Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • A arachni
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 125
    • Issues 125
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 8
    • Merge requests 8
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Package Registry
    • Infrastructure Registry
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Arachni - Web Application Security Scanner Framework
  • arachni
  • Issues
  • #295
Closed
Open
Issue created Oct 05, 2012 by Administrator@rootContributor

RFI Vulnerabilities not being identified

Created by: ghost

I installed arachni on Ubuntu about 2 weeks ago and have found no problems except that I cannot seem to get it to pick up any RFI vulnerabilities. I have run it with the rfi module on mutillidae, ghost, and DVWA from the OWASP Broken Web Apps VM and arachni has not identified any rfi vulnerabilities in any of these, which makes me think I am doing something wrong. I have run other scanners on all of these and discovered vulnerabilities and even run arachni on the specific page in question in attempt to get it to identify something. When looking over what arachni is doing I can see that it identifies the parameter that I know to be vulnerable; however, when it does the RFI checks it comes up with nothing.

Here are the arguments I'm running:

ruby arachni --mods=rfi [URL] --report=xml:outfile=asdf.xml --audit-links --audit-forms

Among various other varations of that.

Assignee
Assign to
Time tracking