Arachni&Owasp Benchmark about benchmarkjava

[davewichers]

I don't use the VMs, nor did I even build it. I think someone contributed it. Is it simply a permissions issue? i.e., if you go in and chmod that script to like 555 can you then run it? I would try to do this from the command line, not via a File System GUI, that way if there are errors you'll see them and maybe figure out the problem, or you can at least send me the errors.

…

-Dave

On Sat, Nov 11, 2017 at 10:46 AM, Sergy123 ***@***.***> wrote: I'm trying to scan Owasp Benchmark with Arachni in the VM environment. For some reasons I can not run runRemoteAccessibleBenchmark.sh (it appears white coloured in the file list) to enable remote scanning.Please Note the Benchmark still works with runBenchmark.sh (appears green coloured in the list) Thanks in advance, Serg — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <https://github.com/OWASP/Benchmark/issues/44>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AExbBYb5GLuj-7fWHrtdN_7gXuX1geLLks5s1cFtgaJpZM4QaiA6> .

[Sergy123]

Thanks Dave,
I managed to fix it and now in theory Benchmarking tool must be available remotely after running ./runRemoteAccessibleBenchmark.sh. But it is still local (https://localhost:8443/benchmark/) what i've done wrong?

[davewichers]

It will still be available locally, so the URL above should still work. But, if you identify the external IP address for the VM, and send a request to that IP from a host on the network to that URL, that should now work too (i.e., it is now remotely accessible). Did you actually try that and it doesn't work??

…

-Dave

On Sat, Nov 11, 2017 at 2:48 PM, Sergy123 ***@***.***> wrote: Thanks Dave, I managed to fix it and now in theory Benchmarking tool must be available remotely after running ./runRemoteAccessibleBenchmark.sh. But it is still local (https://localhost:8443/benchmark/) what i've done wrong? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <https://github.com/OWASP/Benchmark/issues/44#issuecomment-343689624>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AExbBdT6q-4-b1LJrDj4B4T12VjWEjvMks5s1fomgaJpZM4QaiA6> .

[Sergy123]

Dave,
Arachni still gives me an error: RPC.. Exceptions. Loop back interfaces like local hosts are not supported ....Please use different IP address or host name.
I have even tried to do Benchmark scan on the same VM, no luck. But still, I am able to scan the Benchmark with ZAP and SkipFish. For some reasons what is mention above in my first post, doesn't work. Any other suggestions?
Thanks in advance

[davewichers]

Step 1: Can you manually navigate to the OWASP Benchmark using its actual IP? i.e., NOT localhost? Step 2: If so: Scan that URL with Arachni. If not: Apparently the exposure of the Benchmark to remote access feature isn't working. Please let me know if you can actually manually navigate to: https://SOMEIP:8443/benchmark. If you can, you should be able to scan that with Arachni.

…

-Dave

On Sun, Nov 12, 2017 at 9:07 AM, Sergy123 ***@***.***> wrote: Dave, Arachni still gives me an error: RPC.. Exceptions. Loop back interfaces like local hosts are not supported ....Please use different IP address or host name. I have even tried to do Benchmark scan on the same VM, no luck. But still, I am able to scan the Benchmark with ZAP and SkipFish. For some reasons what is mention above in my first post, doesn't work. Any other suggestions? Thanks in advance — You are receiving this because you commented. Reply to this email directly, view it on GitHub <https://github.com/OWASP/Benchmark/issues/44#issuecomment-343739750>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AExbBd3rWoKy_OaSkgAmydMqDZt3xcSpks5s1vuSgaJpZM4QaiA6> .

[Sergy123]

Thanks a lot Dave, everything works fine. I'm really for not replying on time

[davewichers]

I'm glad to hear things are working for you. Are you able to share your results with me when you have something of substance? I'd also like to make sure our Arachni scorecard generation still works. It's been a while since I've used it.

…

-Dave

On Tue, Dec 5, 2017 at 9:49 AM, Sergy123 ***@***.***> wrote: Thanks a lot Dave, everything works fine. I'm really for not replying on time — You are receiving this because you commented. Reply to this email directly, view it on GitHub <https://github.com/OWASP/Benchmark/issues/44#issuecomment-349326317>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AExbBfPfhzfcw5Lhfc1XSzB19B9rD9brks5s9VgKgaJpZM4QaiA6> .

[Sergy123]

This is another issue. I can scan remote benchmark, but For some reasons Arachni does not scan it fully and stops after 25 secs, generating error log. But I'm still able to generate scorecard out of it which is basically "0". The error log is quite big, I'm not sure if I can post it here

[Sergy123]

Dave, I have also scanned OWASP benchmark with SkipFish and W3AF with the aim to produce the score cards for them. But so far i can not figure out how it works with supported score card generator for Arachni tool.

[davewichers]

For Arachni, I'd suggest you see if the tool author can help you as he is obviously the worlds expert on that tool. And he has worked with the Benchmark project in the past with respect to Arachni, so hopefully will be willing to help. For SkipFish and W3AF, those are not supported tools yet. But if you can send me results files for those 2 tools, we should be able to add support for them as well. The Arachni scorecard generator is only for Arachni, not those other tools.

…

-Dave

On Tue, Dec 5, 2017 at 11:47 AM, Sergy123 ***@***.***> wrote: This is another issue. I can scan remote benchmark, but For some reasons Arachni does not scan it fully and stops after 25 secs, generating error log. But I'm still able to generate scorecard out of it which is basically "0". The error log is quite big, I'm not sure if I can post it here — You are receiving this because you commented. Reply to this email directly, view it on GitHub <https://github.com/OWASP/Benchmark/issues/44#issuecomment-349365294>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AExbBdpAjKKVgX9e1fbU0E2AeIuhAjTfks5s9XO0gaJpZM4QaiA6> .

[Sergy123]

May i get your email address please? i have got some questions about score cards as well. Thanks

[davewichers]

Sure. It's [email protected].

…

On Wed, Dec 27, 2017 at 12:13 PM, Sergy123 ***@***.***> wrote: May i get your email address please? i have got some questions about score cards as well. Thanks — You are receiving this because you commented. Reply to this email directly, view it on GitHub <https://github.com/OWASP/Benchmark/issues/44#issuecomment-354144910>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AExbBWGzmKdgWPWJQq8xET3CQtp1XkYaks5tEnqdgaJpZM4QaiA6> .

[davewichers]

As this is more a discussion, rather than a bug, and the discussion is over, I'm closing this 'issue'.