Arachni v1.5.1 - Web Application Security Scanner Framework

• Cookie-jar/cookie-string support.
• Custom header support.
• SSL support with fine-grained options.
• User Agent spoofing.
• Proxy support for SOCKS4, SOCKS4A, SOCKS5, HTTP/1.1 and HTTP/1.0.
• Proxy authentication.
• Site authentication (SSL-based, form-based, Cookie-Jar, Basic-Digest, NTLMv1, Kerberos and others).
• Automatic log-out detection and re-login during the scan (when the initial login was performed via the autologin, login_script or proxy plugins).
• Custom 404 page detection.
• UI abstraction:
  • Command-line Interface.
  • Web User Interface.
• Pause/resume functionality.
• Hibernation support -- Suspend to and restore from disk.
• High performance asynchronous HTTP requests.
  • With adjustable concurrency.
  • With the ability to auto-detect server health and adjust its concurrency automatically.
• Support for custom default input values, using pairs of patterns (to be matched against input names) and values to be used to fill in matching inputs.

• JQuery
• AngularJS
• More to come...

• Page DOM, as HTML code.
  • With a list of DOM transitions required to restore the state of the page to the one at the time it was logged.
• Original DOM (i.e. prior to the action that caused the page to be logged), as HTML code.
  • With a list of DOM transitions.
• Data-flow sinks -- Each sink is a JS method which received a tainted argument.
  • Parent object of the method (ex.: DOMWindow).
  • Method signature (ex.: decodeURIComponent()).
  • Arguments list.
    • With the identified taint located recursively in the included objects.
  • Method source code.
  • JS stacktrace.
• Execution flow sinks -- Each sink is a successfully executed JS payload, as injected by the security checks.
  • Includes a JS stacktrace.
• JavaScript stack-traces include:
  • Method names.
  • Method locations.
  • Method source codes.
  • Argument lists.

• Adjustable pool-size, i.e. the amount of browser workers to utilize.
• Timeout for each job.
• Worker TTL counted in jobs -- Workers which exceed the TTL have their browser process respawned.
• Ability to disable loading images.
• Adjustable screen width and height.
  • Can be used to analyze responsive and mobile applications.
• Ability to wait until certain elements appear in the page.
• Configurable local storage data.

• Forms
  • Along with ones that require interaction via a real browser due to DOM events.
• User-interface Forms
  • Input and button groups which don't belong to an HTML <form> element but are instead associated via JS code.
• User-interface Inputs
  • Orphan <input> elements with associated DOM events.
• Links
  • Along with ones that have client-side parameters in their fragment, i.e.: http://example.com/#/?param=val&param2=val2
  • With support for rewrite rules.
• LinkTemplates -- Allowing for extraction of arbitrary inputs from generic paths, based on user-supplied templates -- useful when rewrite rules are not available.
  • Along with ones that have client-side parameters in their URL fragments, i.e.: http://example.com/#/param/val/param2/val2
• Cookies
• Headers
• Generic client-side elements which have associated DOM events.
• AJAX-request parameters.
• JSON request data.
• XML request data.

• Remotely monitor and manage scans.
• Perform multiple scans at the same time -- Each scan is compartmentalized to its own OS process to take advantage of:
  • Multi-core/SMP architectures.
  • OS-level scheduling/restrictions.
  • Sandboxed failure propagation.
• Communicate over a secure channel.

• Very simple and straightforward API.
• Easy interoperability with non-Ruby systems.
  • Operates over HTTP.
  • Uses JSON to format messages.
• Stateful scan monitoring.
  • Unique sessions automatically only receive updates when polling for progress, rather than full data.

• High-performance/low-bandwidth communication protocol.
  • MessagePack serialization for performance, efficiency and ease of integration with 3rd party systems.
• Grid:
  • Self-healing.
  • Scale up/down by hot-plugging/hot-unplugging nodes.
    • Can scale up infinitely by adding nodes to increase scan capacity.
  • (Always-on) Load-balancing -- All Instances are automatically provided by the least burdened Grid member.
    • With optional per-scan opt-out/override.
  • (Optional) High-Performance mode -- Combines the resources of multiple nodes to perform multi-Instance scans.
    • Enabled on a per-scan basis.

• Filters for redundant pages like galleries, catalogs, etc. based on regular expressions and counters.
  • Can optionally detect and ignore redundant pages automatically.
• URL exclusion filters using regular expressions.
• Page exclusion filters based on content, using regular expressions.
• URL inclusion filters using regular expressions.
• Can be forced to only follow HTTPS paths and not downgrade to HTTP.
• Can optionally follow subdomains.
• Adjustable page count limit.
• Adjustable redirect limit.
• Adjustable directory depth limit.
• Adjustable DOM depth limit.
• Adjustment using URL-rewrite rules.
• Can read paths from multiple user supplied files (to both restrict and extend the scope).

• Can audit:
  • Forms
    • Can automatically refresh nonce tokens.
    • Can submit them via the integrated browser environment.
  • User-interface Forms
    • Input and button groups which don't belong to an HTML <form> element but are instead associated via JS code.
  • User-interface Inputs
    • Orphan <input> elements with associated DOM events.
  • Links
    • Can load them via the integrated browser environment.
  • LinkTemplates
    • Can load them via the integrated browser environment.
  • Cookies
    • Can load them via the integrated browser environment.
  • Headers
  • Generic client-side DOM elements.
  • JSON request data.
  • XML request data.
• Can ignore binary/non-text pages.
• Can audit elements using both GET and POST HTTP methods.
• Can inject both raw and HTTP encoded payloads.
• Can submit all links and forms of the page along with the cookie permutations to provide extensive cookie-audit coverage.
• Can exclude specific input vectors by name.
• Can include specific input vectors by name.

• Operating systems
  • BSD
  • Linux
  • Unix
  • Windows
  • Solaris
• Web servers
  • Apache
  • IIS
  • Nginx
  • Tomcat
  • Jetty
  • Gunicorn
• Programming languages
  • PHP
  • ASP
  • ASPX
  • Java
  • Python
  • Ruby
• Frameworks
  • Rack
  • CakePHP
  • Rails
  • Django
  • ASP.NET MVC
  • JSF
  • CherryPy
  • Nette
  • Symfony

• SQL injection (sql_injection) -- Error based detection.
  • Oracle
  • InterBase
  • PostgreSQL
  • MySQL
  • MSSQL
  • EMC
  • SQLite
  • DB2
  • Informix
  • Firebird
  • SaP Max DB
  • Sybase
  • Frontbase
  • Ingres
  • HSQLDB
  • MS Access
• Blind SQL injection using differential analysis (sql_injection_differential).
• Blind SQL injection using timing attacks (sql_injection_timing).
  • MySQL
  • PostgreSQL
  • MSSQL
• NoSQL injection (no_sql_injection) -- Error based vulnerability detection.
  • MongoDB
• Blind NoSQL injection using differential analysis (no_sql_injection_differential).
• CSRF detection (csrf).
• Code injection (code_injection).
  • PHP
  • Ruby
  • Python
  • Java
  • ASP
• Blind code injection using timing attacks (code_injection_timing).
  • PHP
  • Ruby
  • Python
  • Java
  • ASP
• LDAP injection (ldap_injection).
• Path traversal (path_traversal).
  • *nix
  • Windows
  • Java
• File inclusion (file_inclusion).
  • *nix
  • Windows
  • Java
  • PHP
  • Perl
• Response splitting (response_splitting).
• OS command injection (os_cmd_injection).
  • *nix
  • *BSD
  • IBM AIX
  • Windows
• Blind OS command injection using timing attacks (os_cmd_injection_timing).
  • Linux
  • *BSD
  • Solaris
  • Windows
• Remote file inclusion (rfi).
• Unvalidated redirects (unvalidated_redirect).
• Unvalidated DOM redirects (unvalidated_redirect_dom).
• XPath injection (xpath_injection).
  • Generic
  • PHP
  • Java
  • dotNET
  • libXML2
• XSS (xss).
• Path XSS (xss_path).
• XSS in event attributes of HTML elements (xss_event).
• XSS in HTML tags (xss_tag).
• XSS in script context (xss_script_context).
• DOM XSS (xss_dom).
• DOM XSS script context (xss_dom_script_context).
• Source code disclosure (source_code_disclosure)
• XML External Entity (xxe).
  • Linux
  • *BSD
  • Solaris
  • Windows

• Allowed HTTP methods (allowed_methods).
• Back-up files (backup_files).
• Backup directories (backup_directories)
• Common administration interfaces (common_admin_interfaces).
• Common directories (common_directories).
• Common files (common_files).
• HTTP PUT (http_put).
• Insufficient Transport Layer Protection for password forms (unencrypted_password_form).
• WebDAV detection (webdav).
• HTTP TRACE detection (xst).
• Credit Card number disclosure (credit_card).
• CVS/SVN user disclosure (cvs_svn_users).
• Private IP address disclosure (private_ip).
• Common backdoors (backdoors).
• .htaccess LIMIT misconfiguration (htaccess_limit).
• Interesting responses (interesting_responses).
• HTML object grepper (html_objects).
• E-mail address disclosure (emails).
• US Social Security Number disclosure (ssn).
• Forceful directory listing (directory_listing).
• Mixed Resource/Scripting (mixed_resource).
• Insecure cookies (insecure_cookies).
• HttpOnly cookies (http_only_cookies).
• Auto-complete for password form fields (password_autocomplete).
• Origin Spoof Access Restriction Bypass (origin_spoof_access_restriction_bypass)
• Form-based upload (form_upload)
• localstart.asp (localstart_asp)
• Cookie set for parent domain (cookie_set_for_parent_domain)
• Missing Strict-Transport-Security headers for HTTPS sites (hsts).
• Missing X-Frame-Options headers (x_frame_options).
• Insecure CORS policy (insecure_cors_policy).
• Insecure cross-domain policy (allow-access-from) (insecure_cross_domain_policy_access)
• Insecure cross-domain policy (allow-http-request-headers-from) (insecure_cross_domain_policy_headers)
• Insecure client-access policy (insecure_client_access_policy)

• Standard output
• HTML (zip) (html).
• XML (xml).
• Text (text).
• JSON (json)
• Marshal (marshal)
• YAML (yaml)
• AFR (afr)
  • The default Arachni Framework Report format.

• Passive Proxy (proxy) -- Analyzes requests and responses between the web app and the browser assisting in AJAX audits, logging-in and/or restricting the scope of the audit.
• Form based login (autologin).
• Script based login (login_script).
• Dictionary attacker for HTTP Auth (http_dicattack).
• Dictionary attacker for form based authentication (form_dicattack).
• Cookie collector (cookie_collector) -- Keeps track of cookies while establishing a timeline of changes.
• WAF (Web Application Firewall) Detector (waf_detector) -- Establishes a baseline of normal behavior and uses rDiff analysis to determine if malicious inputs cause any behavioral changes.
• BeepNotify (beep_notify) -- Beeps when the scan finishes.
• EmailNotify (email_notify) -- Sends a notification (and optionally a report) over SMTP at the end of the scan.
• VectorFeed (vector_feed) -- Reads in vector data from which it creates elements to be audited. Can be used to perform extremely specialized/narrow audits on a per vector/element basis. Useful for unit-testing or a gazillion other things.
• Script (script) -- Loads and runs an external Ruby script under the scope of a plugin, used for debugging and general hackery.
• Uncommon headers (uncommon_headers) -- Logs uncommon headers.
• Content-types (content_types) -- Logs content-types of server responses aiding in the identification of interesting (possibly leaked) files.
• Vector collector (vector_collector) -- Collects information about all seen input vectors which are within the scan scope.
• Headers collector (headers_collector) -- Collects response headers based on specified criteria.
• Exec (exec) -- Calls external executables at different scan stages.
• Metrics (metrics) -- Captures metrics about multiple aspects of the scan and the web application.
• Restrict to DOM state (restrict_to_dom_state) -- Restricts the audit to a single page's DOM state, based on a URL fragment.
• Webhook notify (webhook_notify) -- Sends a webhook payload over HTTP at the end of the scan.
• Rate limiter (rate_limiter) -- Rate limits HTTP requests.
• Page dump (page_dump) -- Dumps page data to disk as YAML.

• AutoThrottle (autothrottle) -- Dynamically adjusts HTTP throughput during the scan for maximum bandwidth utilization.
• Healthmap (healthmap) -- Generates sitemap showing the health of each crawled/audited URL

• TimingAttacks (timing_attacks) -- Provides a notice for issues uncovered by timing attacks when the affected audited pages returned unusually high response times to begin with. It also points out the danger of DoS attacks against pages that perform heavy-duty processing.
• Discovery (discovery) -- Performs anomaly detection on issues logged by discovery checks and warns of the possibility of false positives where applicable.
• Uniformity (uniformity) -- Reports inputs that are uniformly vulnerable across a number of pages hinting to the lack of a central point of input sanitization.

rake spec:core            # for the core libraries
rake spec:checks          # for the checks
rake spec:plugins         # for the plugins
rake spec:reports         # for the reports
rake spec:path_extractors # for the path extractors