audit-forms'><a href='#audit-forms'>Audit forms (--audit-forms/-p)</a></h3>
<h3 id='audit-forms'><a href='#audit-forms'>Audit forms (--audit-forms)</a></h3>
**Expects**: `<n/a>`
......@@ -811,9 +811,9 @@ Tells Arachni to audit the link elements of the page and their variables.
**Multiple invocations?**: `no`
Tells Arachni to audit the form elements of the page and their inputs.
Enable auditing of forms.
<h3 id='audit-cookies'><a href='#audit-cookies'>Audit cookies (--audit-cookies/-c)</a></h3>
<h3 id='audit-cookies'><a href='#audit-cookies'>Audit cookies (--audit-cookies)</a></h3>
**Expects**: `<n/a>`
......@@ -822,54 +822,54 @@ Tells Arachni to audit the form elements of the page and their inputs.
**Multiple invocations?**: `no`
Tells Arachni to audit the cookies of the page.
Enable auditing of cookies.
<h3 id='exclude-cookie'><a href='#exclude-cookie'>Exclude cookie (--exclude-cookie)</a></h3>
<h3 id='audit-cookies-extensively'><a href='#audit-cookies-extensively'>Audit cookies extensively (--audit-cookies-extensively)</a></h3>
**Expects**: `cookie name`
**Expects**: `<n/a>`
**Default**: `disabled`
**Multiple invocations?**: `yes`
**Multiple invocations?**: `no`
Tells Arachni to exclude -- not audit -- a cookie by name.
Usually used to avoid auditing a session ID cookie from the cookie-jar.
**Note**: Even if you audit a session cookie Arachni will restore it to its original value right after auditing it.
However, some extra cautious websites may invalidate/block the session upon receiving an invalid token.
If enabled the system will submit all links and forms of the page along with the cookie permutations.
This is very unlikely but it's better to err on the side of caution.
**Warning**: Will severely increase the scan-time.
<h3 id='exclude-vector'><a href='#exclude-vector'>Exclude vector (--exclude-vector)</a></h3>
<h3 id='audit-headers'><a href='#audit-headers'>Audit headers (--audit-headers)</a></h3>
**Expects**: `input name`
**Expects**: `<n/a>`
**Default**: `disabled`
**Multiple invocations?**: `yes`
**Multiple invocations?**: `no`
Tells Arachni to exclude -- not audit -- an input vector by name.
Audit HTTP request headers.
<h3 id='audit-headers'><a href='#audit-headers'>Audit headers (--audit-headers)</a></h3>
**Note**: Header audits use brute force. Almost all valid HTTP request headers will be audited even if there's no indication that the web app uses them.
**Expects**: `<n/a>`
**Warning**: Enabling this option will result in increased requests, maybe by an order of magnitude.
**Default**: `disabled`
<h3 id='audit-link-template'><a href='#audit-link-template'>Link template (--audit-link-template)</a></h3>
**Multiple invocations?**: `no`
**Expects**: `pattern`
**Default**: `disabled`
**Multiple invocations?**: `yes`
Tells Arachni to audit the HTTP headers of the page.
This option allows you to extract and audit inputs from generic paths based on a specified template
in the form of a Ruby regular expression using names groups.
**Note**: Header audits use brute force. Almost all valid HTTP request headers will be audited even if there's no indication that the web app uses them.
<h3 id='audit-link-template_example'><a href='#audit-link-template_example'>Example</a></h3>
**Warning**: Enabling this option will result in increased requests, maybe by an order of magnitude.
To extract the `input1` and `input2` inputs from: `http://test.com/input1/value1/input2/value2`
<h2 id='coverage'><a href='#coverage'>Coverage</a></h2>
Use: `/input1\/(?<input1>\w+)\/input2\/(?<input2>\w+)/`
<h3 id='audit-cookies-extensively'><a href='#audit-cookies-extensively'>Audit cookies extensively (--audit-cookies-extensively)</a></h3>
<h3 id='audit-with-both-methods'><a href='#audit-with-both-methods'>With both methods (--audit-with-both-methods)</a></h3>
**Expects**: `<n/a>`
......@@ -878,23 +878,31 @@ Tells Arachni to audit the HTTP headers of the page.
**Multiple invocations?**: `no`
If enabled Arachni will submit all links and forms of the page along with the cookie permutations.
If enabled, the system will submit all elements using both `GET` and `POST` HTTP request methods.
**Warning**: Will severely increase the scan-time.
<h3 id='fuzz-methods'><a href='#fuzz-methods'>Fuzz methods (--fuzz-methods)</a></h3>
<h3 id='audit-exclude-vector'><a href='#audit-exclude-vector'>Exclude vector (--audit-exclude-vector)</a></h3>
**Expects**: `<n/a>`
**Expects**: `pattern`
**Default**: `disabled`
**Multiple invocations?**: `no`
**Multiple invocations?**: `yes`
If enabled Arachni will submit all links and forms using both the _GET_ and _POST_
HTTP request methods.
Don't audit input vectors whose name matches the pattern.
**Warning**: Will severely increase the scan-time.
<h3 id='audit-include-vector'><a href='#audit-include-vector'>Include vector (--audit-include-vector)</a></h3>
**Expects**: `pattern`
**Default**: `disabled`
**Multiple invocations?**: `yes`
Only audit input vectors whose name matches the pattern.
<h2 id='modules'><a href='#modules'>Modules</a></h2>
......