tag:support.arachni-scanner.com,2012-07-01:/discussions/problems/3363-scan-takes-too-long-timeArachni: Discussion 2015-02-25T04:29:18Ztag:support.arachni-scanner.com,2012-07-01:Comment/360857762015-02-19T02:40:53Z2015-02-19T02:40:54ZScan takes too long time<div><p>Hi,</p>
<p>I am experimenting Arachni to evaluate whether it meets our
requirement. I'm using 1GB RAM, 1 core CPU virtual machine with
bWAPP. Unfortunately, it takes too long (2-3 days) time to scan
bWAPP. I used optimization guides mentioned in the article titled
"Optimizing fast scan", but result was same. How can I make it
faster? I ran Acunetix and Buprsuite on the same machines against
bWAPP. They scanned super fast (at most 30 minutes) compared to
Arachni. So I'm wondering. Following is the command I used to
crawl:</p>
<p>./arachni_multi --instance-spawns=2 <a href=
"http://192.168.217.129/bWAPP/aim.php">http://192.168.217.129/bWAPP/aim.php</a>
--checks trainer --audit-links --audit-forms --audit-cookies
--report-save-path=crawl_report.afr
--platforms=linux,php,apache,mysql
--browser-cluster-ignore-images</p></div>Aggietag:support.arachni-scanner.com,2012-07-01:Comment/360857762015-02-19T02:51:30Z2015-02-19T02:58:39ZScan takes too long time<div><p>My best guess is that you're killing the machine. The VM is
quite underpowered so it's highly likely that the web server gets
stressed and takes too long to respond, and using 3 instances to
perform the scan makes things much worse.</p>
<p>Also, Arachni has a much higher request time-out setting than
most scanners, so if the web server does take a long time to
respond Arachni will wait instead of giving up early.</p>
<p>I'm just guessing though, I downloaded the bee-box appliance to
test this out, I'll let you know what I find.</p>
<p>Cheers</p></div>Tasos Laskostag:support.arachni-scanner.com,2012-07-01:Comment/360857762015-02-19T03:14:27Z2015-02-19T03:14:28ZScan takes too long time<div><p>Wow, fastest reply I've ever seen :). Thanks man. I did it only
one instance as well. It was long too, so I tried with
arachni_multi.</p></div>Aggietag:support.arachni-scanner.com,2012-07-01:Comment/360857762015-02-19T03:21:48Z2015-02-19T03:21:48ZScan takes too long time<div><p>Running a scan now with the same settings as the ones you
mentioned, getting average performance.</p>
<p>One issue I see is the way bWAPP does navigation, via forms with
drop-down inputs that have many available values, and the actions
of those forms change to the current URL. This, in essence, creates
a boatload of needless workload that needs to be processed in order
to get decent coverage, don't know if the other scanners are that
thorough.</p>
<p>Ah and the server just died, as I initially suspected. So, now
rescanning with a much lower request concurrency to avoid stressing
it too much, will keep you posted.</p>
<p>Cheers</p></div>Tasos Laskostag:support.arachni-scanner.com,2012-07-01:Comment/360857762015-02-19T03:49:24Z2015-02-19T03:49:24ZScan takes too long time<div><p>Also, I just found out that there's a link to the root directory
somewhere so Arachni ends up scanning not only bWAPP but the rest
of the included applications.</p></div>Tasos Laskostag:support.arachni-scanner.com,2012-07-01:Comment/360857762015-02-19T05:41:17Z2015-02-19T05:41:17ZScan takes too long time<div><p>OK, you can retry with these extra options:</p>
<pre>
<code>--http-request-concurrency=1 --scope-include-pattern=bWAPP --http-request-timeout=5000</code>
</pre>
<p>That'll prevent the server from being stressed by dramatically
lowering the request concurrency, it'll force the scope to just
bWAPP and in case the server gets stressed Arachni will wait for it
for only 5 second instead of the usual 50.</p>
<p>The scan finished in 22mins with the above configuration.</p>
<p>Cheers</p></div>Tasos Laskostag:support.arachni-scanner.com,2012-07-01:Comment/360857762015-02-19T11:48:51Z2015-02-19T11:48:52ZScan takes too long time<div><p>Thanks, will try with this and post the result.</p></div>Aggietag:support.arachni-scanner.com,2012-07-01:Comment/360857762015-02-19T16:49:38Z2015-02-19T16:49:38ZScan takes too long time<div><p>No problem.</p>
<p>A full scan with all checks still completely killed the server
eventually though, you better increase the VM's resources. 1
request at a time is the slowest Arachni can go.</p>
<p>Cheers</p></div>Tasos Laskos