arachni / arachni

Web Application Security Scanner Framework

Notice

Arachni is heading towards obsolescence, try out its next-gen successor Ecsypno Codename SCNR!

Arachni - Web Application Security Scanner Framework

Version	1.6.1.3
Homepage	http://arachni-scanner.com
Blog	http://arachni-scanner.com/blog
Github	http://github.com/Arachni/arachni
Documentation	https://github.com/Arachni/arachni/wiki
Code Documentation	http://rubydoc.info/github/Arachni/arachni
Support	http://support.arachni-scanner.com
Author	Tasos Laskos (@Zap0tek)
Twitter	@ArachniScanner
Copyright	2010-2022 Ecsypno
License	Arachni Public Source License v1.0 - (see LICENSE file)

Synopsis

Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications.

It is smart, it trains itself by monitoring and learning from the web application's behavior during the scan process and is able to perform meta-analysis using a number of factors in order to correctly assess the trustworthiness of results and intelligently identify (or avoid) false-positives.

Unlike other scanners, it takes into account the dynamic nature of web applications, can detect changes caused while travelling through the paths of a web application’s cyclomatic complexity and is able to adjust itself accordingly. This way, attack/input vectors that would otherwise be undetectable by non-humans can be handled seamlessly.

Moreover, due to its integrated browser environment, it can also audit and inspect client-side code, as well as support highly complicated web applications which make heavy use of technologies such as JavaScript, HTML5, DOM manipulation and AJAX.

Finally, it is versatile enough to cover a great deal of use cases, ranging from a simple command line scanner utility, to a global high performance grid of scanners, to a Ruby library allowing for scripted audits, to a multi-user multi-scan web collaboration platform.

Note: Despite the fact that Arachni is mostly targeted towards web application security, it can easily be used for general purpose scraping, data-mining, etc. with the addition of custom components.

Arachni offers:

A stable, efficient, high-performance framework

Check, report and plugin developers are allowed to easily and quickly create and deploy their components with the minimum amount of restrictions imposed upon them, while provided with the necessary infrastructure to accomplish their goals.

Furthermore, they are encouraged to take full advantage of the Ruby language under a unified framework that will increase their productivity without stifling them or complicating their tasks.

Moreover, that same framework can be utilized as any other Ruby library and lead to the development of brand new scanners or help you create highly customized scan/audit scenarios and/or scripted scans.

Simplicity

Although some parts of the Framework are fairly complex you will never have to deal them directly. From a user’s or a component developer’s point of view everything appears simple and straight-forward all the while providing power, performance and flexibility.

From the simple command-line utility scanner to the intuitive and user-friendly Web interface and collaboration platform, Arachni follows the principle of least surprise and provides you with plenty of feedback and guidance.

In simple terms

Arachni is designed to automatically detect security issues in web applications. All it expects is the URL of the target website and after a while it will present you with its findings.

Features

General

• Cookie-jar/cookie-string support.
• Custom header support.
• SSL support with fine-grained options.
• User Agent spoofing.
• Proxy support for SOCKS4, SOCKS4A, SOCKS5, HTTP/1.1 and HTTP/1.0.
• Proxy authentication.
• Site authentication (SSL-based, form-based, Cookie-Jar, Basic-Digest, NTLMv1, Kerberos and others).
• Automatic log-out detection and re-login during the scan (when the initial login was performed via the autologin, login_script or proxy plugins).
• Custom 404 page detection.
• UI abstraction:
  • Command-line Interface.
  • Web User Interface.
• Pause/resume functionality.
• Hibernation support -- Suspend to and restore from disk.
• High performance asynchronous HTTP requests.
  • With adjustable concurrency.
  • With the ability to auto-detect server health and adjust its concurrency automatically.
• Support for custom default input values, using pairs of patterns (to be matched against input names) and values to be used to fill in matching inputs.

Integrated browser environment

Arachni includes an integrated, real browser environment in order to provide sufficient coverage to modern web applications which make use of technologies such as HTML5, JavaScript, DOM manipulation, AJAX, etc.

In addition to the monitoring of the vanilla DOM and JavaScript environments, Arachni's browsers also hook into popular frameworks to make the logged data easier to digest:

• JQuery
• AngularJS
• More to come...

In essence, this turns Arachni into a DOM and JavaScript debugger, allowing it to monitor DOM events and JavaScript data and execution flows. As a result, not only can the system trigger and identify DOM-based issues, but it will accompany them with a great deal of information regarding the state of the page at the time.

Relevant information include:

• Page DOM, as HTML code.
  • With a list of DOM transitions required to restore the state of the page to the one at the time it was logged.
• Original DOM (i.e. prior to the action that caused the page to be logged), as HTML code.
  • With a list of DOM transitions.
• Data-flow sinks -- Each sink is a JS method which received a tainted argument.
  • Parent object of the method (ex.: DOMWindow).
  • Method signature (ex.: decodeURIComponent()).
  • Arguments list.
    • With the identified taint located recursively in the included objects.
  • Method source code.
  • JS stacktrace.
• Execution flow sinks -- Each sink is a successfully executed JS payload, as injected by the security checks.
  • Includes a JS stacktrace.
• JavaScript stack-traces include:
  • Method names.
  • Method locations.
  • Method source codes.
  • Argument lists.

In essence, you have access to roughly the same information that your favorite debugger (for example, FireBug) would provide, as if you had set a breakpoint to take place at the right time for identifying an issue.

Browser-cluster

The browser-cluster is what coordinates the browser analysis of resources and allows the system to perform operations which would normally be quite time consuming in a high-performance fashion.

Configuration options include:

• Adjustable pool-size, i.e. the amount of browser workers to utilize.
• Timeout for each job.
• Worker TTL counted in jobs -- Workers which exceed the TTL have their browser process respawned.
• Ability to disable loading images.
• Adjustable screen width and height.
  • Can be used to analyze responsive and mobile applications.
• Ability to wait until certain elements appear in the page.
• Configurable local storage data.

Coverage

The system can provide great coverage to modern web applications due to its integrated browser environment. This allows it to interact with complex applications that make heavy use of client-side code (like JavaScript) just like a human would.

In addition to that, it also knows about which browser state changes the application has been programmed to handle and is able to trigger them programatically in order to provide coverage for a full set of possible scenarios.

By inspecting all possible pages and their states (when using client-side code) Arachni is able to extract and audit the following elements and their inputs:

• Forms
  • Along with ones that require interaction via a real browser due to DOM events.
• User-interface Forms
  • Input and button groups which don't belong to an HTML <form> element but are instead associated via JS code.
• User-interface Inputs
  • Orphan <input> elements with associated DOM events.
• Links
  • Along with ones that have client-side parameters in their fragment, i.e.: http://example.com/#/?param=val&param2=val2
  • With support for rewrite rules.
• LinkTemplates -- Allowing for extraction of arbitrary inputs from generic paths, based on user-supplied templates -- useful when rewrite rules are not available.
  • Along with ones that have client-side parameters in their URL fragments, i.e.: http://example.com/#/param/val/param2/val2
• Cookies
  • Also supports nested cookies, containing key-value pairs inside individual cookies.
• Headers
• Generic client-side elements which have associated DOM events.
• AJAX-request parameters.
• JSON request data.
• XML request data.

Open distributed architecture

Arachni is designed to fit into your workflow and easily integrate with your existing infrastructure.

Depending on the level of control you require over the process, you can either choose the REST service or the custom RPC protocol.

Both approaches allow you to:

• Remotely monitor and manage scans.
• Perform multiple scans at the same time -- Each scan is compartmentalized to its own OS process to take advantage of:
  • Multi-core/SMP architectures.
  • OS-level scheduling/restrictions.
  • Sandboxed failure propagation.
• Communicate over a secure channel.

REST API

• Very simple and straightforward API.
• Easy interoperability with non-Ruby systems.
  • Operates over HTTP.
  • Uses JSON to format messages.
• Stateful scan monitoring.
  • Unique sessions automatically only receive updates when polling for progress, rather than full data.

RPC API

• High-performance/low-bandwidth communication protocol.
  • MessagePack serialization for performance, efficiency and ease of integration with 3rd party systems.
• Grid:
  • Self-healing.
  • Scale up/down by hot-plugging/hot-unplugging nodes.
    • Can scale up infinitely by adding nodes to increase scan capacity.
  • (Always-on) Load-balancing -- All Instances are automatically provided by the least burdened Grid member.
    • With optional per-scan opt-out/override.
  • (Optional) High-Performance mode -- Combines the resources of multiple nodes to perform multi-Instance scans.
    • Enabled on a per-scan basis.

Scope configuration

• Filters for redundant pages like galleries, catalogs, etc. based on regular expressions and counters.
  • Can optionally detect and ignore redundant pages automatically.
• URL exclusion filters using regular expressions.
• Page exclusion filters based on content, using regular expressions.
• URL inclusion filters using regular expressions.
• Can be forced to only follow HTTPS paths and not downgrade to HTTP.
• Can optionally follow subdomains.
• Adjustable page count limit.
• Adjustable redirect limit.
• Adjustable directory depth limit.
• Adjustable DOM depth limit.
• Adjustment using URL-rewrite rules.
• Can read paths from multiple user supplied files (to both restrict and extend the scope).

Audit

• Can audit:
  • Forms
    • Can automatically refresh nonce tokens.
    • Can submit them via the integrated browser environment.
  • User-interface Forms
    • Input and button groups which don't belong to an HTML <form> element but are instead associated via JS code.
  • User-interface Inputs
    • Orphan <input> elements with associated DOM events.
  • Links
    • Can load them via the integrated browser environment.
  • LinkTemplates
    • Can load them via the integrated browser environment.
  • Cookies
    • Can load them via the integrated browser environment.
  • Headers
  • Generic client-side DOM elements.
  • JSON request data.
  • XML request data.
• Can ignore binary/non-text pages.
• Can audit elements using both GET and POST HTTP methods.
• Can inject both raw and HTTP encoded payloads.
• Can submit all links and forms of the page along with the cookie permutations to provide extensive cookie-audit coverage.
• Can exclude specific input vectors by name.
• Can include specific input vectors by name.

Components

Arachni is a highly modular system, employing several components of distinct types to perform its duties.

In addition to enabling or disabling the bundled components so as to adjust the system's behavior and features as needed, functionality can be extended via the addition of user-created components to suit almost every need.

Platform fingerprinters

In order to make efficient use of the available bandwidth, Arachni performs rudimentary platform fingerprinting and tailors the audit process to the server-side deployed technologies by only using applicable payloads.

Currently, the following platforms can be identified:

• Operating systems
  • BSD
  • Linux
  • Unix
  • Windows
  • Solaris
• Web servers
  • Apache
  • IIS
  • Nginx
  • Tomcat
  • Jetty
  • Gunicorn
• Programming languages
  • PHP
  • ASP
  • ASPX
  • Java
  • Python
  • Ruby
• Frameworks
  • Rack
  • CakePHP
  • Rails
  • Django
  • ASP.NET MVC
  • JSF
  • CherryPy
  • Nette
  • Symfony

The user also has the option of specifying extra platforms (like a DB server) in order to help the system be as efficient as possible. Alternatively, fingerprinting can be disabled altogether.

Finally, Arachni will always err on the side of caution and send all available payloads when it fails to identify specific platforms.

Checks

Checks are system components which perform security checks and log issues.

Active

Active checks engage the web application via its inputs.

• SQL injection (sql_injection) -- Error based detection.
  • Oracle
  • InterBase
  • PostgreSQL
  • MySQL
  • MSSQL
  • EMC
  • SQLite
  • DB2
  • Informix
  • Firebird
  • SaP Max DB
  • Sybase
  • Frontbase
  • Ingres
  • HSQLDB
  • MS Access
• Blind SQL injection using differential analysis (sql_injection_differential).
• Blind SQL injection using timing attacks (sql_injection_timing).
  • MySQL
  • PostgreSQL
  • MSSQL
• NoSQL injection (no_sql_injection) -- Error based vulnerability detection.
  • MongoDB
• Blind NoSQL injection using differential analysis (no_sql_injection_differential).
• CSRF detection (csrf).
• Code injection (code_injection).
  • PHP
  • Ruby
  • Python
  • Java
  • ASP
• Blind code injection using timing attacks (code_injection_timing).
  • PHP
  • Ruby
  • Python
  • Java
  • ASP
• LDAP injection (ldap_injection).
• Path traversal (path_traversal).
  • *nix
  • Windows
  • Java
• File inclusion (file_inclusion).
  • *nix
  • Windows
  • Java
  • PHP
  • Perl
• Response splitting (response_splitting).
• OS command injection (os_cmd_injection).
  • *nix
  • *BSD
  • IBM AIX
  • Windows
• Blind OS command injection using timing attacks (os_cmd_injection_timing).
  • Linux
  • *BSD
  • Solaris
  • Windows
• Remote file inclusion (rfi).
• Unvalidated redirects (unvalidated_redirect).
• Unvalidated DOM redirects (unvalidated_redirect_dom).
• XPath injection (xpath_injection).
  • Generic
  • PHP
  • Java
  • dotNET
  • libXML2
• XSS (xss).
• Path XSS (xss_path).
• XSS in event attributes of HTML elements (xss_event).
• XSS in HTML tags (xss_tag).
• XSS in script context (xss_script_context).
• DOM XSS (xss_dom).
• DOM XSS script context (xss_dom_script_context).
• Source code disclosure (source_code_disclosure)
• XML External Entity (xxe).
  • Linux
  • *BSD
  • Solaris
  • Windows

Passive

Passive checks look for the existence of files, folders and signatures.

• Allowed HTTP methods (allowed_methods).
• Back-up files (backup_files).
• Backup directories (backup_directories)
• Common administration interfaces (common_admin_interfaces).
• Common directories (common_directories).
• Common files (common_files).
• HTTP PUT (http_put).
• Insufficient Transport Layer Protection for password forms (unencrypted_password_form).
• WebDAV detection (webdav).
• HTTP TRACE detection (xst).
• Credit Card number disclosure (credit_card).
• CVS/SVN user disclosure (cvs_svn_users).
• Private IP address disclosure (private_ip).
• Common backdoors (backdoors).
• .htaccess LIMIT misconfiguration (htaccess_limit).
• Interesting responses (interesting_responses).
• HTML object grepper (html_objects).
• E-mail address disclosure (emails).
• US Social Security Number disclosure (ssn).
• Forceful directory listing (directory_listing).
• Mixed Resource/Scripting (mixed_resource).
• Insecure cookies (insecure_cookies).
• HttpOnly cookies (http_only_cookies).
• Auto-complete for password form fields (password_autocomplete).
• Origin Spoof Access Restriction Bypass (origin_spoof_access_restriction_bypass)
• Form-based upload (form_upload)
• localstart.asp (localstart_asp)
• Cookie set for parent domain (cookie_set_for_parent_domain)
• Missing Strict-Transport-Security headers for HTTPS sites (hsts).
• Missing X-Frame-Options headers (x_frame_options).
• Insecure CORS policy (insecure_cors_policy).
• Insecure cross-domain policy (allow-access-from) (insecure_cross_domain_policy_access)
• Insecure cross-domain policy (allow-http-request-headers-from) (insecure_cross_domain_policy_headers)
• Insecure client-access policy (insecure_client_access_policy)

Reporters

• Standard output
• HTML (zip) (html).
• XML (xml).
• Text (text).
• JSON (json)
• Marshal (marshal)
• YAML (yaml)
• AFR (afr)
  • The default Arachni Framework Report format.

Plugins

Plugins add extra functionality to the system in a modular fashion, this way the core remains lean and makes it easy for anyone to add arbitrary functionality.

• Passive Proxy (proxy) -- Analyzes requests and responses between the web app and the browser assisting in AJAX audits, logging-in and/or restricting the scope of the audit.
• Form based login (autologin).
• Script based login (login_script).
• Dictionary attacker for HTTP Auth (http_dicattack).
• Dictionary attacker for form based authentication (form_dicattack).
• Cookie collector (cookie_collector) -- Keeps track of cookies while establishing a timeline of changes.
• WAF (Web Application Firewall) Detector (waf_detector) -- Establishes a baseline of normal behavior and uses rDiff analysis to determine if malicious inputs cause any behavioral changes.
• BeepNotify (beep_notify) -- Beeps when the scan finishes.
• EmailNotify (email_notify) -- Sends a notification (and optionally a report) over SMTP at the end of the scan.
• VectorFeed (vector_feed) -- Reads in vector data from which it creates elements to be audited. Can be used to perform extremely specialized/narrow audits on a per vector/element basis. Useful for unit-testing or a gazillion other things.
• Script (script) -- Loads and runs an external Ruby script under the scope of a plugin, used for debugging and general hackery.
• Uncommon headers (uncommon_headers) -- Logs uncommon headers.
• Content-types (content_types) -- Logs content-types of server responses aiding in the identification of interesting (possibly leaked) files.
• Vector collector (vector_collector) -- Collects information about all seen input vectors which are within the scan scope.
• Headers collector (headers_collector) -- Collects response headers based on specified criteria.
• Exec (exec) -- Calls external executables at different scan stages.
• Metrics (metrics) -- Captures metrics about multiple aspects of the scan and the web application.
• Restrict to DOM state (restrict_to_dom_state) -- Restricts the audit to a single page's DOM state, based on a URL fragment.
• Webhook notify (webhook_notify) -- Sends a webhook payload over HTTP at the end of the scan.
• Rate limiter (rate_limiter) -- Rate limits HTTP requests.
• Page dump (page_dump) -- Dumps page data to disk as YAML.

Defaults

Default plugins will run for every scan and are placed under /plugins/defaults/.

• AutoThrottle (autothrottle) -- Dynamically adjusts HTTP throughput during the scan for maximum bandwidth utilization.
• Healthmap (healthmap) -- Generates sitemap showing the health of each crawled/audited URL

Meta

Plugins under /plugins/defaults/meta/ perform analysis on the scan results to determine trustworthiness or just add context information or general insights.

• TimingAttacks (timing_attacks) -- Provides a notice for issues uncovered by timing attacks when the affected audited pages returned unusually high response times to begin with. It also points out the danger of DoS attacks against pages that perform heavy-duty processing.
• Discovery (discovery) -- Performs anomaly detection on issues logged by discovery checks and warns of the possibility of false positives where applicable.
• Uniformity (uniformity) -- Reports inputs that are uniformly vulnerable across a number of pages hinting to the lack of a central point of input sanitization.

Trainer subsystem

The Trainer is what enables Arachni to learn from the scan it performs and incorporate that knowledge, on the fly, for the duration of the audit.

Checks have the ability to individually force the Framework to learn from the HTTP responses they are going to induce.

However, this is usually not required since Arachni is aware of which requests are more likely to uncover new elements or attack vectors and will adapt itself accordingly.

Still, this can be an invaluable asset to Fuzzer checks.

Installation

Usage

Running the specs

You can run rake spec to run all specs or you can run them selectively using the following:

rake spec:core            # for the core libraries
rake spec:checks          # for the checks
rake spec:plugins         # for the plugins
rake spec:reports         # for the reports
rake spec:path_extractors # for the path extractors

Please be warned, the core specs will require a beast of a machine due to the necessity to test the Grid/multi-Instance features of the system.

Note: The check specs will take many hours to complete due to the timing-attack tests.

Bug reports/Feature requests

Submit bugs using GitHub Issues and get support via the Support Portal.

Contributing

(Before starting any work, please read the instructions for working with the source code.)

We're happy to accept help from fellow code-monkeys and these are the steps you need to follow in order to contribute code:

• Fork the project.
• Start a feature branch based on the experimental branch (git checkout -b <feature-name> experimental).
• Add specs for your code.
• Run the spec suite to make sure you didn't break anything (rake spec:core for the core libs or rake spec for everything).
• Commit and push your changes.
• Issue a pull request and wait for your code to be reviewed.

License

Arachni Public Source License v1.0 -- please see the LICENSE file for more information.

arachni's Issues

Shutdown doesn't work in Dispatcher screen

Pressing "Shutdown" on my dispatcher page does not end the process. I have to attach to the process first and then do the shutdown in order for it to work.

Arachni hangs

Arachni 0.2.2.1 loops on my application. You will be happy (or not) to know that Accunetix has the same problem. It is a CodeIgniter app, so the URL is a bit odd. The URL where it hangs has this form:
http:///app/utils/login_form/redirect//app/answers/detail/a_id/46

It seems to think that it has to try all the different possible integers (which is also what Accunetix does, apparently heading for maxint).

I have two files - the afr file and stderr from the run which I can provide if you let me know that you want them.

Thanks,
gary

Th

Can't convert Symbol into String

[*] [HTTP: 200] http://comedortandil.unicen.edu.ar/xgap/motores/signos/testeo/selenium/core/TestRunner-splash.html
[v] [Forms: 0 ]

[!]
[!] Thread-1 Arachni::Modules::Audit::XSS
[!]
[*] Arachni::Modules::Audit::XSS
[-] can't convert Symbol into String
[!] /mnt/sec/pentest/webscan/arachni/lib/audit_store.rb:72:in +' [!] /mnt/sec/pentest/webscan/arachni/lib/audit_store.rb:72:inblock in initialize'
[!] /mnt/sec/pentest/webscan/arachni/lib/audit_store.rb:70:in each' [!] /mnt/sec/pentest/webscan/arachni/lib/audit_store.rb:70:ininitialize'
[!] /mnt/sec/pentest/webscan/arachni/lib/framework.rb:248:in new' [!] /mnt/sec/pentest/webscan/arachni/lib/framework.rb:248:inaudit_store_get'
[!] /mnt/sec/pentest/webscan/arachni/lib/framework.rb:133:in run' [!] /mnt/sec/pentest/webscan/arachni/lib/ui/cli/cli.rb:102:inrun'
[!] ./arachni_cli.rb:20:in `

'

[-] #<SystemExit: exit>
[!] Backtrace:
[!] /mnt/sec/pentest/webscan/arachni/lib/framework.rb:138:in exit' [!] /mnt/sec/pentest/webscan/arachni/lib/framework.rb:138:inrescue in run'
[!] /mnt/sec/pentest/webscan/arachni/lib/framework.rb:132:in run' [!] /mnt/sec/pentest/webscan/arachni/lib/ui/cli/cli.rb:102:inrun'
[!] ./arachni_cli.rb:20:in `

'

This happened to me while pentesting a simple website with 2 html, (one without forms) with this command:
[matt@mfsec arachni]$ ./arachni_cli.rb -pv --mods=xss http://test/TestRunner-Splash.html --debug

Add a false positive reporting service

Add a false positive reporting service to be used via the HTML report.

Use asymmetric crypto to encrypt the stacktrace and other debugging data in case they contain sensitive info and send them to a trusted e-mail address via a relay server.

gem install not working over Mac OS X

Hi Tasos, I was trying to install arachni gem in my Macbook (Mac OSX 10.6 - ruby 1.9.2 via rvm) but installed failed due to an error while installing sys-proctable.

I guess this dependence won't allow arachni to be installed as a gem under Mac OS X.
Am I correct?

Can we move over sys-proctable in some way?

is it arachni v0.2.2.2 not stable

I use arachni to do pentest these days(command line as the author suggest me to use).
use the newset version. installed in my ubuntu vmware. it crashed my os two times .
but when i use arachni ,i also use skipfish. i want compare there scan result.
is it the problem of use two scanner at the same time .
another question is
I can not read the scan result .afr format. I also met problem with convert the afr document to html. with encode problem. any one can help my issue.

warning: already initialized constant

[matt@mfsec /mnt/sec/pentest/webscan/arachni ]$ ./arachni.rb --help
/mnt/sec/pentest/webscan/arachni/lib/typhoeus/easy.rb:21: warning: already initialized constant CURLINFO_STRING
/mnt/sec/pentest/webscan/arachni/lib/typhoeus/easy.rb:22: warning: already initialized constant OPTION_VALUES

It's not a big deal, and I'm not sure if arachni has anything to do with it, but i checked that 'easy.rb' file and there are not repeated constants.

Directory listing enabled - false positive

While performing the scan using this tool it gave an issue of directory listing enabled for one of my web application.

When I have tried to verify the same there wasn't any directory listing.

Thanks & Regards,
Dhiraj Ranka

Add double encoded paths

Double encode paths in modules to avoid detection and increase chances of discovery where applicable.

arachni_cli.rb uses hard coded ruby path

At the moment arachni_cli.rb starts up with #!/usr/bin/ruby , which doesn't work if ruby is installed in an alternate location (eg, if you're using RVM)

One option which could be more flexible for this would be to change it to #!/usr/bin/env ruby to pick the first ruby off the users path.

WAF Evasion Plugin

Create a arachni waf evasion plugin now that you already have a WAF fingerprinting plugin. It should focus on the most common WAF: modsecurity, F5, Imperva, etc.

Add support for importing a list of target URLs/websites

What the titles says.

Session ID Audit Plugin

Implement plugin to test the randomness of web app session ID.

Not an archani issue.

[matt@mfsec Zapotek-arachni]$ gem -v
1.3.7
[matt@mfsec Zapotek-arachni]$ ruby -v
ruby 1.9.2p0 (2010-08-18 revision 29036) [x86_64-linux]

[matt@mfsec Zapotek-arachni]$ ./arachni_cli.rb
internal:lib/rubygems/custom_require:29:in require': no such file to load -- ap (LoadError) from <internal:lib/rubygems/custom_require>:29:inrequire'
from ./arachni_cli.rb:13:in `

'

I reinstalled but can't make it work, I'm pretty new on working with ruby, but willing to help.

SSL and auth token by default over XMLRPC

Use SSL by default on client->server configurations and assign unique and random authentication tokens to clients and dispatched instances respectively.

Static binary analysis integration

Arachni should integrate with a static binary analysis tool so it can verify its findings with a binary analysis or source code static analysis tool.

Request SQL response limit

I am testing this against an application that utilizes a very large database, and a normal SELECT * FROM is enough to DoS the SQL server, and then the scanner doesn't get very far. Could you add the option into settings to limit the SELECT to a single field return with LIMIT 0,1...(or even 0,30 is fine). This way I can actually get a full scan done before the server dies on me.

Ctrl+c arachni.

Improve a way to stop arachni whenever the user wants.

robots.txt false positive

Arachni reports robots.txt for:

Exposure of Backup File to an Unauthorized Control Sphere

This file is supposed to be exposed and has no security implications. Even if you block your admin directory there, other rules should pick that up.

 [+] A common sensitive file exists on the server.
 [~] ~~~~~~~~~~~~~~~~~~~~
 [~] Severity: Low
 [~] URL:      http://localhost/robots.txt
 [~] Elements: path
 [~] Variable: n/a
 [~] Description: 
 [~] 

 [~] CWE: http://cwe.mitre.org/data/definitions/530.html

Maintain a persistent, off-line cache of 404 signatures.

Generation of signatures for custom 404 pages should be stored off-line and be reused in later scans in order to avoid unnecessary processing and network overhead.

Failed to load ap

Hi,
I have this error while trying to use arachni. Here is the error:
$ ruby1.9.1 arachni.rb
internal:lib/rubygems/custom_require:29:in require': no such file to load -- ap (LoadError) from <internal:lib/rubygems/custom_require>:29:inrequire'
from arachni.rb:13:in `

'
My conf is:
*Ubuntu 10.10
*Ruby 1.9.1

Issue with function names containing symbols

The function names that use symbols (thanks for fixing the ones with ? and !) like = and others are causing issues. Just a friendly note: The specification (at http://www.xmlrpc.com/spec ) says: "The must contain a sub-item, a string, containing the name of the method to be called. The string may only contain identifier characters, upper and lower-case A-Z, the numeric characters, 0-9, underscore, dot, colon and slash. It's entirely up to the server to decide how to interpret the characters in a methodName."

Arachni is not scanning pages after login page.

My application is a J2EE web application deployed on web logic server. Each and every page needs authorization. It works like this.
First page is a log-in form. After you logged in, you gain access to the application and then you can navigate to any other page otherwise it will revert back to log-in page.

I am running arachni command like this.

arachni http://localhost:portnumber/myapplication/ --plugin=autologin:url=loginpageurl,params='username=username&password=pass'

autoplugin outputs: Form submitted successfully .

but it does not go beyond log-in page.

Thanks in advance

arachni fails to load

Hello

I'm running into a problem when running arachni:

$ gem install arachni
Successfully installed arachni-0.2.3
1 gem installed
Installing ri documentation for arachni-0.2.3...
Installing RDoc documentation for arachni-0.2.3...

Jörg@hobbes ~
$ arachni -h
/usr/local/lib/ruby/gems/1.9.1/gems/nokogiri-1.4.4/lib/nokogiri/xml/attribute_decl.rb:7:in `undef_method': undefined met
hod `attributes' for class `Nokogiri::XML::AttributeDecl' (NameError)
        from /usr/local/lib/ruby/gems/1.9.1/gems/nokogiri-1.4.4/lib/nokogiri/xml/attribute_decl.rb:7:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/nokogiri-1.4.4/lib/nokogiri/xml/attribute_decl.rb:5:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/nokogiri-1.4.4/lib/nokogiri/xml/attribute_decl.rb:2:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/nokogiri-1.4.4/lib/nokogiri/xml/attribute_decl.rb:1:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/nokogiri-1.4.4/lib/nokogiri/xml.rb:5:in `require'
        from /usr/local/lib/ruby/gems/1.9.1/gems/nokogiri-1.4.4/lib/nokogiri/xml.rb:5:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/nokogiri-1.4.4/lib/nokogiri.rb:36:in `require'
        from /usr/local/lib/ruby/gems/1.9.1/gems/nokogiri-1.4.4/lib/nokogiri.rb:36:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/anemone/page.rb:11:in `require'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/anemone/page.rb:11:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/anemone/http.rb:11:in `require'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/anemone/http.rb:11:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/anemone/tentacle.rb:2:in `require'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/anemone/tentacle.rb:2:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/anemone/core.rb:15:in `require'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/anemone/core.rb:15:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/anemone.rb:2:in `require'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/anemone.rb:2:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/spider.rb:11:in `require'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/spider.rb:11:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/framework.rb:20:in `require'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/framework.rb:20:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/ui/cli/cli.rb:15:in `require'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/ui/cli/cli.rb:15:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/ui/cli/cli.rb:12:in `'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/bin/arachni:19:in `require'
        from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/bin/arachni:19:in `'
        from /usr/local/bin/arachni:19:in `load'
        from /usr/local/bin/arachni:19:in `'

This is in Cygwin, just after installing everything.

Thanks for your help!
Joerg

undefined method `pause' for class `Arachni::RPC::XML::Framework' Experimental Branch

Hi,
After using the experimental branch trying to run the arachni_xmlrpcd.rb gives me this error:
ruby arachni_xmlrpcd.rb
/Users/satyajit/Downloads/arachni/arachni-ext/lib/typhoeus/easy.rb:21: warning: already initialized constant CURLINFO_STRING
/Users/satyajit/Downloads/arachni/arachni-ext/lib/typhoeus/easy.rb:22: warning: already initialized constant OPTION_VALUES
/Users/satyajit/Downloads/arachni/arachni-ext/lib/typhoeus/easy.rb:67: warning: already initialized constant INFO_VALUES
/Users/satyajit/Downloads/arachni/arachni-ext/lib/rpc/xml/framework.rb:47:in <class:Framework>': undefined methodpause' for class Arachni::RPC::XML::Framework' (NameError) from /Users/satyajit/Downloads/arachni/arachni-ext/lib/rpc/xml/framework.rb:28:inmodule:XML'
from /Users/satyajit/Downloads/arachni/arachni-ext/lib/rpc/xml/framework.rb:18:in <module:RPC>' from /Users/satyajit/Downloads/arachni/arachni-ext/lib/rpc/xml/framework.rb:17:inmodule:Arachni'
from /Users/satyajit/Downloads/arachni/arachni-ext/lib/rpc/xml/framework.rb:11:in <top (required)>' from <internal:lib/rubygems/custom_require>:29:inrequire'
from internal:lib/rubygems/custom_require:29:in require' from /Users/satyajit/Downloads/arachni/arachni-ext/lib/rpc/xml/server.rb:19:inmodule:Arachni'
from /Users/satyajit/Downloads/arachni/arachni-ext/lib/rpc/xml/server.rb:16:in <top (required)>' from <internal:lib/rubygems/custom_require>:29:inrequire'
from internal:lib/rubygems/custom_require:29:in require' from /Users/satyajit/Downloads/arachni/arachni-ext/lib/rpc/xml/dispatcher/server.rb:16:inmodule:Arachni'
from /Users/satyajit/Downloads/arachni/arachni-ext/lib/rpc/xml/dispatcher/server.rb:14:in <top (required)>' from <internal:lib/rubygems/custom_require>:29:inrequire'
from internal:lib/rubygems/custom_require:29:in require' from arachni_xmlrpcd.rb:78:in

'

Issue with installing 2.3

Good morning,

I'm using 2.2 for a long time and find it cool!
Today, I went into the process to install 2.3 but (ruby 1.9.2):

PC:$sudo gem install arachni
........
.........
PC:$ arachni -h
internal:lib/rubygems/custom_require:33:in require': no such file to load -- robots (LoadError) from <internal:lib/rubygems/custom_require>:33:inrescue in require'
from internal:lib/rubygems/custom_require:29:in require' from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/anemone/core.rb:12:in<top (required)>'
from internal:lib/rubygems/custom_require:29:in require' from <internal:lib/rubygems/custom_require>:29:inrequire'
from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/anemone.rb:2:in <top (required)>' from <internal:lib/rubygems/custom_require>:29:inrequire'
from internal:lib/rubygems/custom_require:29:in require' from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/spider.rb:11:in<top (required)>'
from internal:lib/rubygems/custom_require:29:in require' from <internal:lib/rubygems/custom_require>:29:inrequire'
from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/framework.rb:20:in <top (required)>' from <internal:lib/rubygems/custom_require>:29:inrequire'
from internal:lib/rubygems/custom_require:29:in require' from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/ui/cli/cli.rb:15:inmodule:Arachni'
from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/lib/ui/cli/cli.rb:12:in <top (required)>' from <internal:lib/rubygems/custom_require>:29:inrequire'
from internal:lib/rubygems/custom_require:29:in require' from /usr/local/lib/ruby/gems/1.9.1/gems/arachni-0.2.3/bin/arachni:19:in<top (required)>'
from /usr/local/bin/arachni:19:in load' from /usr/local/bin/arachni:19:in

'

I'm using ubunyu 11.04 ... any idea?
thanks in advance...

Error on plugin-data?

I get this error running every type of scan:

[+] Plugin data:
[~] ---------------

[-] undefined method info' for nil:NilClass [-] undefined methodinfo' for nil:NilClass
/Users/xxxx/.rvm/gems/ruby-1.9.2-p0/gems/arachni-0.2.2.2/lib/component_manager.rb:72:in prep_opts': undefined methodinfo' for nil:NilClass (NoMethodError)
from /Users/xxxx/.rvm/gems/ruby-1.9.2-p0/gems/arachni-0.2.2.2/lib/report/manager.rb:70:in run_one' from /Users/xxxx/.rvm/gems/ruby-1.9.2-p0/gems/arachni-0.2.2.2/lib/report/manager.rb:65:inrun'
from /Users/xxxx/.rvm/gems/ruby-1.9.2-p0/gems/arachni-0.2.2.2/lib/framework.rb:194:in block in run' from /Users/xxxx/.rvm/gems/ruby-1.9.2-p0/gems/arachni-0.2.2.2/lib/module/utilities.rb:97:incall'
from /Users/xxxx/.rvm/gems/ruby-1.9.2-p0/gems/arachni-0.2.2.2/lib/module/utilities.rb:97:in exception_jail' from /Users/xxxx/.rvm/gems/ruby-1.9.2-p0/gems/arachni-0.2.2.2/lib/framework.rb:194:inrun'
from /Users/xxxx/.rvm/gems/ruby-1.9.2-p0/gems/arachni-0.2.2.2/lib/ui/cli/cli.rb:97:in run' from /Users/xxxx/.rvm/gems/ruby-1.9.2-p0/gems/arachni-0.2.2.2/bin/arachni:22:in<top (required)>'
from /Users/xxxx/.rvm/gems/ruby-1.9.2-p0/bin/arachni:19:in load' from /Users/xxxx/.rvm/gems/ruby-1.9.2-p0/bin/arachni:19:in

'

-- Any thoughts on what's going on?

Preliminary reports

It would be nice if Arachni could dump preliminary reports. Now I have to wait for it to finish, which can take very long...

To improve option --lsmod

lsmod will never end if there are dozens of modules.

1. it should pause after 5 modules (so that user can view them within one screen length of console).
2. it should do like this for each category - audit, recon..etc

--lsmod audit

will list modules in audit

--lsmod recon

will list modules in recon

Best Regards
YGN Ethical Hacker Group
http://yehg.net/

AJAX & JSON support?

Not sure if it exists, but can arachni follow ajax (and by relationship how about some jQuery stuff) to locate pages and addition information and in addition read JSON to determine locations of further possibly exploited areas.

Libs don't loading

Sry for topic but I don't know what's going up.

$ ruby1.9.1 arachni.rb

return:

/home/r9s/.gem/ruby/1.9.1/gems/nokogiri-1.4.3.1/lib/nokogiri.rb:13:in `require': no such file to load -- nokogiri/nokogiri (LoadError) from /home/r9s/.gem/ruby/1.9.1/gems/nokogiri-1.4.3.1/lib/nokogiri.rb:13:in`' from /var/lib/gems/1.9.1/gems/anemone-0.5.0/lib/anemone/page.rb:1:in `require' from /var/lib/gems/1.9.1/gems/anemone-0.5.0/lib/anemone/page.rb:1:in`' from /var/lib/gems/1.9.1/gems/anemone-0.5.0/lib/anemone/http.rb:2:in `require' from /var/lib/gems/1.9.1/gems/anemone-0.5.0/lib/anemone/http.rb:2:in`' from /var/lib/gems/1.9.1/gems/anemone-0.5.0/lib/anemone/tentacle.rb:1:in `require' from /var/lib/gems/1.9.1/gems/anemone-0.5.0/lib/anemone/tentacle.rb:1:in`' from /var/lib/gems/1.9.1/gems/anemone-0.5.0/lib/anemone/core.rb:3:in `require' from /var/lib/gems/1.9.1/gems/anemone-0.5.0/lib/anemone/core.rb:3:in`' from /var/lib/gems/1.9.1/gems/anemone-0.5.0/lib/anemone.rb:2:in `require' from /var/lib/gems/1.9.1/gems/anemone-0.5.0/lib/anemone.rb:2:in`' from /home/r9s/Pobrane/arachni-v0.2/lib/anemone/core.rb:11:in `require' from /home/r9s/Pobrane/arachni-v0.2/lib/anemone/core.rb:11:in`' from /home/r9s/Pobrane/arachni-v0.2/lib/spider.rb:12:in `require' from /home/r9s/Pobrane/arachni-v0.2/lib/spider.rb:12:in`' from /home/r9s/Pobrane/arachni-v0.2/lib/framework.rb:19:in `require' from /home/r9s/Pobrane/arachni-v0.2/lib/framework.rb:19:in`' from /home/r9s/Pobrane/arachni-v0.2/lib/ui/cli/cli.rb:14:in `require' from /home/r9s/Pobrane/arachni-v0.2/lib/ui/cli/cli.rb:14:in`module:Arachni' from /home/r9s/Pobrane/arachni-v0.2/lib/ui/cli/cli.rb:12:in `' from arachni.rb:17:in`require' from arachni.rb:17:in `'

CSRF false positive

Arachni can't identify a CSRF token in my forms.

<input type="hidden" name="token" value="security4cf1c8e558586" />

and reports my application is vulnerable to CSRF attacks. If you need more information then I'd happy to help out.

how to resolve "undefined method `max_concurrency'"

$ ruby1.9.1 arachni http://testfire.net
Arachni - Web Application Security Scanner Framework v0.2.2.1 [0.2.1]
Author: Tasos "Zapotek" Laskos [email protected]
[email protected]
(With the support of the community and the Arachni Team.)

   Website:       http://github.com/Zapotek/arachni
   Documentation: http://github.com/Zapotek/arachni/wiki

[] No modules were specified.
[] -> Will run all mods.
[] No audit options were specified.
[] -> Will audit links, forms and cookies.
[] Initing...
[] Waiting for plugins to settle...
[-] undefined method max_concurrency' for #<Typhoeus::Hydra:0x00000001bc15a0> [-] undefined methodmax_concurrency' for #Typhoeus::Hydra:0x00000001bc15a0
[-] undefined method max_concurrency' for #<Typhoeus::Hydra:0x00000001bc15a0> [-] [Error: undefined methodmax_concurrency' for #Typhoeus::Hydra:0x00000001bc15a0] http://testfire.net/

[+] Web Application Security Report - Arachni Framework

[] Report generated on: 2011-02-15 02:24:29 -0800
[] Report false positives: http://github.com/Zapotek/arachni/issues

[+] System settings:
[] ---------------
[] Version: 0.2.2.1
[] Revision: 0.2.1
[] Audit started on: Tue Feb 15 02:24:25 2011
[] Audit finished on: Tue Feb 15 02:24:27 2011
[] Runtime: 00:00:01

[] URL: http://testfire.net/
[] User agent: Arachni/0.2.2.1

[*] Audited elements:
[] * Links
[] * Forms
[~] * Cookies

[*] Modules: unencrypted_password_forms, backup_files, allowed_methods, directory_listing, interesting_responses, http_put, private_ip, credit_card, cvs_svn_users, captcha, ssn, html_objects, emails, webdav, backdoors, common_directories, xst, htaccess_limit, common_files, xss_path, response_splitting, code_injection_timing, xss_uri, csrf, xss_tag, os_cmd_injection, code_injection, xss, rfi, xpath, trainer, sqli_blind_rdiff, sqli, os_cmd_injection_timing, sqli_blind_timing, xss_script_tag, unvalidated_redirect, xss_event, path_traversal, ldapi

[*] Filters:
[] Exclude:
[] Include:
~
[~] Redundant:

[*] Cookies:

[~] ===========================

[+] 0 issues were detected.

[+] Plugin data:
[~] ---------------

[] Dumping audit results in '2011-02-15 02:24:29 -0800.afr'.
[] Done!
[-] undefined method `max_concurrency' for #Typhoeus::Hydra:0x00000001bc15a0

Input of (old) reports...

The ability to read in manually generated AFR reports would be nice.

Gem install fails due to new datamapper version

I assume this is because of the mixed syntax for datamapper and datamapper dependencies, but I'm not a gem wizard by any stretch.
dm-sqlite-adapter ~> 1.0.2
datamapper >= 1.0.2

gem install arachni
ERROR: While executing gem ... (Gem::DependencyError)
Unable to resolve dependencies: dm-do-adapter requires dm-core (> 1.0.2); datamapper requires dm-core (= 1.1.0); dm-types requires dm-core (> 1.1.0); dm-validations requires dm-core (> 1.1.0); dm-timestamps requires dm-core (> 1.1.0); dm-serializer requires dm-core (> 1.1.0); dm-transactions requires dm-core (> 1.1.0); dm-migrations requires dm-core (> 1.1.0); dm-constraints requires dm-core (> 1.1.0); dm-aggregates requires dm-core (~> 1.1.0)

Implement more aggresive time-outs

@ self:

Look into the request time-out situation and implement more aggressive timeouts for non-timing-attack related requests.

There have been reports where the system appears to hang but it's actually a request that doesn't receive a response and takes a very long time to time-out; this is stupid and creates confusion.

Scanner Output issue when scanning Same Site Twice with Same Dispatcher

So then, here we go. The issue is that when launching a scan on the same website twice (started at separate times with separate amount of concurrent connections) it seems that I run into both Scanner outputs showing each others data, instead of the responses from the correct XMLRPC...if that makes sense. I assume this is just an issue when using the same dispatcher to do this, but I am not entirely sure, I haven't had a chance to test it.

Error: Report stdout wasn't found.

[matt@mfsec Zapotek-arachni]$ ./arachni_cli.rb

Arachni v0.1 [0.1] initiated. Author: Anastasios "Zapotek" Laskos [email protected] [email protected] Website: http://www.segfault.gr [-] Error: Report stdout wasn't found.

robots dependency

Since anemone is no longer listed as a dependency of the experimental branch the robots gem that was a dependency of anemone is not installed when the instructions are followed.

Adding robots to the list of "gem installs" would fix this issue.

Error: undefined method `body' for nil:NilClass

[!] HTTP session:

<Net::HTTP 127.0.0.1:80 open=true>

[-] Proceeding anyway...
[-] Error: undefined method body' for nil:NilClass in URL http://127.0.0.1/ [!] Exception: #<NoMethodError: undefined methodbody' for nil:NilClass>
[!] Backtrace:
[!] /mnt/sec/pentest/webscan/arachni/lib/module/trainer.rb:56:in train' [!] /mnt/sec/pentest/webscan/arachni/lib/module/base.rb:99:inblock in initialize'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:347:in call' [!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:347:inblock in train'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:347:in each' [!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:347:intrain'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:130:in block in get' [!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:415:incall'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:415:in exception_jail' [!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:107:inget'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:129:in block in get' [!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:415:incall'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:415:in exception_jail' [!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:107:inget'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:129:in block in get' [!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:415:incall'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:415:in exception_jail' [!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:107:inget'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:129:in block in get' [!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:415:incall'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:415:in exception_jail' [!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:107:inget'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:129:in block in get' [!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:415:incall'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:415:in exception_jail' [!] /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:107:inget'
[!] /mnt/sec/pentest/webscan/arachni/modules/recon/common_directories.rb:59:in block in run' [!] /mnt/sec/pentest/webscan/arachni/lib/module/base.rb:382:inblock in get_data_file'
[!] /mnt/sec/pentest/webscan/arachni/lib/module/base.rb:380:in each' [!] /mnt/sec/pentest/webscan/arachni/lib/module/base.rb:380:inget_data_file'
[!] /mnt/sec/pentest/webscan/arachni/modules/recon/common_directories.rb:51:in run' [!] /mnt/sec/pentest/webscan/arachni/lib/framework.rb:649:inrun_mod'
[!] /mnt/sec/pentest/webscan/arachni/lib/framework.rb:608:in `block (2 levels) in run_mods'
[!] @ /mnt/sec/pentest/webscan/arachni/lib/module/http.rb:457

It started cycling on that until I interrupted it.

Improper arguments with sqlmap.py 0.9

It seems that --time-test and --method were removed from sqlmap.py

Cirillic site

When target site has cirillic strings I get error.
Example:
$ arachni -fv http://www.62.ua --report=html:outfile=test.com.html
I get:
[*] Creating HTML report...
[-] incompatible encoding regexp match (ASCII-8BIT regexp with UTF-8 string)
[-] incompatible encoding regexp match (ASCII-8BIT regexp with UTF-8 string)
(erb):915:in gsub': incompatible encoding regexp match (ASCII-8BIT regexp with UTF-8 string) (Encoding::CompatibilityError) from (erb):915:inblock (2 levels) in run'
from (erb):898:in each' from (erb):898:ineach_with_index'
from (erb):898:in block in run' from (erb):815:ineach'
from (erb):815:in each_with_index' from (erb):815:inrun'
...

Flash parsing and decompiling functionality

arachni should be able to parse and decompile Flash so it can parse links, cookies, forms and headers.

Checking Directories & Files failure.

First of all it's not a bug, but I don't know where to put this.

The method used to check if the site/file exists just checks if the http request was successful, but in some sites there are default 404 pages.

This is a fix I did myself to common_directories.rb and common_files.rb

[-] __log_results( res, file, url ) if( res.code == "200" )

[+] __log_results( res, file, url ) if(( res.code == "200" ) and !(/not found/i.match(res.body)))

Of course it's not a proper regular expression, but worked for me on this website I'm scanning right now, maybe adding a textfile where to retrieve such words with default 404 samples, like "Page not found", "Not found", "404", "Oops", "404 Not Found", "Página no encontrada", "No encontrado," etc could work for now, but it's up to you.

OSX Unable to run Arachni unable to execute file

Hi all,
I have installed all required gems on OSX but when running the arachni files it returns:
"./ruby.cde: line 2: ../cde-exec: cannot execute binary file"
Did chmod +x for that file, doesn't help at all.
Anyone have any idea could point out where is the problem? and possible way to fix it should be highly appreciated.

No HTML reports???

arachni --repload=test.com.afr --report=html:outfile=mine

Arachni - Web Application Security Scanner Framework v0.2.3 [0.2.1]
Author: Tasos "Zapotek" Laskos [email protected]
[email protected]
(With the support of the community and the Arachni Team.)

   Website:       http://arachni.segfault.gr - http://github.com/Zapotek/arachni
   Documentation: http://github.com/Zapotek/arachni/wiki

[*] Creating HTML report...
[-] uninitialized constant Arachni::Reports::HTML::Iconv
/usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/reports/html.rb:96:in rescue in escapeHTML': uninitialized constant Arachni::Reports::HTML::Iconv (NameError) from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/reports/html.rb:93:inescapeHTML'
from (erb):915:in block (2 levels) in run' from (erb):898:ineach'
from (erb):898:in each_with_index' from (erb):898:inblock in run'
from (erb):815:in each' from (erb):815:ineach_with_index'
from (erb):815:in run' from /usr/local/rvm/rubies/ruby-1.9.2-p180/lib/ruby/1.9.1/erb.rb:753:ineval'
from /usr/local/rvm/rubies/ruby-1.9.2-p180/lib/ruby/1.9.1/erb.rb:753:in result' from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/reports/html.rb:64:inrun'
from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/lib/report/manager.rb:72:in run_one' from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/lib/report/manager.rb:61:inblock in run'
from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/lib/report/manager.rb:59:in each' from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/lib/report/manager.rb:59:inrun'
from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/lib/ui/cli/cli.rb:334:in block (2 levels) in parse_opts' from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/lib/module/utilities.rb:97:incall'
from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/lib/module/utilities.rb:97:in exception_jail' from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/lib/ui/cli/cli.rb:334:inblock in parse_opts'
from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/lib/ui/cli/cli.rb:269:in each' from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/lib/ui/cli/cli.rb:269:inparse_opts'
from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/lib/ui/cli/cli.rb:82:in initialize' from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/bin/arachni:21:innew'
from /usr/local/rvm/gems/ruby-1.9.2-p180/gems/arachni-0.2.3/bin/arachni:21:in <top (required)>' from /usr/local/rvm/gems/ruby-1.9.2-p180/bin/arachni:19:inload'
from /usr/local/rvm/gems/ruby-1.9.2-p180/bin/arachni:19:in `

'

I'm lost....

Arachni on Backtrack 4r2

Hey guys,

today I've tried to run arachni on a BT4r2 machine. I'm running into the following error:

root@bt:~# apt-get install libxml2-dev libxslt1-dev libcurl4-openssl-dev ruby1.9 ruby1.9-dev rubygems

wget --no-check-certificate https://github.com/downloads/Zapotek/arachni/arachni-v0.2.1.tar.gz

root@bt:~# tar xzf arachni-v0.2.1.tar.gz

root@bt:~# cd arachni-v0.2.1

root@bt:~/arachni-v0.2.1# gem install nokogiri typhoeus awesome_print liquid yar d robots
Building native extensions. This could take a while...
Successfully installed nokogiri-1.4.4
Building native extensions. This could take a while...
Successfully installed typhoeus-0.2.0
Successfully installed awesome_print-0.3.1
ERROR: Error installing liquid:
liquid requires RubyGems version >= 1.3.7
Successfully installed yard-0.6.3
Successfully installed robots-0.10.0
5 gems installed
Installing ri documentation for nokogiri-1.4.4...

No definition for get_options

No definition for set_options

No definition for parse_memory

No definition for parse_file

No definition for parse_with
Installing ri documentation for typhoeus-0.2.0...
Installing ri documentation for awesome_print-0.3.1...
Installing ri documentation for yard-0.6.3...

RDoc failure in lib/yard/core_ext/hash.rb at or around line 13 column 11

Before reporting this, could you check that the file
you're documenting compiles cleanly--RDoc is not a
full Ruby parser, and gets confused easily if fed
invalid programs.

The internal error was:

ERROR: While generating documentation for yard-0.6.3
... MESSAGE: Name or symbol expected (got #RubyToken::TkfLBRACK:0xa4ac360)
... RDOC args: --ri --op /var/lib/gems/1.8/doc/yard-0.6.3/ri --quiet lib
(continuing with the rest of the installation)
Installing ri documentation for robots-0.10.0...
Installing RDoc documentation for nokogiri-1.4.4...

No definition for get_options

No definition for set_options

No definition for parse_memory

No definition for parse_file

No definition for parse_with
Installing RDoc documentation for typhoeus-0.2.0...
Installing RDoc documentation for awesome_print-0.3.1...
Installing RDoc documentation for yard-0.6.3...

RDoc failure in lib/yard/core_ext/hash.rb at or around line 13 column 11

Before reporting this, could you check that the file
you're documenting compiles cleanly--RDoc is not a
full Ruby parser, and gets confused easily if fed
invalid programs.

The internal error was:

ERROR: While generating documentation for yard-0.6.3
... MESSAGE: Name or symbol expected (got #RubyToken::TkfLBRACK:0xb64a5dc4)
... RDOC args: --op /var/lib/gems/1.8/doc/yard-0.6.3/rdoc --quiet lib
(continuing with the rest of the installation)
Installing RDoc documentation for robots-0.10.0...

root@bt:~/arachni-v0.2.1# ./arachni.rb -h
./arachni.rb:13:in `require': no such file to load -- ap (LoadError)
from ./arachni.rb:13

Is there a way to get arachni up and running on BT4?

If you need more details, feel free to contact me.

regards,
mIke

test issue for mylyn integration

blah blah blah blah

Updated from Eclipse.

I've got no idea what "context" is but I attached it.

End of tests. Marked as closed.

web 0.1-pre noob basic issues

Definitely not an expert, trying to use arachni web. FWIW First impressions.

1. After Save, plugin parameters display defaults, not entered values. The fact that a plugin eg Autologin is checked IS remembered. But not the values in the associated data fields.
2. autologin does not find suitable form. I think I'm entering u+p correctly
3. the autologin failure does not appear in the plugin results page. Might be nice?
4. as a result of 2) (?) doesn't crawl into pages from login page
5. scanner output is displayed on main page during scan, but is it available from within the web app AFTER the scan is completed? (couldn't find it, but is in terminal window)

Bernie

Get parameters removed

Ok, so I am running this against BadStore.net, and there are some issues with "Replay." When attempting to replay the injections and XSS, it won't work because its just calling to /cgi-bin/badstore.cgi, instead of the proper action page, like /cgi-bin/badstore.cgi?action=login or something along those lines.