RFI Vulnerabilities not being identified
Created by: ghost
I installed arachni on Ubuntu about 2 weeks ago and have found no problems except that I cannot seem to get it to pick up any RFI vulnerabilities. I have run it with the rfi module on mutillidae, ghost, and DVWA from the OWASP Broken Web Apps VM and arachni has not identified any rfi vulnerabilities in any of these, which makes me think I am doing something wrong. I have run other scanners on all of these and discovered vulnerabilities and even run arachni on the specific page in question in attempt to get it to identify something. When looking over what arachni is doing I can see that it identifies the parameter that I know to be vulnerable; however, when it does the RFI checks it comes up with nothing.
Here are the arguments I'm running:
ruby arachni --mods=rfi [URL] --report=xml:outfile=asdf.xml --audit-links --audit-forms
Among various other varations of that.