Arachni is an Open Source, feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications.
It is smart, it trains itself by monitoring and learning from the web application’s behaviour during the scan process and is able to perform meta-analysis using a number of factors in order to correctly assess the trustworthiness of results and intelligently identify (or avoid) false-positives.
Unlike other scanners, it takes into account the dynamic nature of web applications, can detect changes caused while travelling through the paths of a web application’s cyclomatic complexity and is able to adjust itself accordingly. This way, attack/input vectors that would otherwise be undetectable by non-humans can be handled seamlessly.
Finally, it is versatile enough to cover a great deal of use-cases, ranging from a simple command line scanner utility, to a distributed high performance grid of scanners, to a Ruby library allowing for scripted audits, to a multi-user multi-scan web user interface.
We haven’t mentioned it for a while back since 2012 – Arachni v0.4 Released – High-Performance (Open Source) Web Application Security Scanner Framework.
It’s a major rewrite so it will break backwards compatibility, don’t try and upgrade because you need to start from scratch. CLI options are different, reports are different, the RPC API is mostly different, the RPC protocol is different and so on and so forth.
- Multiple deployment options.
- Ruby library, for highly-customized, scripted scans.
- CLI scanner utility, for quick scans.
- WebUI, for multi-User, multi-Scan, multi-Dispatcher management.
- Distributed system using remote agents.
- Integrated browser environment
- Support for pause/resume functionality.
- Support for scan hibernation (suspend-to-disk/restore).
- Automated session management (logout detection and re-login).
- Plethora of scope options, governing scan coverage.
- Intelligent, on-the-fly adaptation to each web application.
- Fingerprinting of each individual resource.
- Adjusts injections to match deployed platforms.
- Automated detection of custom-404 pages.
- Constant monitoring of server health and auto-throttling.
- Resulting in less bandwidth consumption, less stress to the web application and, as a result, faster and more reliable scans.
- Trains itself during the entire scan, by learning from HTTP responses, in order to identify new vectors and handle complex workflows like multi-page/form wizards.
- Asynchronous HTTP requests for lightweight concurrency and fast communications.
- Support for multi-Instance scans, utilizing multiple Instances/processes, for super-fast audits (Even when distributed across multiple nodes).
- Abundance of security checks.
- Includes multiple plugins, providing extra functionality like:
- Passive proxy for scanner training via HTTP requests & recording of login sequence
- Form-based authentication.
- Login dictionary attackers.
- Many, many more.
- Highly detailed, well-structured reports available in multiple of open formats.
- Supports addition of custom Checks, Reporters and Plugins due to its modular design.
Full feature list can be found at: http://www.arachni-scanner.com/features/framework
- Updated workflow:
- No more crawl-first, scan workload is discovered and handled on-the-fly.
- Support for suspending scans to disk.
- Addition of an integrated browser environment, supporting:
- Detection of DOM-based issues.
- New input vectors:
- DOM forms
- DOM links (with parameters in URL fragments)
- DOM cookies
- Link templates (for extracting arbitrary inputs from generic paths).
- DOM link templates (for extracting arbitrary inputs from generic URL fragments).
- Support for URL-rewrite rules.
- New checks:
- NoSQL injection (error based and blind).
- DOM XSS variants.
- New reports providing enormous amounts of context for easy issue verification and resolution — especially for DOM-based ones.
- Cleaned up RPC API.
- License update:
- Proprietary, commercial license for SaaS providers and commercial distributors.
- Apache License v2.0 for all other use cases.
You can download Arachni v1.0 here: