Arachni v1.0 Released – Web Application Security Scanner Framework


Arachni is an Open Source, feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications.

It is smart, it trains itself by monitoring and learning from the web application’s behaviour during the scan process and is able to perform meta-analysis using a number of factors in order to correctly assess the trustworthiness of results and intelligently identify (or avoid) false-positives.

Unlike other scanners, it takes into account the dynamic nature of web applications, can detect changes caused while travelling through the paths of a web application’s cyclomatic complexity and is able to adjust itself accordingly. This way, attack/input vectors that would otherwise be undetectable by non-humans can be handled seamlessly.

Moreover, due to its integrated browser environment, it can also audit and inspect client-side code, as well as support highly complicated web applications which make heavy use of technologies such as JavaScript, HTML5, DOM manipulation and AJAX.

Finally, it is versatile enough to cover a great deal of use-cases, ranging from a simple command line scanner utility, to a distributed high performance grid of scanners, to a Ruby library allowing for scripted audits, to a multi-user multi-scan web user interface.

We haven’t mentioned it for a while back since 2012 – Arachni v0.4 Released – High-Performance (Open Source) Web Application Security Scanner Framework.

This Arachni v1.0 release makes it the first open source security scanner to have support for a real browser environment, allowing it to handle modern web applications which make use of technologies such as HTML5/DOM/JavaScript/AJAX.

Arachni v1.0 - Web Application Security Scanner Framework

The new scanner engine has been benchmarked (WIVET v3 and WAVSEP v1.5) higher than even the most established commercial products in crawl coverage, vulnerability identification and accuracy.

It’s a major rewrite so it will break backwards compatibility, don’t try and upgrade because you need to start from scratch. CLI options are different, reports are different, the RPC API is mostly different, the RPC protocol is different and so on and so forth.

Feature Overview

  • Multiple deployment options.
    • Ruby library, for highly-customized, scripted scans.
    • CLI scanner utility, for quick scans.
    • WebUI, for multi-User, multi-Scan, multi-Dispatcher management.
    • Distributed system using remote agents.
  • Integrated browser environment
    • Providing support for deep client-side analysis of applications that make use of DOM/JavaScript/AJAX technologies.
  • Support for pause/resume functionality.
  • Support for scan hibernation (suspend-to-disk/restore).
  • Automated session management (logout detection and re-login).
  • Plethora of scope options, governing scan coverage.
  • Intelligent, on-the-fly adaptation to each web application.
    • Fingerprinting of each individual resource.
    • Adjusts injections to match deployed platforms.
    • Automated detection of custom-404 pages.
    • Constant monitoring of server health and auto-throttling.
    • Resulting in less bandwidth consumption, less stress to the web application and, as a result, faster and more reliable scans.
    • Trains itself during the entire scan, by learning from HTTP responses, in order to identify new vectors and handle complex workflows like multi-page/form wizards.
  • High-performance
    • Asynchronous HTTP requests for lightweight concurrency and fast communications.
    • Clustered browser environments for concurrent JavaScript/DOM operations.
    • Support for multi-Instance scans, utilizing multiple Instances/processes, for super-fast audits (Even when distributed across multiple nodes).
  • Abundance of security checks.
  • Includes multiple plugins, providing extra functionality like:
    • Passive proxy for scanner training via HTTP requests & recording of login sequence
    • Form-based authentication.
    • Login dictionary attackers.
    • Many, many more.
  • Highly detailed, well-structured reports available in multiple of open formats.
  • Supports addition of custom Checks, Reporters and Plugins due to its modular design.

Full feature list can be found at: http://www.arachni-scanner.com/features/framework

Highlighted Changes

  • Updated workflow:
    • No more crawl-first, scan workload is discovered and handled on-the-fly.
    • Support for suspending scans to disk.
  • Addition of an integrated browser environment, supporting:
    • HTML5/DOM/JavaScript/AJAX
    • Detection of DOM-based issues.
  • New input vectors:
    • DOM forms
    • DOM links (with parameters in URL fragments)
    • DOM cookies
  • Link templates (for extracting arbitrary inputs from generic paths).
  • DOM link templates (for extracting arbitrary inputs from generic URL fragments).
  • Support for URL-rewrite rules.
  • New checks:
    • NoSQL injection (error based and blind).
    • DOM XSS variants.
  • New reports providing enormous amounts of context for easy issue verification and resolution — especially for DOM-based ones.
  • Cleaned up RPC API.
  • License update:
    • Proprietary, commercial license for SaaS providers and commercial distributors.
    • Apache License v2.0 for all other use cases.

You can download Arachni v1.0 here:

http://www.arachni-scanner.com/download/

Or read more here – the author can be found on Twitter here @Zap0tek.

Posted in: Hacking Tools, Web Hacking

, , , , , , , , , , ,


Latest Posts:


dSploit APK Download - Hacking & Security Toolkit For Android dSploit APK Download – Hacking & Security Toolkit For Android
dSploit APK Download is a Hacking & Security Toolkit For Android which can conduct network analysis and penetration testing activities.
Scallion - GPU Based Onion Hash Generator Scallion – GPU Based Onion Hash Generator
Scallion is a GPU-driven Onion Hash Generator written in C#, it lets you create vanity GPG keys and .onion addresses (for Tor's hidden services).
WiFi-Dumper - Dump WiFi Profiles and Cleartext Passwords WiFi-Dumper – Dump WiFi Profiles and Cleartext Passwords
WiFi-Dumper is an open-source Python-based tool to dump WiFi profiles and cleartext passwords of the connected access points on a Windows machine.
truffleHog - Search Git for High Entropy Strings with Commit History truffleHog – Search Git for High Entropy Strings with Commit History
truffleHog is a Python-based tool to search Git for high entropy strings, digging deep into commit history and branches. This is effective at finding secrets accidentally committed.
AIEngine - AI-driven Network Intrusion Detection System AIEngine – AI-driven Network Intrusion Detection System
AIEngine is a next-generation interactive/programmable Python/Ruby/Java/Lua and Go AI-driven Network Intrusion Detection System engine with many capabilities.
Sooty - SOC Analyst All-In-One CLI Tool Sooty – SOC Analyst All-In-One CLI Tool
Sooty is a tool developed with the task of aiding a SOC analyst to automate parts of their workflow and speed up their process.


Comments are closed.