trouble limiting scans to specific form(s)
Created by: gingerlime
Perhaps I'm missing something, but I'm having some trouble performing a more targeted scan. Hope it's just some obvious setting or parameter that I'm using incorrectly
I'm using experimental and launching arachni with these parameters:
arachni --link-count=0 --depth=0 --redirect-limit=0 --plugin=proxy:port=8282,bind_address=127.0.0.1 http://x.y.z
Then I go to the page, login, submit the form I'm particularly interested in, and then shut the proxy down as instructed, so the scan starts.
I get a couple of problems:
First of all, the scan seems to go far beyond the form and keeps scanning for a long time and doesn't only include the forms I was hoping for (this is probably because I did something wrong?)
Secondly, it seems like some pages are misidentified. i.e. the site I'm scanning seems to ignore anything after a certain URI, so for example /dashboard/
and /dashboard/bla/
and /dashboard/bla/bla/
all lead to the exact same page. But it looks like arachni isn't aware of this...
[*] CommonDirectories: Analyzing response for: http://x.y.z:80/dashboard/system/
[+] CommonDirectories: Found system at http://x.y.z:80/dashboard/system/
[~] Trainer: Found 17 new links.
[*] CommonDirectories: Analyzing response for: http://x.y.z:80/dashboard/~admin/
[+] CommonDirectories: Found ~admin at http://x.y.z:80/dashboard/~admin/
[~] Trainer: Found 17 new links.
...
I guess I can use the --redundant
option to limit this, but I thought I should report it anyway. Using the parameters above I wasn't expecting the scan to include dashboard
at all, so am a bit confused...
Am I doing something wrong? Should I do something else / use better options?