|
|
|
## Version 0.4.2
|
|
|
|
|
|
|
|
There are a lot of options, customizations and tweaks you can use but fear not and don't let yourself be overwhelmed.
|
|
|
|
|
|
|
|
This guide will walk you through each and every one of them and teach you how to use them in order to make your scans as efficient as possible.
|
|
|
|
|
|
|
|
_If you intend to scan big and complex sites it's best that you read through this guide and evaluate all available options._
|
|
|
|
|
|
|
|
### Quickstart
|
|
|
|
|
|
|
|
#### Help
|
|
|
|
|
|
|
|
In order to see everything Arachni has to offer execute:
|
|
|
|
|
|
|
|
$ arachni -h
|
|
|
|
|
|
|
|
#### Examples
|
|
|
|
|
|
|
|
You can simply run Arachni like so:
|
|
|
|
|
|
|
|
$ arachni http://test.com
|
|
|
|
|
|
|
|
which will load all modules, the plugins under `/plugins/defaults` and audit
|
|
|
|
all forms, links and cookies.
|
|
|
|
|
|
|
|
In the following example all modules will be run against _http://test.com_,
|
|
|
|
auditing links/forms/cookies and following subdomains --with verbose output enabled.
|
|
|
|
|
|
|
|
The results of the audit will be saved in the the file _test.com.afr_.
|
|
|
|
|
|
|
|
$ arachni -fv http://test.com --report=afr:outfile=test.com.afr
|
|
|
|
|
|
|
|
The Arachni Framework Report (.afr) file can later be loaded by Arachni to
|
|
|
|
create a report, like so:
|
|
|
|
|
|
|
|
$ arachni --repload=test.com.afr --report=html:outfile=my_report.html
|
|
|
|
|
|
|
|
or any other report type as shown by:
|
|
|
|
|
|
|
|
$ arachni --lsrep
|
|
|
|
|
|
|
|
#### You can make module loading easier by using wildcards (*) and exclusions (-).
|
|
|
|
|
|
|
|
To load all `xss` modules using a wildcard:
|
|
|
|
|
|
|
|
$ arachni http://example.net --modules=xss*
|
|
|
|
|
|
|
|
To load all _audit_ modules using a wildcard:
|
|
|
|
|
|
|
|
$ arachni http://example.net --modules=audit/*
|
|
|
|
|
|
|
|
To exclude only the _csrf_ module:
|
|
|
|
|
|
|
|
$ arachni http://example.net --modules=*,-csrf
|
|
|
|
|
|
|
|
Or you can mix and match; to run everything but the _xss_ modules:
|
|
|
|
|
|
|
|
$ arachni http://example.net --modules=*,-xss*
|
|
|
|
|
|
|
|
#### Performing a full scan quickly
|
|
|
|
|
|
|
|
The _full_ profile adds header auditing to the defaults.
|
|
|
|
|
|
|
|
_NOTICE: Auditing headers can increase scan time by an order of magnitude
|
|
|
|
(depending on the website) and may be considered over-the-top in most scenarios._
|
|
|
|
|
|
|
|
You can use it like so:
|
|
|
|
|
|
|
|
$ arachni --load-profile=profiles/full.afp http://example.net
|
|
|
|
|
|
|
|
|
|
|
|
_If you installed the Gem then you'll have to look for the "profiles" directory
|
|
|
|
in your gems path._
|
|
|
|
|
|
|
|
### Command reference
|
|
|
|
|
|
|
|
[Command Line Interface help output](#cli_help_output)
|
|
|
|
|
|
|
|
* [General](#general)
|
|
|
|
* [Version (--version)](#version)
|
|
|
|
* [Verbosity (-v)](#verbosity)
|
|
|
|
* [Example](#verbosity_example)
|
|
|
|
* [Debug mode (--debug)](#debug)
|
|
|
|
* [Only positives (--only-positives)](#only-positives)
|
|
|
|
* [HTTP request limit (--http-req-limit)](#http-req-limit)
|
|
|
|
* [HTTP request timeout (--http-timeout)](#http-timeout)
|
|
|
|
* [HTTPS only (--https-only)](#https-only)
|
|
|
|
* [Cookie jar (--cookie-jar)](#cookie-jar)
|
|
|
|
* [Cookie string (--cookie-string)](#cookie-string)
|
|
|
|
* [User agent (--user-agent)](#user-agent)
|
|
|
|
* [Custom header (--custom-header)](#custom-header)
|
|
|
|
* [Example](#custom-header_example)
|
|
|
|
* [Authorized by (--authed-by)](#authed-by)
|
|
|
|
* [Example](#authed-by_example)
|
|
|
|
* [Login check URL (--login-check-url)](#login-check-url)
|
|
|
|
* [Login check pattern (--login-check-pattern)](#login-check-pattern)
|
|
|
|
* [Profiles](#profiles)
|
|
|
|
* [Save profile (--save-profile)](#save-profile)
|
|
|
|
* [Example](#save-profile_example)
|
|
|
|
* [Load profile (--load-profile)](#load-profile)
|
|
|
|
* [Example](#load-profile_example)
|
|
|
|
* [Show profile (--show-profile)](#show-profile)
|
|
|
|
* [Example](#show-profile_example)
|
|
|
|
* [Crawler](#crawler)
|
|
|
|
* [Exclude (--exclude/-e)](#exclude)
|
|
|
|
* [Example](#exclude_example)
|
|
|
|
* [Exclude page by content (--exclude-page)](#exclude-page)
|
|
|
|
* [Example](#exclude-page_example)
|
|
|
|
* [Include (--include/-i)](#include)
|
|
|
|
* [Redundant (--redundant)](#redundant)
|
|
|
|
* [Audo-redundant (--auto-redundant)](#auto-redundant)
|
|
|
|
* [Example](#auto-redundant_example)
|
|
|
|
* [Follow subdomains (-f/--follow-subdomains)](#follow-subdomains)
|
|
|
|
* [Depth limit (--depth)](#depth)
|
|
|
|
* [Link count limit (--link-count)](#link-count)
|
|
|
|
* [Redirect limit (--redirect-limit)](#redirect-limit)
|
|
|
|
* [Extend paths (--extend-paths)](#extend-paths)
|
|
|
|
* [Restrict paths (--restrict-paths)](#restrict-paths)
|
|
|
|
* [Auditor](#auditor)
|
|
|
|
* [Audit links (--audit-links/-g)](#audit-links)
|
|
|
|
* [Audit forms (--audit-forms/-p)](#audit-forms)
|
|
|
|
* [Audit cookies (--audit-cookies/-c)](#audit-cookies)
|
|
|
|
* [Exclude cookie (--exclude-cookie)](#exclude-cookie)
|
|
|
|
* [Exclude vector (--exclude-vector)](#exclude-vector)
|
|
|
|
* [Audit headers (--audit-headers)](#audit-headers)
|
|
|
|
* [Coverage](#coverage)
|
|
|
|
* [Audit cookies extensively (--audit-cookies-extensively)](#audit-cookies-extensively)
|
|
|
|
* [Fuzz methods (--fuzz-methods)](#fuzz-methods)
|
|
|
|
* [Exclude binaries (--exclude-binaries)](#exclude-binaries)
|
|
|
|
* [Modules](#modules)
|
|
|
|
* [List modules (--lsmod)](#lsmod)
|
|
|
|
* [Example](#lsmod_example)
|
|
|
|
* [Modules (--modules/-m)](#modules)
|
|
|
|
* [Example](#mods_example)
|
|
|
|
* [Reports](#reports)
|
|
|
|
* [List reports (--lsrep)](#lsrep)
|
|
|
|
* [Example](#lsrep_example)
|
|
|
|
* [Load a report (--repload)](#repload)
|
|
|
|
* [Example](#repload_example)
|
|
|
|
* [Report (--report)](#report)
|
|
|
|
* [Example](#report_example)
|
|
|
|
* [Plugins](#plugins)
|
|
|
|
* [List plugins (--lsplug)](#lsplug)
|
|
|
|
* [Example](#lsplug_example)
|
|
|
|
* [Load a plugin (--plugin)](#plugin)
|
|
|
|
* [Example](#plugin_example)
|
|
|
|
* [Proxy](#proxy)
|
|
|
|
* [Proxy server (--proxy)](#proxy_server)
|
|
|
|
* [Proxy authentication (--proxy-auth)](#proxy-auth)
|
|
|
|
* [Proxy type (--proxy-type)](#proxy-type)
|
|
|
|
|
|
|
|
<h2 id='general'><a href='#general'>General</a></h2>
|
|
|
|
|
|
|
|
<h3 id='version'><a href='#version'>Version (--version)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Outputs the Arachni banner and version information.
|
|
|
|
|
|
|
|
<h3 id='verbosity'><a href='#verbosity'>Verbosity (-v)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
When verbosity is enabled Arachni will give you detailed information about what's going on during the whole process.
|
|
|
|
|
|
|
|
<h4 id='verbosity_example'><a href='#verbosity_example'>Example</a></h4>
|
|
|
|
|
|
|
|
Let's give this a try:
|
|
|
|
|
|
|
|
```arachni --audit-forms --modules=xss http://testfire.net/ --link-count=1```
|
|
|
|
|
|
|
|
|
|
|
|
This will load the XSS module and audit all the forms in "http://testfire.net/".
|
|
|
|
|
|
|
|
*Verbose mode disabled*
|
|
|
|
|
|
|
|
Observe that there's no _-v_ flag in the following run.
|
|
|
|
_Don't worry about the rest of the parameters right now._
|
|
|
|
|
|
|
|
*Quick note:*
|
|
|
|
Arachni's output messages are classified into several categories, each of them prefixed with a different colored symbol.
|
|
|
|
"[*]" messages are status messages.
|
|
|
|
"[+]" messages are "ok" messages - positive matches.
|
|
|
|
_I won't bother with coloring during the examples._
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
Arachni - Web Application Security Scanner Framework v0.4.2
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
|
|
|
|
(With the support of the community and the Arachni Team.)
|
|
|
|
|
|
|
|
Website: http://arachni-scanner.com
|
|
|
|
Documentation: http://arachni-scanner.com/wiki
|
|
|
|
|
|
|
|
|
|
|
|
[*] Initialising...
|
|
|
|
[*] Waiting for plugins to settle...
|
|
|
|
[*] [HTTP: 200] http://testfire.net/
|
|
|
|
[*] Harvesting HTTP responses...
|
|
|
|
[~] Depending on server responsiveness and network conditions this may take a while.
|
|
|
|
|
|
|
|
[*] Auditing: [HTTP: 200] http://testfire.net/
|
|
|
|
[*] Profiler: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] Profiler: Auditing form variable '__original_values__' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] Profiler: Auditing form variable '__sample_values__' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] XSS: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] XSS: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] XSS: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] Harvesting HTTP responses...
|
|
|
|
[~] Depending on server responsiveness and network conditions this may take a while.
|
|
|
|
[*] Profiler: Analyzing response #3...
|
|
|
|
[~] Trainer: Found 1 new links.
|
|
|
|
[*] Profiler: Analyzing response #4...
|
|
|
|
[*] Profiler: Analyzing response #5...
|
|
|
|
[*] XSS: Analyzing response #6...
|
|
|
|
[+] XSS: In form var 'txtSearch' ( http://testfire.net/search.aspx )
|
|
|
|
[*] XSS: Analyzing response #7...
|
|
|
|
[+] XSS: In form var 'txtSearch' ( http://testfire.net/search.aspx )
|
|
|
|
[*] XSS: Analyzing response #8...
|
|
|
|
[+] XSS: In form var 'txtSearch' ( http://testfire.net/search.aspx )
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
*Verbose mode enabled*
|
|
|
|
|
|
|
|
See the extra information in this example.
|
|
|
|
"[v]" messages are verbose messages.
|
|
|
|
In this case the verbose messages give information about the inputs that discovered the XSS vulnerability.
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni -v --audit-forms --modules=xss http://testfire.net/ --link-count=1
|
|
|
|
Arachni - Web Application Security Scanner Framework v0.4.2
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
|
|
|
|
(With the support of the community and the Arachni Team.)
|
|
|
|
|
|
|
|
Website: http://arachni-scanner.com
|
|
|
|
Documentation: http://arachni-scanner.com/wiki
|
|
|
|
|
|
|
|
|
|
|
|
[*] Initialising...
|
|
|
|
[*] Waiting for plugins to settle...
|
|
|
|
[*] [HTTP: 200] http://testfire.net/
|
|
|
|
[*] Harvesting HTTP responses...
|
|
|
|
[~] Depending on server responsiveness and network conditions this may take a while.
|
|
|
|
|
|
|
|
[*] Auditing: [HTTP: 200] http://testfire.net/
|
|
|
|
[*] Profiler: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] Profiler: Auditing form variable '__original_values__' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] Profiler: Auditing form variable '__sample_values__' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] XSS: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] XSS: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] XSS: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] Harvesting HTTP responses...
|
|
|
|
[~] Depending on server responsiveness and network conditions this may take a while.
|
|
|
|
[*] Profiler: Analyzing response #3...
|
|
|
|
[~] Trainer: Found 1 new links.
|
|
|
|
[*] Profiler: Analyzing response #4...
|
|
|
|
[*] Profiler: Analyzing response #5...
|
|
|
|
[*] XSS: Analyzing response #6...
|
|
|
|
[+] XSS: In form var 'txtSearch' ( http://testfire.net/search.aspx )
|
|
|
|
[v] XSS: Injected string: <some_dangerous_input_e9829177cc9e8bbc164a5c96acf12b2a477beda9b268a18fcc63a99a9f134c8c/>
|
|
|
|
[v] XSS: Verified string: <some_dangerous_input_e9829177cc9e8bbc164a5c96acf12b2a477beda9b268a18fcc63a99a9f134c8c/>
|
|
|
|
[*] XSS: Analyzing response #7...
|
|
|
|
[+] XSS: In form var 'txtSearch' ( http://testfire.net/search.aspx )
|
|
|
|
[v] XSS: Injected string: '-;<some_dangerous_input_e9829177cc9e8bbc164a5c96acf12b2a477beda9b268a18fcc63a99a9f134c8c/>
|
|
|
|
[v] XSS: Verified string: '-;<some_dangerous_input_e9829177cc9e8bbc164a5c96acf12b2a477beda9b268a18fcc63a99a9f134c8c/>
|
|
|
|
[*] XSS: Analyzing response #8...
|
|
|
|
[+] XSS: In form var 'txtSearch' ( http://testfire.net/search.aspx )
|
|
|
|
[v] XSS: Injected string: --> <some_dangerous_input_e9829177cc9e8bbc164a5c96acf12b2a477beda9b268a18fcc63a99a9f134c8c/> <!--
|
|
|
|
[v] XSS: Verified string: --> <some_dangerous_input_e9829177cc9e8bbc164a5c96acf12b2a477beda9b268a18fcc63a99a9f134c8c/> <!--
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
<h3 id='debug'><a href='debug'>Debug mode (--debug)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
When this flag is enabled the system will output a lot of messages detailing what's happening internally.
|
|
|
|
|
|
|
|
If you don't want to be flooded by annoying and obscure messages you can pipe debugging output to a separate file when running Arachni using:
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni -pv --mods=xss http://localhost/~zapotek/tests/forms/xss.php --debug 2> debug.log
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
The debug.log file will contain something like:
|
|
|
|
|
|
|
|
```
|
|
|
|
$ cat debug.log
|
|
|
|
[!] XSS: Current audit ID: XSS:http://localhost/~zapotek/tests/forms/xss.php:form:["xss"]=<arachni_xss_5e2e830ed4f831cb30df6df05151022b94cd27991b459ae8c3b349e2bbd2dad1
|
|
|
|
[!] XSS: Current audit ID: XSS:http://localhost/~zapotek/tests/forms/xss.php:form:["xss"]=__original_values__
|
|
|
|
[!] XSS: Current audit ID: XSS:http://localhost/~zapotek/tests/forms/xss.php:form:["xss"]=__sample_values__
|
|
|
|
[!] XSS:
|
|
|
|
[!] XSS: Trainer set to: OFF
|
|
|
|
[!] XSS: ------------
|
|
|
|
[!] XSS: Injection string format combinations set to:
|
|
|
|
[!] XSS: |
|
|
|
|
[!] XSS: |----> Null character termination (Format::NULL [4]) and append to default value (Format::APPEND [2]). [Combo mask: 6]
|
|
|
|
[!] XSS:
|
|
|
|
[!] XSS: Prepared combinations:
|
|
|
|
[!] XSS: |
|
|
|
|
[!] XSS: |
|
|
|
|
[!] XSS: |--> Auditing: __original_values__
|
|
|
|
[!] XSS: |--> Combo:
|
|
|
|
[!] XSS: |------> ["xss", ""]
|
|
|
|
[!] XSS: |
|
|
|
|
[!] XSS: |--> Auditing: __sample_values__
|
|
|
|
[!] XSS: |--> Combo:
|
|
|
|
[!] XSS: |------> ["xss", "1"]
|
|
|
|
[!] XSS: |
|
|
|
|
[!] XSS: |--> Auditing: xss
|
|
|
|
[!] XSS: |--> Combo:
|
|
|
|
[!] XSS: |------> ["xss", "1<arachni_xss_5e2e830ed4f831cb30df6df05151022b94cd27991b459ae8c3b349e2bbd2dad1\x00"]
|
|
|
|
[!] XSS:
|
|
|
|
[!] XSS: ------------
|
|
|
|
[!] XSS:
|
|
|
|
[!] XSS: Current audit ID: XSS:http://localhost/~zapotek/tests/forms/xss.php:form:["xss"]=__original_values__
|
|
|
|
[!] XSS: Submitting form with original values; overriding trainer option.
|
|
|
|
[!] XSS: Trainer set to: ON
|
|
|
|
[!] ------------
|
|
|
|
[!] Queued request.
|
|
|
|
[!] ID#: 0
|
|
|
|
[!] URL: http://localhost/~zapotek/tests/forms/xss.php
|
|
|
|
[!] Method: post
|
|
|
|
[!] Params: {"xss"=>""}
|
|
|
|
[!] Headers: {"cookie"=>"", "From"=>"", "Accept"=>"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "User-Agent"=>"Arachni/0.2.1"}
|
|
|
|
[!] Train?: true
|
|
|
|
[!] ------------
|
|
|
|
[!] XSS: Current audit ID: XSS:http://localhost/~zapotek/tests/forms/xss.php:form:["xss"]=__sample_values__
|
|
|
|
[!] XSS: Submitting form with sample values; overriding trainer option.
|
|
|
|
[!] XSS: Trainer set to: ON
|
|
|
|
[!] ------------
|
|
|
|
[!] Queued request.
|
|
|
|
[!] ID#: 1
|
|
|
|
[!] URL: http://localhost/~zapotek/tests/forms/xss.php
|
|
|
|
[!] Method: post
|
|
|
|
[!] Params: {"xss"=>"1"}
|
|
|
|
[!] Headers: {"cookie"=>"", "From"=>"", "Accept"=>"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "User-Agent"=>"Arachni/0.2.1"}
|
|
|
|
[!] Train?: true
|
|
|
|
[!] ------------
|
|
|
|
[!] ------------
|
|
|
|
[!] Queued request.
|
|
|
|
[!] ID#: 2
|
|
|
|
[!] URL: http://localhost/~zapotek/tests/forms/xss.php
|
|
|
|
[!] Method: post
|
|
|
|
[!] Params: {"xss"=>"1<arachni_xss_5e2e830ed4f831cb30df6df05151022b94cd27991b459ae8c3b349e2bbd2dad1\x00"}
|
|
|
|
[!] Headers: {"cookie"=>"", "From"=>"", "Accept"=>"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "User-Agent"=>"Arachni/0.2.1"}
|
|
|
|
[!] Train?: false
|
|
|
|
[!] ------------
|
|
|
|
[!] ------------
|
|
|
|
[!] Got response.
|
|
|
|
[!] Request ID#: 2
|
|
|
|
[!] URL: http://localhost/~zapotek/tests/forms/xss.php
|
|
|
|
[!] Method: post
|
|
|
|
[!] Params: {"xss"=>"1<arachni_xss_5e2e830ed4f831cb30df6df05151022b94cd27991b459ae8c3b349e2bbd2dad1\x00"}
|
|
|
|
[!] Headers: {"cookie"=>"", "From"=>"", "Accept"=>"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "User-Agent"=>"Arachni/0.2.1"}
|
|
|
|
[!] Train?: false
|
|
|
|
[!] ------------
|
|
|
|
[!] XSS: Request ID: 2
|
|
|
|
[!] ------------
|
|
|
|
[!] Got response.
|
|
|
|
[!] Request ID#: 0
|
|
|
|
[!] URL: http://localhost/~zapotek/tests/forms/xss.php
|
|
|
|
[!] Method: post
|
|
|
|
[!] Params: {"xss"=>""}
|
|
|
|
[!] Headers: {"cookie"=>"", "From"=>"", "Accept"=>"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "User-Agent"=>"Arachni/0.2.1"}
|
|
|
|
[!] Train?: true
|
|
|
|
[!] ------------
|
|
|
|
[!] Trainer: Started for response with request ID: #0
|
|
|
|
[!] Trainer: Page hasn't changed, skipping...
|
|
|
|
[!] ------------
|
|
|
|
[!] Got response.
|
|
|
|
[!] Request ID#: 1
|
|
|
|
[!] URL: http://localhost/~zapotek/tests/forms/xss.php
|
|
|
|
[!] Method: post
|
|
|
|
[!] Params: {"xss"=>"1"}
|
|
|
|
[!] Headers: {"cookie"=>"", "From"=>"", "Accept"=>"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "User-Agent"=>"Arachni/0.2.1"}
|
|
|
|
[!] Train?: true
|
|
|
|
[!] ------------
|
|
|
|
[!] Trainer: Started for response with request ID: #1
|
|
|
|
[!] Trainer: Training complete.
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
<h3 id='only-positives'><a href='#only-positives'>Only positives (--only-positives)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
This will suppress all messages except for positive matches -- vulnerabilities.
|
|
|
|
|
|
|
|
<h3 id='http-req-limit'><a href='#http-req-limit'>HTTP request limit (--http-req-limit)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: integer
|
|
|
|
*Default*: 60
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Limit how many concurrent HTTP request are sent.
|
|
|
|
|
|
|
|
*Note*: If your scan seems unresponsive try lowering the limit.
|
|
|
|
*Warning*: Given enough bandwidth and a high limit it could cause a DoS.
|
|
|
|
Be careful when setting this option too high, don't kill your server.
|
|
|
|
|
|
|
|
<h3 id='http-timeout'><a href='#http-timeout'>HTTP timeout (--http-timeout)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: integer (milliseconds)
|
|
|
|
*Default*: 50000
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Limit how long the HTTP client should wait for a response from the server.
|
|
|
|
|
|
|
|
<h3 id='https-only'><a href='#https-only'>HTTP timeout (--https-only)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Forces the system to only follow HTTPS URLs.
|
|
|
|
_(Target URL must be an HTTPS one as well.)_
|
|
|
|
|
|
|
|
<h3 id='cookie-jar'><a href='#cookie-jar'>Cookie jar (--cookie-jar)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: cookiejar file
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Arachni allows you to pass your own cookies in the form of a Netscape cookie-jar file.
|
|
|
|
If you want to audit restricted parts of a website that are accessible only to logged in users you should pass the session cookies to Arachni.
|
|
|
|
|
|
|
|
There's a number of ways to do that, I've found that Firebug's export cookie feature works best.
|
|
|
|
|
|
|
|
You should also take a look at the _--exclude-cookie_ option discussed later.
|
|
|
|
|
|
|
|
*Note*: If you don't feel comfortable setting your own cookie-jar you can use the Proxy or AutoLogin plugin to login to the web application.
|
|
|
|
|
|
|
|
<h3 id='cookie-string'><a href='#cookie-string'>Cookie string (--cookie-string)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: string
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Cookies, as a string, to be sent to the web application.
|
|
|
|
|
|
|
|
<h4 id='cookie-string_example'><a href='#cookie-string_example'>Example</a></h4>
|
|
|
|
|
|
|
|
```
|
|
|
|
--cookie-string='userid=19;sessionid=deadbeefbabe'
|
|
|
|
```
|
|
|
|
|
|
|
|
<h3 id='user-agent'><a href='#user-agent'>User agent (--user-agent)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: string
|
|
|
|
*Default*: "Arachni/<version>"
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
You can pass your own user agent string which will be sent to the webserver under audit.
|
|
|
|
Default is _Arachni/<version>_.
|
|
|
|
|
|
|
|
<h3 id='custom-header'><a href='#custom-header'>Custom header (--custom-header)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: string
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Allows you to specify custom headers in the form of key-value pairs.
|
|
|
|
|
|
|
|
<h4 id='custom-header_example'><a href='#custom-header_example'>Example</a></h4>
|
|
|
|
|
|
|
|
|
|
|
|
``` --custom-header='field_name=field value'```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<h3 id='authed-by'><a href='#authed-by'>Authorized by (--authed-by)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: string
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
The string passed to this option will be included in the user-agent string and be the value of the "From" HTTP header field.
|
|
|
|
|
|
|
|
The _--authed-by_ value should contain information about the person who authorized the scan, his name and e-mail.
|
|
|
|
|
|
|
|
<h4 id='authed-by_example'><a href='#authed-by_example'>Example</a></h4>
|
|
|
|
|
|
|
|
|
|
|
|
``` --authed-by='John Doe <jdoe@test.com>'```
|
|
|
|
|
|
|
|
|
|
|
|
<h3 id='login-check-url'><a href='#login-check-url'>Login check URL (--login-check-url)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: string
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
*Requires*: "login-check-pattern":#login-check-pattern
|
|
|
|
|
|
|
|
The URL passed to this option will be used to verify that the scanner is still
|
|
|
|
logged in to the web application.
|
|
|
|
|
|
|
|
If HTTP response body of URL matches the "login-check-pattern":#login-check-pattern
|
|
|
|
this should indicate that the scanner is logged in.
|
|
|
|
|
|
|
|
<h3 id='login-check-pattern'><a href='#login-check-pattern'>Login check pattern (--login-check-pattern)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: string
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
*Requires*: "login-check-url":#login-check-url
|
|
|
|
|
|
|
|
A pattern used against the body of the "login-check-url":#login-check-url to
|
|
|
|
verify that the scanner is still logged in to the web application.
|
|
|
|
|
|
|
|
A positive match should indicate that the scanner is logged in.
|
|
|
|
|
|
|
|
<h2 id='profiles'><a href='#profiles'>Profiles</a></h2>
|
|
|
|
|
|
|
|
<h3 id='save-profile'><a href='#save-profile'>Save profile (--save-profile)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: filename
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
This option allows you to save your current running configuration, all the options passed to Arachni, to an Arachni Framework Profile (.afp) file.
|
|
|
|
|
|
|
|
<h4 id='save-profile_example'><a href='#save-profile_example'>Example</a></h4>
|
|
|
|
|
|
|
|
|
|
|
|
```arachni -pv --modules=xss http://site.com/ --save-profile=myprofile```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<h3 id='load-profile'><a href='#load-profile'>Load profile (--load-profile)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: Arachni Framework Profile (.afp) file
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
This option allows you to load and run a saved profile.
|
|
|
|
The load profile option does not restrict your ability to specify more options or even resave the profile.
|
|
|
|
|
|
|
|
<h4 id='load-profile_example'><a href='#load-profile_example'>Example</a></h4>
|
|
|
|
|
|
|
|
|
|
|
|
```arachni --load-profile=myprofile.afp```
|
|
|
|
|
|
|
|
|
|
|
|
<h3 id='show-profile'><a href='#show-profile'>Show profile (--show-profile)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
This option will output the running configuration as a string of command line arguments.
|
|
|
|
|
|
|
|
<h4 id='show-profile_example'><a href='#show-profile_example'>Example</a></h4>
|
|
|
|
|
|
|
|
|
|
|
|
```arachni --show-profile --load-profile=myprofile.afp</pre></code>
|
|
|
|
|
|
|
|
<h2 id='crawler'><a href='#crawler'>Crawler</a></h2>
|
|
|
|
|
|
|
|
<h3 id='exclude'><a href='#exclude'>Exclude (--exclude/-e)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: regexp
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
The _--exclude_ option expects a regular expression or plain string and excludes URLs matching that expression from the crawling process.
|
|
|
|
|
|
|
|
<h4 id='exclude_example'><a href='#exclude_example'>Example</a></h4>
|
|
|
|
|
|
|
|
In this simple example we tell Arachni to exclude all URLs that contain the string "xss".
|
|
|
|
Thus no further action was taken.
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni http://testfire.net --modules=xss --exclude=testfire
|
|
|
|
Arachni - Web Application Security Scanner Framework v0.4.2
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
|
|
|
|
(With the support of the community and the Arachni Team.)
|
|
|
|
|
|
|
|
Website: http://arachni-scanner.com
|
|
|
|
Documentation: http://arachni-scanner.com/wiki
|
|
|
|
|
|
|
|
|
|
|
|
[~] No audit options were specified.
|
|
|
|
[~] -> Will audit links, forms and cookies.
|
|
|
|
|
|
|
|
[*] Initialising...
|
|
|
|
[*] Waiting for plugins to settle...
|
|
|
|
[*] Resolver: Resolving hostnames...
|
|
|
|
[*] Resolver: Done!
|
|
|
|
|
|
|
|
[*] Dumping audit results in '2012-09-09 02.38.18 +0300.afr'.
|
|
|
|
[*] Done!
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[+] Web Application Security Report - Arachni Framework
|
|
|
|
|
|
|
|
[~] Report generated on: 2012-09-09 02:38:18 +0300
|
|
|
|
[~] Report false positives at: http://github.com/Arachni/arachni/issues
|
|
|
|
|
|
|
|
[+] System settings:
|
|
|
|
[~] ---------------
|
|
|
|
[~] Version: 0.4.1dev
|
|
|
|
[~] Revision: 0.2.7
|
|
|
|
[~] Audit started on: Sun Sep 9 02:38:15 2012
|
|
|
|
[~] Audit finished on: Sun Sep 9 02:38:16 2012
|
|
|
|
[~] Runtime: 00:00:01
|
|
|
|
|
|
|
|
[~] URL: http://testfire.net/
|
|
|
|
[~] User agent: Arachni/v0.4.2
|
|
|
|
|
|
|
|
[*] Audited elements:
|
|
|
|
[~] * Links
|
|
|
|
[~] * Forms
|
|
|
|
[~] * Cookies
|
|
|
|
|
|
|
|
[*] Modules: xss
|
|
|
|
|
|
|
|
[*] Filters:
|
|
|
|
[~] Exclude:
|
|
|
|
[~] (?-mix:testfire)
|
|
|
|
|
|
|
|
[~] =
|
|
|
|
|
|
|
|
[+] 0 issues were detected.
|
|
|
|
|
|
|
|
|
|
|
|
[+] Plugin data:
|
|
|
|
[~] ---------------
|
|
|
|
|
|
|
|
|
|
|
|
[~] 0.0% [=> ] 100%
|
|
|
|
[~] Est. remaining time: --:--:--
|
|
|
|
|
|
|
|
[~] Crawling, discovered 0 pages and counting.
|
|
|
|
|
|
|
|
[~] Sent 0 requests.
|
|
|
|
[~] Received and analyzed 0 responses.
|
|
|
|
[~] In 00:00:01
|
|
|
|
[~] Average: 0 requests/second.
|
|
|
|
|
|
|
|
[~] Burst response time total 0
|
|
|
|
[~] Burst response count total 0
|
|
|
|
[~] Burst average response time 0
|
|
|
|
[~] Burst average 0 requests/second
|
|
|
|
[~] Timed-out requests 0
|
|
|
|
[~] Original max concurrency 20
|
|
|
|
[~] Throttled max concurrency 20
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
<h3 id='exclude-page'><a href='#exclude-page'>Exclude page by content (--exclude-page)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: regexp
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
The _--exclude-page_ option expects a regular expression or plain string
|
|
|
|
and excludes pages whose content matching that expression from the crawl process.
|
|
|
|
|
|
|
|
<h3 id='include'><a href='#include'>Include (--include/-i)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: regexp
|
|
|
|
*Default*: '.*'
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
This is the exact oposite of the _--exclude_ option.
|
|
|
|
When a regular expression is passed to the _--include_ option, *only* URLs matching that regular expression will be crawled.
|
|
|
|
|
|
|
|
<h3 id='redundant'><a href='#redundant'>Redundant (--redundant)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: regexp:integer
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
The redundant option expects a regular expression and a counter, like so:
|
|
|
|
|
|
|
|
```--redundant='calendar.php':3```
|
|
|
|
|
|
|
|
|
|
|
|
This will cause URLs that contain "calendar.php" to be crawled only 3 times.
|
|
|
|
|
|
|
|
This option is useful when auditing a website that has a lot of redundant pages like a photo gallery or a dynamically generated calendar.
|
|
|
|
|
|
|
|
<h3 id='auto-redundant'><a href='#auto-redundant'>Auto-redundant (--auto-redundant)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: integer
|
|
|
|
*Default*: disabled (with a value of 10 if none has been specified)
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
The auto-redundant option sets the limit of how many URLs with identical parameters
|
|
|
|
should be followed.
|
|
|
|
|
|
|
|
This can prevent infinite loops caused by pages like photo galleries or catalogues.
|
|
|
|
|
|
|
|
<h4 id='auto-redundant_example'><a href='#auto-redundant_example'>Example</a></h4>
|
|
|
|
|
|
|
|
With ```--auto-redundant=2``` and given the following list of URLs:
|
|
|
|
```
|
|
|
|
http://test.com/?stuff=1
|
|
|
|
http://test.com/?stuff=2
|
|
|
|
http://test.com/?stuff=other-stuff
|
|
|
|
http://test.com/?stuff=blah
|
|
|
|
http://test.com/?stuff=blah&stuff2=1
|
|
|
|
http://test.com/?stuff=blah&stuff2=2
|
|
|
|
http://test.com/?stuff=blah2&stuff2=bloo
|
|
|
|
http://test.com/path.php?stuff=blah&stuff2=1
|
|
|
|
```
|
|
|
|
|
|
|
|
Only the following will be followed:
|
|
|
|
```
|
|
|
|
http://test.com/?stuff=1
|
|
|
|
http://test.com/?stuff=2
|
|
|
|
http://test.com/?stuff=blah&stuff2=1
|
|
|
|
http://test.com/?stuff=blah&stuff2=2
|
|
|
|
http://test.com/path.php?stuff=blah&stuff2=1
|
|
|
|
```
|
|
|
|
|
|
|
|
<h3 id='follow-subdomains'><a href='#follow-subdomains'>Follow subdomains (-f/--follow-subdomains)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
This flag will cause Arachni to follow links to subdomains.
|
|
|
|
|
|
|
|
<h3 id='depth'><a href='#depth'>Depth limit (--depth)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: integer
|
|
|
|
*Default*: infinite
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
It specifies how deep into the site structure the crawler should go.
|
|
|
|
|
|
|
|
<h3 id='link-count'><a href='#link-count'>Link count limit (--link-count)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: integer
|
|
|
|
*Default*: infinite
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
It specifies how many links the crawler should follow.
|
|
|
|
|
|
|
|
<h3 id='redirect-limit'><a href='#redirect-limit'>Redirect limit (--redirect-limit)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: integer
|
|
|
|
*Default*: infinite
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
It specifies how many redirects the crawler should follow.
|
|
|
|
|
|
|
|
<h3 id='extend-paths'><a href='#extend-paths'>Extend paths (--extend-paths)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: file
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Allows you to extend the scope of the audit by supplementing the paths discovered by the crawler with the paths in the file.
|
|
|
|
The file must contains one path per line.
|
|
|
|
|
|
|
|
<h3 id='restrict-paths'><a href='#restrict-paths'>Restrict paths (--restrict-paths)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: file
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Uses the paths contained in file instead of performing a crawl.
|
|
|
|
|
|
|
|
|
|
|
|
<h2 id='auditor'><a href='#auditor'>Auditor</a></h2>
|
|
|
|
|
|
|
|
<h3 id='audit-links'><a href='#audit-links'>Audit links (--audit-links/-g)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni to audit the link elements of the page and their variables.
|
|
|
|
|
|
|
|
<h3 id='audit-forms'><a href='#audit-forms'>Audit forms (--audit-forms/-p)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni to audit the form elements of the page and their inputs.
|
|
|
|
|
|
|
|
<h3 id='audit-cookies'><a href='#audit-cookies'>Audit cookies (--audit-cookies/-c)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni to audit the cookies of the page.
|
|
|
|
|
|
|
|
<h3 id='exclude-cookie'><a href='#exclude-cookie'>Exclude cookie (--exclude-cookie)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: cookie name
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Tells Arachni to exclude -- not audit -- a cookie by name.
|
|
|
|
Usually used to avoid auditing a session ID cookie from the cookie-jar.
|
|
|
|
|
|
|
|
*Note*: Even if you audit a session cookie Arachni will restore it to its original value right after auditing it.
|
|
|
|
However, some extra cautious websites may invalidate/block the session upon receiving an invalid token.
|
|
|
|
This is very unlikely but it's better to err on the side of caution.
|
|
|
|
|
|
|
|
<h3 id='exclude-vector'><a href='#exclude-vector'>Exclude cookie (--exclude-vector)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: input name
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Tells Arachni to exclude -- not audit -- an input vector by name.
|
|
|
|
|
|
|
|
<h3 id='audit-headers'><a href='#audit-headers'>Audit headers (--audit-headers)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni to audit the HTTP headers of the page.
|
|
|
|
|
|
|
|
*Note*: Header audits use brute force. Almost all valid HTTP request headers will be audited even if there's no indication that the web app uses them.
|
|
|
|
*Warning*: Enabling this option will result in increased requests, maybe by an order of magnitude.
|
|
|
|
|
|
|
|
<h2 id='coverage'><a href='#coverage'>Coverage</a></h2>
|
|
|
|
|
|
|
|
<h3 id='audit-cookies-extensively'><a href='#audit-cookies-extensively'>Audit cookies extensively (--audit-cookies-extensively)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
If enabled Arachni will submit all links and forms of the page along with the cookie permutations.
|
|
|
|
|
|
|
|
*Warning*: Will severely increase the scan-time.
|
|
|
|
|
|
|
|
<h3 id='fuzz-methods'><a href='#fuzz-methods'>Fuzz methods (--fuzz-methods)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
If enabled Arachni will submit all links and forms using both the _GET_ and _POST_
|
|
|
|
HTTP request methods.
|
|
|
|
|
|
|
|
*Warning*: Will severely increase the scan-time.
|
|
|
|
|
|
|
|
<h3 id='exclude-binaries'><a href='#exclude-binaries'>Exclude binaries (--exclude-binaries)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Disables inclusion of binary HTTP response bodies in the audit.
|
|
|
|
|
|
|
|
*Note*: Binary content can confuse recon modules that perform pattern matching.
|
|
|
|
|
|
|
|
<h2 id='modules'><a href='#modules'>Modules</a></h2>
|
|
|
|
|
|
|
|
<h3 id='lsmod'><a href='#lsmod'>List modules (--lsmod)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: regular expression
|
|
|
|
*Default*: disabled OR .*
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Tells Arachni to list all available modules based on the regular expressions provided and exit.
|
|
|
|
|
|
|
|
<h4 id='lsmod_example'><a href='#lsmod_example'>Example</a></h4>
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni --lsmod
|
|
|
|
Arachni - Web Application Security Scanner Framework v0.4.2
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
|
|
|
|
(With the support of the community and the Arachni Team.)
|
|
|
|
|
|
|
|
Website: http://arachni-scanner.com
|
|
|
|
Documentation: http://arachni-scanner.com/wiki
|
|
|
|
|
|
|
|
|
|
|
|
[~] No modules were specified.
|
|
|
|
[~] -> Will run all mods.
|
|
|
|
|
|
|
|
[~] No audit options were specified.
|
|
|
|
[~] -> Will audit links, forms and cookies.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[~] Available modules:
|
|
|
|
|
|
|
|
[*] code_injection:
|
|
|
|
--------------------
|
|
|
|
Name: Code injection
|
|
|
|
Description: It tries to inject code snippets into the
|
|
|
|
web application and assess whether or not the injection
|
|
|
|
was successful.
|
|
|
|
Elements: form, link, cookie, header
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.6
|
|
|
|
References:
|
|
|
|
[~] PHP http://php.net/manual/en/function.eval.php
|
|
|
|
[~] Perl http://perldoc.perl.org/functions/eval.html
|
|
|
|
[~] Python http://docs.python.org/py3k/library/functions.html#eval
|
|
|
|
[~] ASP http://www.aspdev.org/asp/asp-eval-execute/
|
|
|
|
[~] Ruby http://en.wikipedia.org/wiki/Eval#Ruby
|
|
|
|
Targets:
|
|
|
|
[~] PHP
|
|
|
|
[~] Perl
|
|
|
|
[~] Python
|
|
|
|
[~] ASP
|
|
|
|
[~] Ruby
|
|
|
|
Metasploitable: unix/webapp/arachni_php_eval
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/modules/audit/code_injection.rb
|
|
|
|
|
|
|
|
[*] path_traversal:
|
|
|
|
--------------------
|
|
|
|
Name: PathTraversal
|
|
|
|
Description: It injects paths of common files (/etc/passwd and boot.ini)
|
|
|
|
and evaluates the existence of a path traversal vulnerability
|
|
|
|
based on the presence of relevant content in the HTML responses.
|
|
|
|
Elements: form, link, cookie, header
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.2.6
|
|
|
|
References:
|
|
|
|
[~] OWASP http://www.owasp.org/index.php/Path_Traversal
|
|
|
|
[~] WASC http://projects.webappsec.org/Path-Traversal
|
|
|
|
Targets:
|
|
|
|
[~] Unix
|
|
|
|
[~] Windows
|
|
|
|
[~] Tomcat
|
|
|
|
Metasploitable: unix/webapp/arachni_path_traversal
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/modules/audit/path_traversal.rb
|
|
|
|
|
|
|
|
[*] sqli_blind_rdiff:
|
|
|
|
--------------------
|
|
|
|
Name: Blind (rDiff) SQL Injection
|
|
|
|
Description: It uses rDiff analysis to decide how different inputs affect
|
|
|
|
the behavior of the the web pages.
|
|
|
|
Using that as a basis it extrapolates about what inputs are vulnerable to blind SQL injection.
|
|
|
|
(Note: This module may get confused by certain types of XSS vulnerabilities.
|
|
|
|
If this module returns a positive result you should investigate nonetheless.)
|
|
|
|
Elements: link, form, cookie
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.3.2
|
|
|
|
References:
|
|
|
|
[~] OWASP http://www.owasp.org/index.php/Blind_SQL_Injection
|
|
|
|
[~] MITRE - CAPEC http://capec.mitre.org/data/definitions/7.html
|
|
|
|
Targets:
|
|
|
|
[~] Generic
|
|
|
|
Metasploitable: unix/webapp/arachni_sqlmap
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/modules/audit/sqli_blind_rdiff.rb
|
|
|
|
|
|
|
|
Hit <space> <enter> to continue, any other key to exit.
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
You can filter module listing like so:
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni --lsmod=xss --lsmod=path
|
|
|
|
Arachni - Web Application Security Scanner Framework v0.4.2
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
|
|
|
|
(With the support of the community and the Arachni Team.)
|
|
|
|
|
|
|
|
Website: http://arachni-scanner.com
|
|
|
|
Documentation: http://arachni-scanner.com/wiki
|
|
|
|
|
|
|
|
|
|
|
|
[~] No modules were specified.
|
|
|
|
[~] -> Will run all mods.
|
|
|
|
|
|
|
|
[~] No audit options were specified.
|
|
|
|
[~] -> Will audit links, forms and cookies.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[~] Available modules:
|
|
|
|
|
|
|
|
[*] xss_path:
|
|
|
|
--------------------
|
|
|
|
Name: XSSPath
|
|
|
|
Description: Cross-Site Scripting module for path injection
|
|
|
|
Elements: path
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.8
|
|
|
|
References:
|
|
|
|
[~] ha.ckers http://ha.ckers.org/xss.html
|
|
|
|
[~] Secunia http://secunia.com/advisories/9716/
|
|
|
|
Targets:
|
|
|
|
[~] Generic
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/modules/audit/xss_path.rb
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<h3 id='modules'><a href='#modules'>Modules (--modules/-m)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: modname,modname,... OR '*'
|
|
|
|
*Default*: '*' -- all modules
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni which modules to load.
|
|
|
|
Modules are referenced by their filename without the '.rb' extension, use '--lsmod' to see all.
|
|
|
|
You can specify the modules to load as comma separated values (without spaces) or '*' to load all modules.
|
|
|
|
You can prevent modules from loading by prefixing their name with a dash (-).
|
|
|
|
|
|
|
|
|
|
|
|
<h4 id='mods_example'><a href='#mods_example'>Example</a></h4>
|
|
|
|
|
|
|
|
As CSV:
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni --modules=xss,sqli,path_traversal http://localhost/
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
All modules:
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni http://localhost/
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
Excluding modules:
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni --modules=*,-backup_files,-xss http://www.test.com
|
|
|
|
```
|
|
|
|
|
|
|
|
The above will load all modules except for the 'backup_files' and 'xss' modules.
|
|
|
|
|
|
|
|
<h2 id='reports'><a href='#reports'>Reports</a></h2>
|
|
|
|
|
|
|
|
<h3 id='lsrep'><a href='#lsrep'>List reports (--lsrep)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Lists all available reports.
|
|
|
|
|
|
|
|
<h4 id='lsrep_example'><a href='#lsrep_example'>Example</a></h4>
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni --lsrep
|
|
|
|
Arachni - Web Application Security Scanner Framework v0.4.2
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
|
|
|
|
(With the support of the community and the Arachni Team.)
|
|
|
|
|
|
|
|
Website: http://arachni-scanner.com
|
|
|
|
Documentation: http://arachni-scanner.com/wiki
|
|
|
|
|
|
|
|
|
|
|
|
[~] No modules were specified.
|
|
|
|
[~] -> Will run all mods.
|
|
|
|
|
|
|
|
[~] No audit options were specified.
|
|
|
|
[~] -> Will audit links, forms and cookies.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[~] Available reports:
|
|
|
|
|
|
|
|
[*] yaml:
|
|
|
|
--------------------
|
|
|
|
Name: YAML Report
|
|
|
|
Description: Exports the audit results as a YAML file.
|
|
|
|
Options:
|
|
|
|
[~] outfile - Where to save the report.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default: 2012-09-09 02.41.03 +0300.yaml
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.1
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/yaml.rb
|
|
|
|
|
|
|
|
[*] txt:
|
|
|
|
--------------------
|
|
|
|
Name: Text report
|
|
|
|
Description: Exports a report as a plain text file.
|
|
|
|
Options:
|
|
|
|
[~] outfile - Where to save the report.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default: 2012-09-09 02.41.03 +0300.txt
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.2.1
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/txt.rb
|
|
|
|
|
|
|
|
[*] xml:
|
|
|
|
--------------------
|
|
|
|
Name: XML report
|
|
|
|
Description: Exports a report as an XML file.
|
|
|
|
Options:
|
|
|
|
[~] outfile - Where to save the report.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default: 2012-09-09 02.41.03 +0300.xml
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.2.2
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/xml.rb
|
|
|
|
|
|
|
|
[*] metareport:
|
|
|
|
--------------------
|
|
|
|
Name: Metareport
|
|
|
|
Description: Creates a file to be used with the Arachni MSF plug-in.
|
|
|
|
Options:
|
|
|
|
[~] outfile - Where to save the report.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default: 2012-09-09 02.41.03 +0300.msf
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.1
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/metareport.rb
|
|
|
|
|
|
|
|
[*] afr:
|
|
|
|
--------------------
|
|
|
|
Name: Arachni Framework Report
|
|
|
|
Description: Saves the file in the default Arachni Framework Report (.afr) format.
|
|
|
|
Options:
|
|
|
|
[~] outfile - Where to save the report.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default: 2012-09-09 02.41.03 +0300.afr
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.1
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/afr.rb
|
|
|
|
|
|
|
|
[*] html:
|
|
|
|
--------------------
|
|
|
|
Name: HTML Report
|
|
|
|
Description: Exports a report as an HTML document.
|
|
|
|
Options:
|
|
|
|
[~] tpl - Template to use.
|
|
|
|
[~] Type: path
|
|
|
|
[~] Default: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/html/default.erb
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
[~] outfile - Where to save the report.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default: 2012-09-09 02.41.03 +0300.html
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.3.1
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/html.rb
|
|
|
|
|
|
|
|
[*] ap:
|
|
|
|
--------------------
|
|
|
|
Name: AP
|
|
|
|
Description: Awesome prints an AuditStore hash.
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.1
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/ap.rb
|
|
|
|
|
|
|
|
[*] marshal:
|
|
|
|
--------------------
|
|
|
|
Name: Marshal Report
|
|
|
|
Description: Exports the audit results as a Marshal file.
|
|
|
|
Options:
|
|
|
|
[~] outfile - Where to save the report.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default: 2012-09-09 02.41.03 +0300.marshal
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.1
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/marshal.rb
|
|
|
|
|
|
|
|
[*] json:
|
|
|
|
--------------------
|
|
|
|
Name: JSON Report
|
|
|
|
Description: Exports the audit results as a JSON file.
|
|
|
|
Options:
|
|
|
|
[~] outfile - Where to save the report.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default: 2012-09-09 02.41.03 +0300.json
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.1
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/json.rb
|
|
|
|
|
|
|
|
[*] stdout:
|
|
|
|
--------------------
|
|
|
|
Name: Stdout
|
|
|
|
Description: Prints the results to standard output.
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.2.2
|
|
|
|
Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/stdout.rb
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
<h3 id='repload'><a href='#repload'>Load a report (--repload)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: Arachni Framework Report (.afr) file
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni to load an Arachni Framework Report (.afr) file.
|
|
|
|
You can use this option to load a report file and convert it to another format.
|
|
|
|
|
|
|
|
<h4 id='repload_example'><a href='#repload_example'>Example</a></h4>
|
|
|
|
|
|
|
|
Load an AFR report file and send it to the "stdout" report.
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni --repload=2012-09-09\ 02.42.20\ +0300.afr
|
|
|
|
Arachni - Web Application Security Scanner Framework v0.4.2
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
|
|
|
|
(With the support of the community and the Arachni Team.)
|
|
|
|
|
|
|
|
Website: http://arachni-scanner.com
|
|
|
|
Documentation: http://arachni-scanner.com/wiki
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[+] Web Application Security Report - Arachni Framework
|
|
|
|
|
|
|
|
[~] Report generated on: 2012-09-09 02:42:54 +0300
|
|
|
|
[~] Report false positives at: http://github.com/Arachni/arachni/issues
|
|
|
|
|
|
|
|
[+] System settings:
|
|
|
|
[~] ---------------
|
|
|
|
[~] Version: 0.4.1dev
|
|
|
|
[~] Revision: 0.2.7
|
|
|
|
[~] Audit started on: Sun Sep 9 02:42:15 2012
|
|
|
|
[~] Audit finished on: Sun Sep 9 02:42:18 2012
|
|
|
|
[~] Runtime: 00:00:03
|
|
|
|
|
|
|
|
[~] URL: http://testfire.net/
|
|
|
|
[~] User agent: Arachni/v0.4.2
|
|
|
|
|
|
|
|
[*] Audited elements:
|
|
|
|
[~] * Forms
|
|
|
|
|
|
|
|
[*] Modules: xss
|
|
|
|
|
|
|
|
[*] Cookies:
|
|
|
|
[~] ASP.NET_SessionId = zdjkcj2t3qdmmw555alngpbm
|
|
|
|
[~] amSessionId = 203429333847
|
|
|
|
|
|
|
|
[~] =
|
|
|
|
|
|
|
|
[+] 1 issues were detected.
|
|
|
|
|
|
|
|
[+] [1] Cross-Site Scripting (XSS)
|
|
|
|
[~] ~~~~~~~~~~~~~~~~~~~~
|
|
|
|
[~] ID Hash: 106295fcfffa8fea3664f8fb27defe5b81f3dfba2b54c5c7f2bcb63b36246359
|
|
|
|
[~] Severity: High
|
|
|
|
[~] URL: http://testfire.net/search.aspx
|
|
|
|
[~] Element: form
|
|
|
|
[~] Method: GET
|
|
|
|
[~] Tags: xss, regexp, injection, script
|
|
|
|
[~] Variable: txtSearch
|
|
|
|
[~] Description:
|
|
|
|
[~] Client-side code (like JavaScript) can
|
|
|
|
be injected into the web application which is then returned to the user's browser.
|
|
|
|
This can lead to a compromise of the client's system or serve as a pivoting point for other attacks.
|
|
|
|
|
|
|
|
[~] CWE: http://cwe.mitre.org/data/definitions/79.html
|
|
|
|
|
|
|
|
[~] Requires manual verification?: false
|
|
|
|
|
|
|
|
[~] References:
|
|
|
|
[~] ha.ckers - http://ha.ckers.org/xss.html
|
|
|
|
[~] Secunia - http://secunia.com/advisories/9716/
|
|
|
|
|
|
|
|
[*] Variations
|
|
|
|
[~] ----------
|
|
|
|
[~] Variation 1:
|
|
|
|
[~] URL: http://testfire.net/search.aspx
|
|
|
|
[~] Injected value: <some_dangerous_input_851ed9aefabd36fc0ad7d0611c23e1ae561b7caaa28b42ef305a109c9f1cb639/>
|
|
|
|
[~] Regular expression:
|
|
|
|
[~] Matched string: <some_dangerous_input_851ed9aefabd36fc0ad7d0611c23e1ae561b7caaa28b42ef305a109c9f1cb639/>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[+] Plugin data:
|
|
|
|
[~] ---------------
|
|
|
|
|
|
|
|
|
|
|
|
[*] Resolver
|
|
|
|
[~] ~~~~~~~~~~~~~~
|
|
|
|
[~] Description: Resolves vulnerable hostnames to IP addresses.
|
|
|
|
|
|
|
|
[~] testfire.net: 65.61.137.117
|
|
|
|
|
|
|
|
[*] Health map
|
|
|
|
[~] ~~~~~~~~~~~~~~
|
|
|
|
[~] Description: Generates a simple list of safe/unsafe URLs.
|
|
|
|
|
|
|
|
[~] Legend:
|
|
|
|
[+] No issues
|
|
|
|
[-] Has issues
|
|
|
|
|
|
|
|
[+] http://testfire.net/
|
|
|
|
[-] http://testfire.net/search.aspx
|
|
|
|
|
|
|
|
[~] Total: 2
|
|
|
|
[+] Without issues: 1
|
|
|
|
[-] With issues: 1 ( 50% )
|
|
|
|
|
|
|
|
[*] Profiler
|
|
|
|
[~] ~~~~~~~~~~~~~~
|
|
|
|
[~] Description: Examines the behavior of the web application gathering general statistics
|
|
|
|
and performs taint analysis to determine which inputs affect the output.
|
|
|
|
|
|
|
|
It does not perform any vulnerability assessment nor does it send attack payloads.
|
|
|
|
|
|
|
|
[~] Inputs affecting output:
|
|
|
|
|
|
|
|
[+] Form using the 'txtSearch' input at 'http://testfire.net/' pointing to 'http://testfire.net/search.aspx' using 'GET'.
|
|
|
|
[~] It was submitted using the following parameters:
|
|
|
|
[~] * txtSearch = arachni_text023849c38925e2af028a2eb4e1dc41afd7dc7a238195c1c2ae00438d1dae00e1
|
|
|
|
[~]
|
|
|
|
[~] The taint landed in the following elements at 'http://testfire.net/search.aspx?txtSearch=arachni_text023849c38925e2af028a2eb4e1dc41afd7dc7a238195c1c2ae00438d1dae00e1':
|
|
|
|
[~] * Body
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
Load an AFR file and create an HTML report from it.
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni --repload=2012-09-09\ 02.42.20\ +0300.afr --report=html
|
|
|
|
Arachni - Web Application Security Scanner Framework v0.4.2
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
|
|
|
|
(With the support of the community and the Arachni Team.)
|
|
|
|
|
|
|
|
Website: http://arachni-scanner.com
|
|
|
|
Documentation: http://arachni-scanner.com/wiki
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[*] Creating HTML report...
|
|
|
|
[*] Saved in '2012-09-09 02.43.42 +0300.html'.
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
<h3 id='report'><a href='#report'>Report (--report)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: repname
|
|
|
|
*Default*: stdout
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Tells Arachni which report component to use.
|
|
|
|
Reports are referenced by their filename without the '.rb' extension, use '--lsrep' to see all.
|
|
|
|
|
|
|
|
<h4 id='report_example'><a href='#report_example'>Example</a></h4>
|
|
|
|
|
|
|
|
Running the HTML report with an outfile option:
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni http://testfire.net --link-count=1 --modules=xss --report=html:outfile=my_html_report.html
|
|
|
|
Arachni - Web Application Security Scanner Framework v0.4.2
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
|
|
|
|
(With the support of the community and the Arachni Team.)
|
|
|
|
|
|
|
|
Website: http://arachni-scanner.com
|
|
|
|
Documentation: http://arachni-scanner.com/wiki
|
|
|
|
|
|
|
|
|
|
|
|
[~] No audit options were specified.
|
|
|
|
[~] -> Will audit links, forms and cookies.
|
|
|
|
|
|
|
|
[*] Initialising...
|
|
|
|
[*] Waiting for plugins to settle...
|
|
|
|
[*] [HTTP: 200] http://testfire.net/
|
|
|
|
[*] Harvesting HTTP responses...
|
|
|
|
[~] Depending on server responsiveness and network conditions this may take a while.
|
|
|
|
|
|
|
|
[*] Auditing: [HTTP: 200] http://testfire.net/
|
|
|
|
[*] Profiler: Auditing link variable 'content' with action 'http://testfire.net/default.aspx?content=inside_contact.htm'.
|
|
|
|
[*] Profiler: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] Profiler: Auditing form variable '__original_values__' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] Profiler: Auditing form variable '__sample_values__' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] Profiler: Auditing cookie variable 'ASP.NET_SessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] Profiler: Auditing cookie variable 'amSessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing link variable 'content' with action 'http://testfire.net/default.aspx?content=inside_contact.htm'.
|
|
|
|
[*] XSS: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] XSS: Auditing cookie variable 'ASP.NET_SessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amSessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing link variable 'content' with action 'http://testfire.net/default.aspx?content=inside_contact.htm'.
|
|
|
|
[*] XSS: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] XSS: Auditing cookie variable 'ASP.NET_SessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amSessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing link variable 'content' with action 'http://testfire.net/default.aspx?content=inside_contact.htm'.
|
|
|
|
[*] XSS: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] XSS: Auditing cookie variable 'ASP.NET_SessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amSessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] Harvesting HTTP responses...
|
|
|
|
[~] Depending on server responsiveness and network conditions this may take a while.
|
|
|
|
[*] Profiler: Analyzing response #3...
|
|
|
|
[*] Profiler: Analyzing response #4...
|
|
|
|
[~] Trainer: Found 1 new links.
|
|
|
|
[*] Profiler: Analyzing response #5...
|
|
|
|
[*] Profiler: Analyzing response #6...
|
|
|
|
[*] XSS: Analyzing response #9...
|
|
|
|
[*] XSS: Analyzing response #10...
|
|
|
|
[+] XSS: In form var 'txtSearch' ( http://testfire.net/search.aspx )
|
|
|
|
[*] XSS: Analyzing response #13...
|
|
|
|
[*] XSS: Analyzing response #14...
|
|
|
|
[+] XSS: In form var 'txtSearch' ( http://testfire.net/search.aspx )
|
|
|
|
[*] XSS: Analyzing response #17...
|
|
|
|
[*] XSS: Analyzing response #18...
|
|
|
|
[+] XSS: In form var 'txtSearch' ( http://testfire.net/search.aspx )
|
|
|
|
[*] Profiler: Analyzing response #8...
|
|
|
|
[*] Profiler: Analyzing response #7...
|
|
|
|
[*] XSS: Analyzing response #12...
|
|
|
|
[*] XSS: Analyzing response #11...
|
|
|
|
[*] XSS: Analyzing response #15...
|
|
|
|
[*] XSS: Analyzing response #16...
|
|
|
|
[*] XSS: Analyzing response #19...
|
|
|
|
[*] XSS: Analyzing response #20...
|
|
|
|
|
|
|
|
[*] Resolver: Resolving hostnames...
|
|
|
|
[*] Resolver: Done!
|
|
|
|
|
|
|
|
[*] Dumping audit results in '2012-09-09 02.45.19 +0300.afr'.
|
|
|
|
[*] Done!
|
|
|
|
|
|
|
|
[*] Creating HTML report...
|
|
|
|
[*] Saved in 'my_html_report.html'.
|
|
|
|
|
|
|
|
[~] 100.0% [>] 100%
|
|
|
|
[~] Est. remaining time: --:--:--
|
|
|
|
|
|
|
|
[~] Crawler has discovered 2 pages.
|
|
|
|
[~] Audit limited to a max of 1 pages -- excluding 1 pages of Trainer feedback.
|
|
|
|
|
|
|
|
[~] Sent 25 requests.
|
|
|
|
[~] Received and analyzed 25 responses.
|
|
|
|
[~] In 00:00:04
|
|
|
|
[~] Average: 6 requests/second.
|
|
|
|
|
|
|
|
[~] Currently auditing http://testfire.net/search.aspx?txtSearch=
|
|
|
|
[~] Burst response time total 0
|
|
|
|
[~] Burst response count total 0
|
|
|
|
[~] Burst average response time 0
|
|
|
|
[~] Burst average 0 requests/second
|
|
|
|
[~] Timed-out requests 0
|
|
|
|
[~] Original max concurrency 20
|
|
|
|
[~] Throttled max concurrency 20
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
<h2 id='plugins'><a href='#plugins'>Plugins</a></h2>
|
|
|
|
|
|
|
|
<h3 id='lsplug'><a href='#lsplug'>List plugins (--lsplug)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: <n/a>
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Lists all available plugins.
|
|
|
|
|
|
|
|
<h4 id='lsplug_example'><a href='#lsplug_example'>Example</a></h4>
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni --lsplug
|
|
|
|
Arachni - Web Application Security Scanner Framework v0.4.2
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
|
|
|
|
(With the support of the community and the Arachni Team.)
|
|
|
|
|
|
|
|
Website: http://arachni-scanner.com
|
|
|
|
Documentation: http://arachni-scanner.com/wiki
|
|
|
|
|
|
|
|
|
|
|
|
[~] No modules were specified.
|
|
|
|
[~] -> Will run all mods.
|
|
|
|
|
|
|
|
[~] No audit options were specified.
|
|
|
|
[~] -> Will audit links, forms and cookies.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[~] Available plugins:
|
|
|
|
|
|
|
|
[*] resolver:
|
|
|
|
--------------------
|
|
|
|
Name: Resolver
|
|
|
|
Description: Resolves vulnerable hostnames to IP addresses.
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.1
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/defaults/resolver.rb
|
|
|
|
|
|
|
|
[*] healthmap:
|
|
|
|
--------------------
|
|
|
|
Name: Health map
|
|
|
|
Description: Generates a simple list of safe/unsafe URLs.
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.3
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/defaults/healthmap.rb
|
|
|
|
|
|
|
|
[*] profiler:
|
|
|
|
--------------------
|
|
|
|
Name: Profiler
|
|
|
|
Description: Examines the behavior of the web application gathering general statistics
|
|
|
|
and performs taint analysis to determine which inputs affect the output.
|
|
|
|
|
|
|
|
It does not perform any vulnerability assessment nor does it send attack payloads.
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.5
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/defaults/profiler.rb
|
|
|
|
|
|
|
|
[*] uniformity:
|
|
|
|
--------------------
|
|
|
|
Name: Uniformity (Lack of central sanitization)
|
|
|
|
Description: Analyzes the scan results and logs issues which persist across different pages.
|
|
|
|
This is usually a sign for a lack of a central/single point of input sanitization,
|
|
|
|
a bad coding practise.
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.2
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/defaults/meta/uniformity.rb
|
|
|
|
|
|
|
|
[*] manual_verification:
|
|
|
|
--------------------
|
|
|
|
Name: Issues requiring manual verification
|
|
|
|
Description: The HTTP responses of the issues logged by this plugin exhibit a suspicious pattern
|
|
|
|
even before any audit action has taken place -- this challenges the relevance of the audit procedure.
|
|
|
|
|
|
|
|
Thus, these issues require manual verification.
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.2
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/defaults/meta/remedies/manual_verification.rb
|
|
|
|
|
|
|
|
[*] timing_attacks:
|
|
|
|
--------------------
|
|
|
|
Name: Timing attack anomalies
|
|
|
|
Description: Analyzes the scan results and logs issues that used timing attacks
|
|
|
|
while the affected web pages demonstrated an unusually high response time.
|
|
|
|
A situation which renders the logged issues inconclusive or (possibly) false positives.
|
|
|
|
|
|
|
|
Pages with high response times usually include heavy-duty processing
|
|
|
|
which makes them prime targets for Denial-of-Service attacks.
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.4
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/defaults/meta/remedies/timing_attacks.rb
|
|
|
|
|
|
|
|
[*] discovery:
|
|
|
|
--------------------
|
|
|
|
Name: Discovery module response anomalies
|
|
|
|
Description: Analyzes the scan results and identifies issues logged by discovery modules
|
|
|
|
(i.e. modules that look for certain files and folders on the server),
|
|
|
|
while the server responses were exhibiting an anomalous factor of similarity.
|
|
|
|
|
|
|
|
There's a good chance that these issues are false positives.
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.2
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/defaults/meta/remedies/discovery.rb
|
|
|
|
|
|
|
|
[*] autothrottle:
|
|
|
|
--------------------
|
|
|
|
Name: AutoThrottle
|
|
|
|
Description: Monitors HTTP response times and automatically
|
|
|
|
throttles the request concurrency in order to maintain stability
|
|
|
|
and avoid from killing the server.
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.3
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/defaults/autothrottle.rb
|
|
|
|
|
|
|
|
[*] content_types:
|
|
|
|
--------------------
|
|
|
|
Name: Content-types
|
|
|
|
Description: Logs content-types of server responses.
|
|
|
|
It can help you categorize and identify publicly available file-types
|
|
|
|
which in turn can help you identify accidentally leaked files.
|
|
|
|
Options:
|
|
|
|
[~] exclude - Exclude content-types that match this regular expression.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default: text
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.4
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/defaults/content_types.rb
|
|
|
|
|
|
|
|
[*] libnotify:
|
|
|
|
--------------------
|
|
|
|
Name: libnotify
|
|
|
|
Description: Uses the libnotify library to send notifications for each discovered issue
|
|
|
|
and a summary at the end of the scan.
|
|
|
|
Options:
|
|
|
|
[~] for_every_issue - Show every issue.
|
|
|
|
[~] Type: bool
|
|
|
|
[~] Default: true
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.1
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/libnotify.rb
|
|
|
|
|
|
|
|
[*] cookie_collector:
|
|
|
|
--------------------
|
|
|
|
Name: Cookie collector
|
|
|
|
Description: Monitors and collects cookies while establishing a timeline of changes.
|
|
|
|
|
|
|
|
WARNING: Highly discouraged when the audit includes cookies.
|
|
|
|
It will log thousands of results leading to a huge report,
|
|
|
|
highly increased memory and CPU usage.
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.5
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/cookie_collector.rb
|
|
|
|
|
|
|
|
[*] proxy:
|
|
|
|
--------------------
|
|
|
|
Name: Proxy
|
|
|
|
Description:
|
|
|
|
* Gathers data based on user actions and exchanged HTTP
|
|
|
|
traffic and pushes that data to the framework's page-queue to be audited.
|
|
|
|
* Updates the framework cookies with the cookies of the HTTP requests and
|
|
|
|
responses, thus it can also be used to login to a web application.
|
|
|
|
* Supports SSL interception.
|
|
|
|
|
|
|
|
To skip crawling and only audit elements discovered by using the proxy
|
|
|
|
set '--link-count=0'.
|
|
|
|
Options:
|
|
|
|
[~] port - Port to bind to.
|
|
|
|
[~] Type: port
|
|
|
|
[~] Default: 8282
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
[~] bind_address - IP address to bind to.
|
|
|
|
[~] Type: address
|
|
|
|
[~] Default: 0.0.0.0
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
[~] timeout - How long to wait for a request to complete, in milliseconds.
|
|
|
|
[~] Type: integer
|
|
|
|
[~] Default: 20000
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.2
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/proxy.rb
|
|
|
|
|
|
|
|
[*] beep_notify:
|
|
|
|
--------------------
|
|
|
|
Name: Beep notify
|
|
|
|
Description: It beeps when the scan finishes.
|
|
|
|
Options:
|
|
|
|
[~] repeat - How many times to beep.
|
|
|
|
[~] Type: integer
|
|
|
|
[~] Default: 4
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
[~] interval - How long to wait between beeps.
|
|
|
|
[~] Type: float
|
|
|
|
[~] Default: 0.4
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/beep_notify.rb
|
|
|
|
|
|
|
|
[*] rescan:
|
|
|
|
--------------------
|
|
|
|
Name: ReScan
|
|
|
|
Description: It uses the AFR report of a previous scan to
|
|
|
|
extract the sitemap in order to avoid a redundant crawl.
|
|
|
|
|
|
|
|
Options:
|
|
|
|
[~] afr - Path to the AFR report.
|
|
|
|
[~] Type: path
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.2
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/rescan.rb
|
|
|
|
|
|
|
|
[*] http_dicattack:
|
|
|
|
--------------------
|
|
|
|
Name: HTTP dictionary attacker
|
|
|
|
Description: Uses wordlists to crack password protected directories.
|
|
|
|
If the cracking process is successful the found credentials will be set
|
|
|
|
framework-wide and used for the duration of the audit.
|
|
|
|
If that's not what you want set the crawler's link-count limit to "0".
|
|
|
|
Options:
|
|
|
|
[~] username_list - File with a list of usernames (newline separated).
|
|
|
|
[~] Type: path
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] password_list - File with a list of passwords (newline separated).
|
|
|
|
[~] Type: path
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.2
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/http_dicattack.rb
|
|
|
|
|
|
|
|
[*] vector_feed:
|
|
|
|
--------------------
|
|
|
|
Name: Vector feed
|
|
|
|
Description: Reads in vector data from which it creates elements to be audited.
|
|
|
|
Can be used to perform extremely specialized/narrow audits on a per vector/element basis.
|
|
|
|
|
|
|
|
Notes:
|
|
|
|
* To only audit the vectors in the feed you must set the 'link-count' limit to 0 to prevent crawling.
|
|
|
|
* Can handle multiple YAML documents.
|
|
|
|
|
|
|
|
Example YAML file:
|
|
|
|
-
|
|
|
|
# you can pass pages to be audited by grep modules (and JS in the future)
|
|
|
|
type: page
|
|
|
|
url: http://localhost/
|
|
|
|
# response code
|
|
|
|
code: 200
|
|
|
|
# response headers
|
|
|
|
headers:
|
|
|
|
Content-Type: "text/html; charset=utf-8"
|
|
|
|
body: "HTML code goes here"
|
|
|
|
|
|
|
|
-
|
|
|
|
# default type is link which has method get
|
|
|
|
#type: link
|
|
|
|
action: http://localhost/link
|
|
|
|
inputs:
|
|
|
|
my_param: "my val"
|
|
|
|
|
|
|
|
-
|
|
|
|
# if a method is post it'll default to a form type
|
|
|
|
type: form
|
|
|
|
method: post
|
|
|
|
action: http://localhost/form
|
|
|
|
inputs:
|
|
|
|
post_this: "HUA!"
|
|
|
|
csrf: "my_csrf_token"
|
|
|
|
# do not fuzz/mutate/audit the following inputs (by name obviously)
|
|
|
|
skip:
|
|
|
|
- csrf
|
|
|
|
|
|
|
|
# GET only
|
|
|
|
-
|
|
|
|
type: cookie
|
|
|
|
action: http://localhost/cookie
|
|
|
|
inputs:
|
|
|
|
session_id: "43434234343sddsdsds"
|
|
|
|
|
|
|
|
# GET only
|
|
|
|
-
|
|
|
|
type: header
|
|
|
|
action: http://localhost/header
|
|
|
|
# only 1 input allowed, each header field=>value must be defined separately
|
|
|
|
inputs:
|
|
|
|
User-Agent: "Blah/2"
|
|
|
|
|
|
|
|
|
|
|
|
Options:
|
|
|
|
[~] vectors - Vector array (for configuration over RPC).
|
|
|
|
[~] Type: abstract
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
[~] yaml_string - A string of YAML serialized vectors (for configuration over RPC).
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
[~] yaml_file - A file containing the YAML serialized vectors.
|
|
|
|
[~] Type: path
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.2
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/vector_feed.rb
|
|
|
|
|
|
|
|
[*] script:
|
|
|
|
--------------------
|
|
|
|
Name: Script
|
|
|
|
Description: Loads and runs an external Ruby script under the scope of a plugin,
|
|
|
|
used for debugging and general hackery.
|
|
|
|
|
|
|
|
Will not work over RPC.
|
|
|
|
Options:
|
|
|
|
[~] path - Path to the script.
|
|
|
|
[~] Type: path
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.1
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/script.rb
|
|
|
|
|
|
|
|
[*] email_notify:
|
|
|
|
--------------------
|
|
|
|
Name: E-mail notify
|
|
|
|
Description: Sends a notification (and optionally a report) over SMTP at the end of the scan.
|
|
|
|
Options:
|
|
|
|
[~] to - E-mail address of the receiver.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] cc - E-mail address to which to send a carbon copy of the notification.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
[~] bcc - E-mail address for a blind carbon copy.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
[~] from - E-mail address of the sender.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] server_address - Address of the SMTP server to use.
|
|
|
|
[~] Type: address
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] server_port - SMTP port.
|
|
|
|
[~] Type: port
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] tls - Use TLS/SSL?.
|
|
|
|
[~] Type: bool
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
[~] username - SMTP username.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] password - SMTP password.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] authentication - Authentication.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default: plain
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
[~] report - Report type to send as an attachment. (accepted: txt, xml, html, json, yaml, marshalnone)
|
|
|
|
[~] Type: enum
|
|
|
|
[~] Default: txt
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.2
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/email_notify.rb
|
|
|
|
|
|
|
|
[*] autologin:
|
|
|
|
--------------------
|
|
|
|
Name: AutoLogin
|
|
|
|
Description: It looks for the login form in the user provided URL,
|
|
|
|
merges its input fields with the user supplied parameters and sets the cookies
|
|
|
|
of the response and request as framework-wide cookies to be used by the spider later on.
|
|
|
|
|
|
|
|
Options:
|
|
|
|
[~] url - The URL that contains the login form.
|
|
|
|
[~] Type: url
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] params - Form parameters to submit. ( username=user&password=pass )
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] check - A pattern which will be used to verify a successful login.
|
|
|
|
For example, if a logout link only appears when a user is logged in then it can be a perfect choice.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.5
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/autologin.rb
|
|
|
|
|
|
|
|
[*] waf_detector:
|
|
|
|
--------------------
|
|
|
|
Name: WAF Detector
|
|
|
|
Description: Performs basic profiling on the web application
|
|
|
|
in order to assess the existence of a Web Application Firewall.
|
|
|
|
|
|
|
|
This is a 4 stage process:
|
|
|
|
1. Grab the original page as is
|
|
|
|
2. Send a lot of innocent (vanilla) strings in non-existent inputs so as to profile normal behavior
|
|
|
|
3. Send a lot of suspicious (spicy) strings in non-existent inputs and check if behavior changes
|
|
|
|
4. Make heads or tails of the gathered responses
|
|
|
|
|
|
|
|
Steps 1 to 3 will be repeated _precision_ times (default: 5) and the responses will be averaged using rDiff analysis.
|
|
|
|
Options:
|
|
|
|
[~] precision - Stage precision (how many times to perform each detection stage).
|
|
|
|
[~] Type: integer
|
|
|
|
[~] Default: 5
|
|
|
|
[~] Required?: false
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.2
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/waf_detector.rb
|
|
|
|
|
|
|
|
[*] form_dicattack:
|
|
|
|
--------------------
|
|
|
|
Name: Form dictionary attacker
|
|
|
|
Description: Uses wordlists to crack login forms.
|
|
|
|
If the cracking process is successful the found credentials will be set
|
|
|
|
framework-wide and used for the duration of the audit.
|
|
|
|
If that's not what you want set the crawler's link-count limit to "0".
|
|
|
|
Options:
|
|
|
|
[~] username_list - File with a list of usernames (newline separated).
|
|
|
|
[~] Type: path
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] password_list - File with a list of passwords (newline separated).
|
|
|
|
[~] Type: path
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] username_field - The name of the username form field.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] password_field - The name of the password form field.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
[~] login_verifier - A regular expression which will be used to verify a successful login.
|
|
|
|
For example, if a logout link only appears when a user is logged in then it can be a perfect choice.
|
|
|
|
[~] Type: string
|
|
|
|
[~] Default:
|
|
|
|
[~] Required?: true
|
|
|
|
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
Version: 0.1.4
|
|
|
|
Path: /home/zapotek/workspace/arachni/plugins/form_dicattack.rb
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
<h3 id='plugin'><a href='#plugin'>Plugin (--plugin)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: plugin name
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: yes
|
|
|
|
|
|
|
|
Tells Arachni which plugin components to run.
|
|
|
|
Plugins are referenced by their filename without the '.rb' extension, use '--lsplug' to see all.
|
|
|
|
|
|
|
|
<h4 id='plugin_example'><a href='#plugin_example'>Example</a></h4>
|
|
|
|
|
|
|
|
Excluding the logout URL and running the AutoLogin plugin to automatically login to a web application:
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni http://testfire.net --link-count=1 --modules=xss \
|
|
|
|
--plugin=autologin:url=http://testfire.net/bank/login.aspx,params='uid=jsmith&passw=Demo1234',check='Sign Off|MY ACCOUNT' \
|
|
|
|
-e logout
|
|
|
|
|
|
|
|
Arachni - Web Application Security Scanner Framework v0.4.2
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
|
|
|
|
(With the support of the community and the Arachni Team.)
|
|
|
|
|
|
|
|
Website: http://arachni-scanner.com
|
|
|
|
Documentation: http://arachni-scanner.com/wiki
|
|
|
|
|
|
|
|
|
|
|
|
[~] No audit options were specified.
|
|
|
|
[~] -> Will audit links, forms and cookies.
|
|
|
|
|
|
|
|
[*] Initialising...
|
|
|
|
[~] AutoLogin: System paused.
|
|
|
|
[*] Waiting for plugins to settle...
|
|
|
|
[*] AutoLogin: Found log-in form with name: login
|
|
|
|
[+] AutoLogin: Form submitted successfully.
|
|
|
|
[~] AutoLogin: Cookies set to:
|
|
|
|
[~] AutoLogin: * ASP.NET_SessionId = 14kge555fdb4bjflm3rx3t55
|
|
|
|
[~] AutoLogin: * amSessionId = 204023334531
|
|
|
|
[~] AutoLogin: * amUserInfo = UserName=anNtaXRo&Password=RGVtbzEyMzQ=
|
|
|
|
[~] AutoLogin: * amUserId = 100116014
|
|
|
|
[~] AutoLogin: * amCreditOffer = CardType=Gold&Limit=10000&Interest=7.9
|
|
|
|
[*] [HTTP: 200] http://testfire.net/
|
|
|
|
[*] Harvesting HTTP responses...
|
|
|
|
[~] Depending on server responsiveness and network conditions this may take a while.
|
|
|
|
|
|
|
|
[*] Auditing: [HTTP: 200] http://testfire.net/
|
|
|
|
[*] Profiler: Auditing link variable 'content' with action 'http://testfire.net/default.aspx?content=inside_contact.htm'.
|
|
|
|
[*] Profiler: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] Profiler: Auditing form variable '__original_values__' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] Profiler: Auditing form variable '__sample_values__' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] Profiler: Auditing cookie variable 'ASP.NET_SessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] Profiler: Auditing cookie variable 'amSessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] Profiler: Auditing cookie variable 'amUserInfo' with action 'http://testfire.net/'.
|
|
|
|
[*] Profiler: Auditing cookie variable 'amUserId' with action 'http://testfire.net/'.
|
|
|
|
[*] Profiler: Auditing cookie variable 'amCreditOffer' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing link variable 'content' with action 'http://testfire.net/default.aspx?content=inside_contact.htm'.
|
|
|
|
[*] XSS: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] XSS: Auditing cookie variable 'ASP.NET_SessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amSessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amUserInfo' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amUserId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amCreditOffer' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing link variable 'content' with action 'http://testfire.net/default.aspx?content=inside_contact.htm'.
|
|
|
|
[*] XSS: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] XSS: Auditing cookie variable 'ASP.NET_SessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amSessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amUserInfo' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amUserId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amCreditOffer' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing link variable 'content' with action 'http://testfire.net/default.aspx?content=inside_contact.htm'.
|
|
|
|
[*] XSS: Auditing form variable 'txtSearch' with action 'http://testfire.net/search.aspx'.
|
|
|
|
[*] XSS: Auditing cookie variable 'ASP.NET_SessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amSessionId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amUserInfo' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amUserId' with action 'http://testfire.net/'.
|
|
|
|
[*] XSS: Auditing cookie variable 'amCreditOffer' with action 'http://testfire.net/'.
|
|
|
|
[*] Harvesting HTTP responses...
|
|
|
|
[~] Depending on server responsiveness and network conditions this may take a while.
|
|
|
|
[*] Profiler: Analyzing response #6...
|
|
|
|
[*] Profiler: Analyzing response #7...
|
|
|
|
[*] XSS: Analyzing response #26...
|
|
|
|
[*] XSS: Analyzing response #27...
|
|
|
|
[~] Trainer: Found 1 new links.
|
|
|
|
[*] Profiler: Analyzing response #9...
|
|
|
|
[*] Profiler: Analyzing response #8...
|
|
|
|
[*] XSS: Analyzing response #28...
|
|
|
|
[*] XSS: Analyzing response #15...
|
|
|
|
[*] XSS: Analyzing response #16...
|
|
|
|
[+] XSS: In form var 'txtSearch' ( http://testfire.net/search.aspx )
|
|
|
|
[*] XSS: Analyzing response #22...
|
|
|
|
[*] XSS: Analyzing response #30...
|
|
|
|
[+] XSS: In form var 'txtSearch' ( http://testfire.net/search.aspx )
|
|
|
|
[*] Profiler: Analyzing response #10...
|
|
|
|
[*] XSS: Analyzing response #31...
|
|
|
|
[*] XSS: Analyzing response #32...
|
|
|
|
[*] Profiler: Analyzing response #11...
|
|
|
|
[*] Profiler: Analyzing response #12...
|
|
|
|
[*] Profiler: Analyzing response #14...
|
|
|
|
[*] Profiler: Analyzing response #13...
|
|
|
|
[*] XSS: Analyzing response #33...
|
|
|
|
[*] XSS: Analyzing response #17...
|
|
|
|
[*] XSS: Analyzing response #18...
|
|
|
|
[*] XSS: Analyzing response #19...
|
|
|
|
[*] XSS: Analyzing response #34...
|
|
|
|
[*] XSS: Analyzing response #20...
|
|
|
|
[*] XSS: Analyzing response #21...
|
|
|
|
[*] XSS: Analyzing response #23...
|
|
|
|
[+] XSS: In form var 'txtSearch' ( http://testfire.net/search.aspx )
|
|
|
|
[*] XSS: Analyzing response #35...
|
|
|
|
[*] XSS: Analyzing response #24...
|
|
|
|
[*] XSS: Analyzing response #25...
|
|
|
|
[*] XSS: Analyzing response #29...
|
|
|
|
|
|
|
|
[*] Resolver: Resolving hostnames...
|
|
|
|
[*] Resolver: Done!
|
|
|
|
|
|
|
|
|
|
|
|
[*] Dumping audit results in '2012-09-09 02.48.17 +0300.afr'.
|
|
|
|
[*] Done!
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[+] Web Application Security Report - Arachni Framework
|
|
|
|
|
|
|
|
[~] Report generated on: 2012-09-09 02:48:17 +0300
|
|
|
|
[~] Report false positives at: http://github.com/Arachni/arachni/issues
|
|
|
|
|
|
|
|
[+] System settings:
|
|
|
|
[~] ---------------
|
|
|
|
[~] Version: 0.4.1dev
|
|
|
|
[~] Revision: 0.2.7
|
|
|
|
[~] Audit started on: Sun Sep 9 02:48:08 2012
|
|
|
|
[~] Audit finished on: Sun Sep 9 02:48:15 2012
|
|
|
|
[~] Runtime: 00:00:06
|
|
|
|
|
|
|
|
[~] URL: http://testfire.net/
|
|
|
|
[~] User agent: Arachni/v0.4.2
|
|
|
|
|
|
|
|
[*] Audited elements:
|
|
|
|
[~] * Links
|
|
|
|
[~] * Forms
|
|
|
|
[~] * Cookies
|
|
|
|
|
|
|
|
[*] Modules: xss
|
|
|
|
|
|
|
|
[*] Filters:
|
|
|
|
[~] Exclude:
|
|
|
|
[~] (?-mix:logout)
|
|
|
|
|
|
|
|
[~] =
|
|
|
|
|
|
|
|
[+] 2 issues were detected.
|
|
|
|
|
|
|
|
[+] [1] Cross-Site Scripting (XSS)
|
|
|
|
[~] ~~~~~~~~~~~~~~~~~~~~
|
|
|
|
[~] ID Hash: 106295fcfffa8fea3664f8fb27defe5b81f3dfba2b54c5c7f2bcb63b36246359
|
|
|
|
[~] Severity: High
|
|
|
|
[~] URL: http://testfire.net/search.aspx
|
|
|
|
[~] Element: form
|
|
|
|
[~] Method: GET
|
|
|
|
[~] Tags: xss, regexp, injection, script
|
|
|
|
[~] Variable: txtSearch
|
|
|
|
[~] Description:
|
|
|
|
[~] Client-side code (like JavaScript) can
|
|
|
|
be injected into the web application which is then returned to the user's browser.
|
|
|
|
This can lead to a compromise of the client's system or serve as a pivoting point for other attacks.
|
|
|
|
|
|
|
|
[~] CWE: http://cwe.mitre.org/data/definitions/79.html
|
|
|
|
|
|
|
|
[~] Requires manual verification?: false
|
|
|
|
|
|
|
|
[~] References:
|
|
|
|
[~] ha.ckers - http://ha.ckers.org/xss.html
|
|
|
|
[~] Secunia - http://secunia.com/advisories/9716/
|
|
|
|
|
|
|
|
[*] Variations
|
|
|
|
[~] ----------
|
|
|
|
[~] Variation 1:
|
|
|
|
[~] URL: http://testfire.net/search.aspx
|
|
|
|
[~] Injected value: <some_dangerous_input_0ee58e885a87d988553542c0e6c56bc258b7478d3d7c4157233792539add3ab9/>
|
|
|
|
[~] Regular expression:
|
|
|
|
[~] Matched string: <some_dangerous_input_0ee58e885a87d988553542c0e6c56bc258b7478d3d7c4157233792539add3ab9/>
|
|
|
|
|
|
|
|
|
|
|
|
[+] [2] Cross-Site Scripting (XSS)
|
|
|
|
[~] ~~~~~~~~~~~~~~~~~~~~
|
|
|
|
[~] ID Hash: 2530b44f891ab1ebbdad206ceff0c82bee2bf038a978ebcb75f4fa34e9dca727
|
|
|
|
[~] Severity: High
|
|
|
|
[~] URL: http://testfire.net/search.aspx?txtSearch=arachni_text
|
|
|
|
[~] Element: link
|
|
|
|
[~] Method: GET
|
|
|
|
[~] Tags: xss, regexp, injection, script
|
|
|
|
[~] Variable: txtSearch
|
|
|
|
[~] Description:
|
|
|
|
[~] Client-side code (like JavaScript) can
|
|
|
|
be injected into the web application which is then returned to the user's browser.
|
|
|
|
This can lead to a compromise of the client's system or serve as a pivoting point for other attacks.
|
|
|
|
|
|
|
|
[~] CWE: http://cwe.mitre.org/data/definitions/79.html
|
|
|
|
|
|
|
|
[~] Requires manual verification?: false
|
|
|
|
|
|
|
|
[~] References:
|
|
|
|
[~] ha.ckers - http://ha.ckers.org/xss.html
|
|
|
|
[~] Secunia - http://secunia.com/advisories/9716/
|
|
|
|
|
|
|
|
[*] Variations
|
|
|
|
[~] ----------
|
|
|
|
[~] Variation 1:
|
|
|
|
[~] URL: http://testfire.net/search.aspx?txtSearch=arachni_text
|
|
|
|
[~] Injected value: '-;<some_dangerous_input_0ee58e885a87d988553542c0e6c56bc258b7478d3d7c4157233792539add3ab9/>
|
|
|
|
[~] Regular expression:
|
|
|
|
[~] Matched string: '-;<some_dangerous_input_0ee58e885a87d988553542c0e6c56bc258b7478d3d7c4157233792539add3ab9/>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[+] Plugin data:
|
|
|
|
[~] ---------------
|
|
|
|
|
|
|
|
|
|
|
|
[*] Resolver
|
|
|
|
[~] ~~~~~~~~~~~~~~
|
|
|
|
[~] Description: Resolves vulnerable hostnames to IP addresses.
|
|
|
|
|
|
|
|
[~] testfire.net: 65.61.137.117
|
|
|
|
|
|
|
|
[*] Health map
|
|
|
|
[~] ~~~~~~~~~~~~~~
|
|
|
|
[~] Description: Generates a simple list of safe/unsafe URLs.
|
|
|
|
|
|
|
|
[~] Legend:
|
|
|
|
[+] No issues
|
|
|
|
[-] Has issues
|
|
|
|
|
|
|
|
[+] http://testfire.net/
|
|
|
|
[-] http://testfire.net/search.aspx
|
|
|
|
[-] http://testfire.net/search.aspx?txtSearch=arachni_text
|
|
|
|
|
|
|
|
[~] Total: 3
|
|
|
|
[+] Without issues: 1
|
|
|
|
[-] With issues: 2 ( 67% )
|
|
|
|
|
|
|
|
[*] Profiler
|
|
|
|
[~] ~~~~~~~~~~~~~~
|
|
|
|
[~] Description: Examines the behavior of the web application gathering general statistics
|
|
|
|
and performs taint analysis to determine which inputs affect the output.
|
|
|
|
|
|
|
|
It does not perform any vulnerability assessment nor does it send attack payloads.
|
|
|
|
|
|
|
|
[~] Inputs affecting output:
|
|
|
|
|
|
|
|
[+] Form using the 'txtSearch' input at 'http://testfire.net/' pointing to 'http://testfire.net/search.aspx' using 'GET'.
|
|
|
|
[~] It was submitted using the following parameters:
|
|
|
|
[~] * txtSearch = arachni_texte4e549408422875958476160732390defefcac7c2bd8353d918fe452d20de2a6
|
|
|
|
[~]
|
|
|
|
[~] The taint landed in the following elements at 'http://testfire.net/search.aspx?txtSearch=arachni_texte4e549408422875958476160732390defefcac7c2bd8353d918fe452d20de2a6':
|
|
|
|
[~] * Body
|
|
|
|
[+] Link using the 'txtSearch' input at 'http://testfire.net/search.aspx?txtSearch=arachni_text' pointing to 'http://testfire.net/search.aspx?txtSearch=arachni_text' using 'GET'.
|
|
|
|
[~] It was submitted using the following parameters:
|
|
|
|
[~] * txtSearch = arachni_text5f2703a5211db19a9020f7443f6a440fbc95cda90b7c2d53912f5ce47d050056
|
|
|
|
[~]
|
|
|
|
[~] The taint landed in the following elements at 'http://testfire.net/search.aspx?txtSearch=arachni_text5f2703a5211db19a9020f7443f6a440fbc95cda90b7c2d53912f5ce47d050056':
|
|
|
|
[~] * Body
|
|
|
|
|
|
|
|
[*] AutoLogin
|
|
|
|
[~] ~~~~~~~~~~~~~~
|
|
|
|
[~] Description: It looks for the login form in the user provided URL,
|
|
|
|
merges its input fields with the user supplied parameters and sets the cookies
|
|
|
|
of the response and request as framework-wide cookies to be used by the spider later on.
|
|
|
|
|
|
|
|
|
|
|
|
[+] Form submitted successfully.
|
|
|
|
[~] Cookies set to:
|
|
|
|
[~] * ASP.NET_SessionId = 14kge555fdb4bjflm3rx3t55
|
|
|
|
[~] * amSessionId = 204023334531
|
|
|
|
[~] * amUserInfo = UserName=anNtaXRo&Password=RGVtbzEyMzQ=
|
|
|
|
[~] * amUserId = 100116014
|
|
|
|
[~] * amCreditOffer = CardType=Gold&Limit=10000&Interest=7.9
|
|
|
|
|
|
|
|
[~] 100.0% [>] 100%
|
|
|
|
[~] Est. remaining time: --:--:--
|
|
|
|
|
|
|
|
[~] Crawler has discovered 2 pages.
|
|
|
|
[~] Audit limited to a max of 1 pages -- excluding 1 pages of Trainer feedback.
|
|
|
|
|
|
|
|
[~] Sent 40 requests.
|
|
|
|
[~] Received and analyzed 40 responses.
|
|
|
|
[~] In 00:00:06
|
|
|
|
[~] Average: 6 requests/second.
|
|
|
|
|
|
|
|
[~] Currently auditing http://testfire.net/search.aspx?txtSearch=arachni_text
|
|
|
|
[~] Burst response time total 0
|
|
|
|
[~] Burst response count total 0
|
|
|
|
[~] Burst average response time 0
|
|
|
|
[~] Burst average 0 requests/second
|
|
|
|
[~] Timed-out requests 0
|
|
|
|
[~] Original max concurrency 20
|
|
|
|
[~] Throttled max concurrency 20
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<h2 id='proxy'><a href='#proxy'>Proxy</a></h2>
|
|
|
|
|
|
|
|
<h3 id='proxy_server'><a href='#proxy_server'>Proxy server (--proxy)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: server:port
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni to send all requests via a proxy server.
|
|
|
|
|
|
|
|
<h3 id='proxy-auth'><a href='#proxy-auth'>Proxy authentication (--proxy-auth)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: username:password
|
|
|
|
*Default*: disabled
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni authenticate itself with the proxy server using the supplied username and password.
|
|
|
|
|
|
|
|
<h3 id='proxy-type'><a href='#proxy-type'>Proxy type (--proxy-type)</a></h3>
|
|
|
|
|
|
|
|
*Expects*: http, http_1_0, socks4, socks5, socks4a
|
|
|
|
*Default*: disabled OR http
|
|
|
|
*Multiple invocations?*: no
|
|
|
|
|
|
|
|
Tells Arachni what protocol to use to connect and comunicate with the proxy server.
|
|
|
|
|
|
|
|
<h2 id='cli_help_output'><a href='#cli_help_output'>CLI Help Output</a></h2>
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
$ arachni -h
|
|
|
|
Arachni - Web Application Security Scanner Framework v0.4.2
|
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
|
|
|
|
(With the support of the community and the Arachni Team.)
|
|
|
|
|
|
|
|
Website: http://arachni-scanner.com
|
|
|
|
Documentation: http://arachni-scanner.com/wiki
|
|
|
|
|
|
|
|
|
|
|
|
Usage: arachni [options] url
|
|
|
|
|
|
|
|
Supported options:
|
|
|
|
|
|
|
|
|
|
|
|
General ----------------------
|
|
|
|
|
|
|
|
-h
|
|
|
|
--help Output this.
|
|
|
|
|
|
|
|
-v Be verbose.
|
|
|
|
|
|
|
|
--debug Show what is happening internally.
|
|
|
|
(You should give it a shot sometime ;) )
|
|
|
|
|
|
|
|
--only-positives Echo positive results *only*.
|
|
|
|
|
|
|
|
--http-req-limit=<integer> Concurrent HTTP requests limit.
|
|
|
|
(Default: 20)
|
|
|
|
(Be careful not to kill your server.)
|
|
|
|
(*NOTE*: If your scan seems unresponsive try lowering the limit.)
|
|
|
|
|
|
|
|
--http-timeout=<integer> HTTP request timeout in milliseconds.
|
|
|
|
|
|
|
|
--cookie-jar=<filepath> Netscape HTTP cookie file, use curl to create it.
|
|
|
|
|
|
|
|
--cookie-string='<name>=<value>; <name2>=<value2>'
|
|
|
|
|
|
|
|
Cookies, as a string, to be sent to the web application.
|
|
|
|
|
|
|
|
--user-agent=<string> Specify user agent.
|
|
|
|
|
|
|
|
--custom-header='<name>=<value>'
|
|
|
|
|
|
|
|
Specify custom headers to be included in the HTTP requests.
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
--authed-by=<string> Who authorized the scan, include name and e-mail address.
|
|
|
|
(It'll make it easier on the sys-admins during log reviews.)
|
|
|
|
(Will be appended to the user-agent string.)
|
|
|
|
|
|
|
|
--login-check-url=<url> A URL used to verify that the scanner is still logged in to the web application.
|
|
|
|
(Requires 'login-check-pattern'.)
|
|
|
|
|
|
|
|
--login-check-pattern=<regexp>
|
|
|
|
|
|
|
|
A pattern used against the body of the 'login-check-url' to verify that the scanner is still logged in to the web application.
|
|
|
|
(Requires 'login-check-url'.)
|
|
|
|
|
|
|
|
Profiles -----------------------
|
|
|
|
|
|
|
|
--save-profile=<filepath> Save the current run profile/options to <filepath>.
|
|
|
|
|
|
|
|
--load-profile=<filepath> Load a run profile from <filepath>.
|
|
|
|
(Can be used multiple times.)
|
|
|
|
(You can complement it with more options, except for:
|
|
|
|
* --modules
|
|
|
|
* --redundant)
|
|
|
|
|
|
|
|
--show-profile Will output the running profile as CLI arguments.
|
|
|
|
|
|
|
|
|
|
|
|
Crawler -----------------------
|
|
|
|
|
|
|
|
-e <regexp>
|
|
|
|
--exclude=<regexp> Exclude urls matching <regexp>.
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
-i <regexp>
|
|
|
|
--include=<regexp> Include *only* urls matching <regex>.
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
--redundant=<regexp>:<limit>
|
|
|
|
|
|
|
|
Limit crawl on redundant pages like galleries or catalogs.
|
|
|
|
(URLs matching <regexp> will be crawled <limit> amount of times.)
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
--auto-redundant=<limit> Only follow <limit> amount of URLs with identical query parameter names.
|
|
|
|
(Default: inf)
|
|
|
|
(Will default to 10 if no value has been specified.)
|
|
|
|
|
|
|
|
-f
|
|
|
|
--follow-subdomains Follow links to subdomains.
|
|
|
|
(Default: off)
|
|
|
|
|
|
|
|
--depth=<integer> Directory depth limit.
|
|
|
|
(Default: inf)
|
|
|
|
(How deep Arachni should go into the site structure.)
|
|
|
|
|
|
|
|
--link-count=<integer> How many links to follow.
|
|
|
|
(Default: inf)
|
|
|
|
|
|
|
|
--redirect-limit=<integer> How many redirects to follow.
|
|
|
|
(Default: 20)
|
|
|
|
|
|
|
|
--extend-paths=<filepath> Add the paths in <file> to the ones discovered by the crawler.
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
--restrict-paths=<filepath> Use the paths in <file> instead of crawling.
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
|
|
|
|
Auditor ------------------------
|
|
|
|
|
|
|
|
-g
|
|
|
|
--audit-links Audit links.
|
|
|
|
|
|
|
|
-p
|
|
|
|
--audit-forms Audit forms.
|
|
|
|
|
|
|
|
-c
|
|
|
|
--audit-cookies Audit cookies.
|
|
|
|
|
|
|
|
--exclude-cookie=<name> Cookie to exclude from the audit by name.
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
--exclude-vector=<name> Input vector (parameter) not to audit by name.
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
--audit-headers Audit HTTP headers.
|
|
|
|
(*NOTE*: Header audits use brute force.
|
|
|
|
Almost all valid HTTP request headers will be audited
|
|
|
|
even if there's no indication that the web app uses them.)
|
|
|
|
(*WARNING*: Enabling this option will result in increased requests,
|
|
|
|
maybe by an order of magnitude.)
|
|
|
|
|
|
|
|
Coverage -----------------------
|
|
|
|
|
|
|
|
--audit-cookies-extensively Submit all links and forms of the page along with the cookie permutations.
|
|
|
|
(*WARNING*: This will severely increase the scan-time.)
|
|
|
|
|
|
|
|
--fuzz-methods Audit links, forms and cookies using both GET and POST requests.
|
|
|
|
(*WARNING*: This will severely increase the scan-time.)
|
|
|
|
|
|
|
|
--exclude-binaries Exclude non text-based pages from the audit.
|
|
|
|
(Binary content can confuse recon modules that perform pattern matching.)
|
|
|
|
|
|
|
|
Modules ------------------------
|
|
|
|
|
|
|
|
--lsmod=<regexp> List available modules based on the provided regular expression.
|
|
|
|
(If no regexp is provided all modules will be listed.)
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
|
|
|
|
-m <modname,modname..>
|
|
|
|
--modules=<modname,modname..>
|
|
|
|
|
|
|
|
Comma separated list of modules to load.
|
|
|
|
(Modules are referenced by their filename without the '.rb' extension, use '--lsmod' to list all.
|
|
|
|
Use '*' as a module name to deploy all modules or as a wildcard, like so:
|
|
|
|
xss* to load all xss modules
|
|
|
|
sqli* to load all sql injection modules
|
|
|
|
etc.
|
|
|
|
|
|
|
|
You can exclude modules by prefixing their name with a minus sign:
|
|
|
|
--modules=*,-backup_files,-xss
|
|
|
|
The above will load all modules except for the 'backup_files' and 'xss' modules.
|
|
|
|
|
|
|
|
Or mix and match:
|
|
|
|
-xss* to unload all xss modules.)
|
|
|
|
|
|
|
|
|
|
|
|
Reports ------------------------
|
|
|
|
|
|
|
|
--lsrep=<regexp> List available reports based on the provided regular expression.
|
|
|
|
(If no regexp is provided all reports will be listed.)
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
--repload=<filepath> Load audit results from an '.afr' report file.
|
|
|
|
(Allows you to create new reports from finished scans.)
|
|
|
|
|
|
|
|
--report='<report>:<optname>=<val>,<optname2>=<val2>,...'
|
|
|
|
|
|
|
|
<report>: the name of the report as displayed by '--lsrep'
|
|
|
|
(Reports are referenced by their filename without the '.rb' extension, use '--lsrep' to list all.)
|
|
|
|
(Default: stdout)
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
|
|
|
|
Plugins ------------------------
|
|
|
|
|
|
|
|
--lsplug=<regexp> List available plugins based on the provided regular expression.
|
|
|
|
(If no regexp is provided all plugins will be listed.)
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
--plugin='<plugin>:<optname>=<val>,<optname2>=<val2>,...'
|
|
|
|
|
|
|
|
<plugin>: the name of the plugin as displayed by '--lsplug'
|
|
|
|
(Plugins are referenced by their filename without the '.rb' extension, use '--lsplug' to list all.)
|
|
|
|
(Can be used multiple times.)
|
|
|
|
|
|
|
|
|
|
|
|
Proxy --------------------------
|
|
|
|
|
|
|
|
--proxy=<server:port> Proxy address to use.
|
|
|
|
|
|
|
|
--proxy-auth=<user:passwd> Proxy authentication credentials.
|
|
|
|
|
|
|
|
--proxy-type=<type> Proxy type; can be http, http_1_0, socks4, socks5, socks4a
|
|
|
|
(Default: http)
|
|
|
|
|
|
|
|
```
|
|
|
|
|
