| ... | ... | @@ -153,16 +153,20 @@ in your gems path._ |
|
|
|
|
|
|
|
<h3 id='version'><a href='#version'>Version (--version)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Outputs the Arachni banner and version information.
|
|
|
|
|
|
|
|
<h3 id='verbosity'><a href='#verbosity'>Verbosity (-v)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
When verbosity is enabled Arachni will give you detailed information about what's going on during the whole process.
|
| ... | ... | @@ -280,8 +284,10 @@ Arachni - Web Application Security Scanner Framework v0.4.2 |
|
|
|
|
|
|
|
<h3 id='debug'><a href='debug'>Debug mode (--debug)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
When this flag is enabled the system will output a lot of messages detailing what's happening internally.
|
| ... | ... | @@ -394,16 +400,20 @@ $ cat debug.log |
|
|
|
|
|
|
|
<h3 id='only-positives'><a href='#only-positives'>Only positives (--only-positives)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
This will suppress all messages except for positive matches -- vulnerabilities.
|
|
|
|
|
|
|
|
<h3 id='http-req-limit'><a href='#http-req-limit'>HTTP request limit (--http-req-limit)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: integer
|
|
|
|
*Default*: 60
|
|
|
|
**Expects**: integer
|
|
|
|
|
|
|
|
**Default**: 60
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Limit how many concurrent HTTP request are sent.
|
| ... | ... | @@ -414,16 +424,20 @@ Limit how many concurrent HTTP request are sent. |
|
|
|
|
|
|
|
<h3 id='http-timeout'><a href='#http-timeout'>HTTP timeout (--http-timeout)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: integer (milliseconds)
|
|
|
|
*Default*: 50000
|
|
|
|
**Expects**: integer (milliseconds)
|
|
|
|
|
|
|
|
**Default**: 50000
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Limit how long the HTTP client should wait for a response from the server.
|
|
|
|
|
|
|
|
<h3 id='https-only'><a href='#https-only'>HTTP timeout (--https-only)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Forces the system to only follow HTTPS URLs.
|
| ... | ... | @@ -431,8 +445,10 @@ _(Target URL must be an HTTPS one as well.)_ |
|
|
|
|
|
|
|
<h3 id='cookie-jar'><a href='#cookie-jar'>Cookie jar (--cookie-jar)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: cookiejar file
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: cookiejar file
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Arachni allows you to pass your own cookies in the form of a Netscape cookie-jar file.
|
| ... | ... | @@ -446,8 +462,10 @@ You should also take a look at the _--exclude-cookie_ option discussed later. |
|
|
|
|
|
|
|
<h3 id='cookie-string'><a href='#cookie-string'>Cookie string (--cookie-string)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: string
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: string
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Cookies, as a string, to be sent to the web application.
|
| ... | ... | @@ -460,8 +478,10 @@ Cookies, as a string, to be sent to the web application. |
|
|
|
|
|
|
|
<h3 id='user-agent'><a href='#user-agent'>User agent (--user-agent)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: string
|
|
|
|
*Default*: "Arachni/<version>"
|
|
|
|
**Expects**: string
|
|
|
|
|
|
|
|
**Default**: "Arachni/<version>"
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
You can pass your own user agent string which will be sent to the webserver under audit.
|
| ... | ... | @@ -469,8 +489,10 @@ Default is _Arachni/<version>_. |
|
|
|
|
|
|
|
<h3 id='custom-header'><a href='#custom-header'>Custom header (--custom-header)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: string
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: string
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Allows you to specify custom headers in the form of key-value pairs.
|
| ... | ... | @@ -484,8 +506,10 @@ Allows you to specify custom headers in the form of key-value pairs. |
|
|
|
|
|
|
|
<h3 id='authed-by'><a href='#authed-by'>Authorized by (--authed-by)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: string
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: string
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
The string passed to this option will be included in the user-agent string and be the value of the "From" HTTP header field.
|
| ... | ... | @@ -500,8 +524,10 @@ The _--authed-by_ value should contain information about the person who authoriz |
|
|
|
|
|
|
|
<h3 id='login-check-url'><a href='#login-check-url'>Login check URL (--login-check-url)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: string
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: string
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
*Requires*: "login-check-pattern":#login-check-pattern
|
|
|
|
|
| ... | ... | @@ -513,8 +539,10 @@ this should indicate that the scanner is logged in. |
|
|
|
|
|
|
|
<h3 id='login-check-pattern'><a href='#login-check-pattern'>Login check pattern (--login-check-pattern)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: string
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: string
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
*Requires*: "login-check-url":#login-check-url
|
|
|
|
|
| ... | ... | @@ -527,8 +555,10 @@ A positive match should indicate that the scanner is logged in. |
|
|
|
|
|
|
|
<h3 id='save-profile'><a href='#save-profile'>Save profile (--save-profile)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: filename
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: filename
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
This option allows you to save your current running configuration, all the options passed to Arachni, to an Arachni Framework Profile (.afp) file.
|
| ... | ... | @@ -542,8 +572,10 @@ This option allows you to save your current running configuration, all the optio |
|
|
|
|
|
|
|
<h3 id='load-profile'><a href='#load-profile'>Load profile (--load-profile)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: Arachni Framework Profile (.afp) file
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: Arachni Framework Profile (.afp) file
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
This option allows you to load and run a saved profile.
|
| ... | ... | @@ -557,8 +589,10 @@ The load profile option does not restrict your ability to specify more options o |
|
|
|
|
|
|
|
<h3 id='show-profile'><a href='#show-profile'>Show profile (--show-profile)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
This option will output the running configuration as a string of command line arguments.
|
| ... | ... | @@ -572,8 +606,10 @@ This option will output the running configuration as a string of command line ar |
|
|
|
|
|
|
|
<h3 id='exclude'><a href='#exclude'>Exclude (--exclude/-e)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: regexp
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: regexp
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
The _--exclude_ option expects a regular expression or plain string and excludes URLs matching that expression from the crawling process.
|
| ... | ... | @@ -668,8 +704,10 @@ Arachni - Web Application Security Scanner Framework v0.4.2 |
|
|
|
|
|
|
|
<h3 id='exclude-page'><a href='#exclude-page'>Exclude page by content (--exclude-page)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: regexp
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: regexp
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
The _--exclude-page_ option expects a regular expression or plain string
|
| ... | ... | @@ -677,8 +715,10 @@ and excludes pages whose content matching that expression from the crawl process |
|
|
|
|
|
|
|
<h3 id='include'><a href='#include'>Include (--include/-i)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: regexp
|
|
|
|
*Default*: '.*'
|
|
|
|
**Expects**: regexp
|
|
|
|
|
|
|
|
**Default**: '.*'
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
This is the exact oposite of the _--exclude_ option.
|
| ... | ... | @@ -686,8 +726,10 @@ When a regular expression is passed to the _--include_ option, *only* URLs match |
|
|
|
|
|
|
|
<h3 id='redundant'><a href='#redundant'>Redundant (--redundant)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: regexp:integer
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: regexp:integer
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
The redundant option expects a regular expression and a counter, like so:
|
| ... | ... | @@ -701,8 +743,10 @@ This option is useful when auditing a website that has a lot of redundant pages |
|
|
|
|
|
|
|
<h3 id='auto-redundant'><a href='#auto-redundant'>Auto-redundant (--auto-redundant)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: integer
|
|
|
|
*Default*: disabled (with a value of 10 if none has been specified)
|
|
|
|
**Expects**: integer
|
|
|
|
|
|
|
|
**Default**: disabled (with a value of 10 if none has been specified)
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
The auto-redundant option sets the limit of how many URLs with identical parameters
|
| ... | ... | @@ -735,40 +779,50 @@ http://test.com/path.php?stuff=blah&stuff2=1 |
|
|
|
|
|
|
|
<h3 id='follow-subdomains'><a href='#follow-subdomains'>Follow subdomains (-f/--follow-subdomains)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
This flag will cause Arachni to follow links to subdomains.
|
|
|
|
|
|
|
|
<h3 id='depth'><a href='#depth'>Depth limit (--depth)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: integer
|
|
|
|
*Default*: infinite
|
|
|
|
**Expects**: integer
|
|
|
|
|
|
|
|
**Default**: infinite
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
It specifies how deep into the site structure the crawler should go.
|
|
|
|
|
|
|
|
<h3 id='link-count'><a href='#link-count'>Link count limit (--link-count)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: integer
|
|
|
|
*Default*: infinite
|
|
|
|
**Expects**: integer
|
|
|
|
|
|
|
|
**Default**: infinite
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
It specifies how many links the crawler should follow.
|
|
|
|
|
|
|
|
<h3 id='redirect-limit'><a href='#redirect-limit'>Redirect limit (--redirect-limit)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: integer
|
|
|
|
*Default*: infinite
|
|
|
|
**Expects**: integer
|
|
|
|
|
|
|
|
**Default**: infinite
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
It specifies how many redirects the crawler should follow.
|
|
|
|
|
|
|
|
<h3 id='extend-paths'><a href='#extend-paths'>Extend paths (--extend-paths)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: file
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: file
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Allows you to extend the scope of the audit by supplementing the paths discovered by the crawler with the paths in the file.
|
| ... | ... | @@ -776,8 +830,10 @@ The file must contains one path per line. |
|
|
|
|
|
|
|
<h3 id='restrict-paths'><a href='#restrict-paths'>Restrict paths (--restrict-paths)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: file
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: file
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Uses the paths contained in file instead of performing a crawl.
|
| ... | ... | @@ -787,32 +843,40 @@ Uses the paths contained in file instead of performing a crawl. |
|
|
|
|
|
|
|
<h3 id='audit-links'><a href='#audit-links'>Audit links (--audit-links/-g)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni to audit the link elements of the page and their variables.
|
|
|
|
|
|
|
|
<h3 id='audit-forms'><a href='#audit-forms'>Audit forms (--audit-forms/-p)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni to audit the form elements of the page and their inputs.
|
|
|
|
|
|
|
|
<h3 id='audit-cookies'><a href='#audit-cookies'>Audit cookies (--audit-cookies/-c)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni to audit the cookies of the page.
|
|
|
|
|
|
|
|
<h3 id='exclude-cookie'><a href='#exclude-cookie'>Exclude cookie (--exclude-cookie)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: cookie name
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: cookie name
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Tells Arachni to exclude -- not audit -- a cookie by name.
|
| ... | ... | @@ -824,16 +888,20 @@ This is very unlikely but it's better to err on the side of caution. |
|
|
|
|
|
|
|
<h3 id='exclude-vector'><a href='#exclude-vector'>Exclude cookie (--exclude-vector)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: input name
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: input name
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Tells Arachni to exclude -- not audit -- an input vector by name.
|
|
|
|
|
|
|
|
<h3 id='audit-headers'><a href='#audit-headers'>Audit headers (--audit-headers)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni to audit the HTTP headers of the page.
|
| ... | ... | @@ -845,8 +913,10 @@ Tells Arachni to audit the HTTP headers of the page. |
|
|
|
|
|
|
|
<h3 id='audit-cookies-extensively'><a href='#audit-cookies-extensively'>Audit cookies extensively (--audit-cookies-extensively)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
If enabled Arachni will submit all links and forms of the page along with the cookie permutations.
|
| ... | ... | @@ -855,8 +925,10 @@ If enabled Arachni will submit all links and forms of the page along with the co |
|
|
|
|
|
|
|
<h3 id='fuzz-methods'><a href='#fuzz-methods'>Fuzz methods (--fuzz-methods)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
If enabled Arachni will submit all links and forms using both the _GET_ and _POST_
|
| ... | ... | @@ -866,8 +938,10 @@ HTTP request methods. |
|
|
|
|
|
|
|
<h3 id='exclude-binaries'><a href='#exclude-binaries'>Exclude binaries (--exclude-binaries)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Disables inclusion of binary HTTP response bodies in the audit.
|
| ... | ... | @@ -878,8 +952,10 @@ Disables inclusion of binary HTTP response bodies in the audit. |
|
|
|
|
|
|
|
<h3 id='lsmod'><a href='#lsmod'>List modules (--lsmod)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: regular expression
|
|
|
|
*Default*: disabled OR .*
|
|
|
|
**Expects**: regular expression
|
|
|
|
|
|
|
|
**Default**: disabled OR .*
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Tells Arachni to list all available modules based on the regular expressions provided and exit.
|
| ... | ... | @@ -1016,8 +1092,10 @@ Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/modules/audit/xs |
|
|
|
|
|
|
|
<h3 id='modules'><a href='#modules'>Modules (--modules/-m)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: modname,modname,... OR '*'
|
|
|
|
*Default*: '*' -- all modules
|
|
|
|
**Expects**: modname,modname,... OR '*'
|
|
|
|
|
|
|
|
**Default**: '*' -- all modules
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni which modules to load.
|
| ... | ... | @@ -1054,8 +1132,10 @@ The above will load all modules except for the 'backup_files' and 'xss' modules. |
|
|
|
|
|
|
|
<h3 id='lsrep'><a href='#lsrep'>List reports (--lsrep)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Lists all available reports.
|
| ... | ... | @@ -1221,8 +1301,10 @@ Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/stdout.r |
|
|
|
|
|
|
|
<h3 id='repload'><a href='#repload'>Load a report (--repload)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: Arachni Framework Report (.afr) file
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: Arachni Framework Report (.afr) file
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni to load an Arachni Framework Report (.afr) file.
|
| ... | ... | @@ -1373,8 +1455,10 @@ Arachni - Web Application Security Scanner Framework v0.4.2 |
|
|
|
|
|
|
|
<h3 id='report'><a href='#report'>Report (--report)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: repname
|
|
|
|
*Default*: stdout
|
|
|
|
**Expects**: repname
|
|
|
|
|
|
|
|
**Default**: stdout
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Tells Arachni which report component to use.
|
| ... | ... | @@ -1483,8 +1567,10 @@ Arachni - Web Application Security Scanner Framework v0.4.2 |
|
|
|
|
|
|
|
<h3 id='lsplug'><a href='#lsplug'>List plugins (--lsplug)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: <n/a>
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Lists all available plugins.
|
| ... | ... | @@ -1979,8 +2065,10 @@ Path: /home/zapotek/workspace/arachni/plugins/form_dicattack.rb |
|
|
|
|
|
|
|
<h3 id='plugin'><a href='#plugin'>Plugin (--plugin)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: plugin name
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: plugin name
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Tells Arachni which plugin components to run.
|
| ... | ... | @@ -2285,24 +2373,30 @@ Arachni - Web Application Security Scanner Framework v0.4.2 |
|
|
|
|
|
|
|
<h3 id='proxy_server'><a href='#proxy_server'>Proxy server (--proxy)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: server:port
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: server:port
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni to send all requests via a proxy server.
|
|
|
|
|
|
|
|
<h3 id='proxy-auth'><a href='#proxy-auth'>Proxy authentication (--proxy-auth)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: username:password
|
|
|
|
*Default*: disabled
|
|
|
|
**Expects**: username:password
|
|
|
|
|
|
|
|
**Default**: disabled
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni authenticate itself with the proxy server using the supplied username and password.
|
|
|
|
|
|
|
|
<h3 id='proxy-type'><a href='#proxy-type'>Proxy type (--proxy-type)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: http, http_1_0, socks4, socks5, socks4a
|
|
|
|
*Default*: disabled OR http
|
|
|
|
**Expects**: http, http_1_0, socks4, socks5, socks4a
|
|
|
|
|
|
|
|
**Default**: disabled OR http
|
|
|
|
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni what protocol to use to connect and comunicate with the proxy server.
|
| ... | ... | |
