Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • A arachni
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 125
    • Issues 125
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 8
    • Merge requests 8
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Package Registry
    • Infrastructure Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Arachni - Web Application Security Scanner Framework
  • arachni
  • Issues
  • #153
Closed
Open
Issue created Feb 02, 2012 by Administrator@rootContributor

trouble limiting scans to specific form(s)

Created by: gingerlime

Perhaps I'm missing something, but I'm having some trouble performing a more targeted scan. Hope it's just some obvious setting or parameter that I'm using incorrectly

I'm using experimental and launching arachni with these parameters: arachni --link-count=0 --depth=0 --redirect-limit=0 --plugin=proxy:port=8282,bind_address=127.0.0.1 http://x.y.z

Then I go to the page, login, submit the form I'm particularly interested in, and then shut the proxy down as instructed, so the scan starts.

I get a couple of problems:

First of all, the scan seems to go far beyond the form and keeps scanning for a long time and doesn't only include the forms I was hoping for (this is probably because I did something wrong?)

Secondly, it seems like some pages are misidentified. i.e. the site I'm scanning seems to ignore anything after a certain URI, so for example /dashboard/ and /dashboard/bla/ and /dashboard/bla/bla/ all lead to the exact same page. But it looks like arachni isn't aware of this...

 [*] CommonDirectories: Analyzing response for: http://x.y.z:80/dashboard/system/
 [+] CommonDirectories: Found system at http://x.y.z:80/dashboard/system/
 [~] Trainer: Found 17 new links.
 [*] CommonDirectories: Analyzing response for: http://x.y.z:80/dashboard/~admin/
 [+] CommonDirectories: Found ~admin at http://x.y.z:80/dashboard/~admin/
 [~] Trainer: Found 17 new links.
...

I guess I can use the --redundant option to limit this, but I thought I should report it anyway. Using the parameters above I wasn't expecting the scan to include dashboard at all, so am a bit confused...

Am I doing something wrong? Should I do something else / use better options?

Assignee
Assign to
Time tracking