Arachni - Web Application Security Scanner Framework v1.1 Author: Tasos "Zapotek" Laskos (With the support of the community and the Arachni Team.) Website: http://arachni-scanner.com Documentation: http://arachni-scanner.com/wiki [~] No checks were specified, loading all. [~] No element audit options were specified, will audit links, forms, cookies, JSONs and XMLs. [*] Initializing... [*] Preparing plugins... [*] ... done. [~] Login script: System paused. [~] Login script: Running the script. [-] [ArgumentError] unknown encoding name - utf8 [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/nokogiri-1.6.6.2/lib/nokogiri/xml/node.rb:615:in `find' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/nokogiri-1.6.6.2/lib/nokogiri/xml/node.rb:615:in `serialize' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/nokogiri-1.6.6.2/lib/nokogiri/xml/node.rb:774:in `to_format' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/nokogiri-1.6.6.2/lib/nokogiri/xml/node.rb:630:in `to_html' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/element/form.rb:285:in `from_node' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/element/form.rb:270:in `block in from_document' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/nokogiri-1.6.6.2/lib/nokogiri/xml/node_set.rb:187:in `block in each' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/nokogiri-1.6.6.2/lib/nokogiri/xml/node_set.rb:186:in `upto' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/nokogiri-1.6.6.2/lib/nokogiri/xml/node_set.rb:186:in `each' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/element/form.rb:269:in `map' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/element/form.rb:269:in `from_document' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/parser.rb:153:in `forms' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/page.rb:286:in `block (2 levels) in ' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/components/fingerprinters/languages/aspx.rb:36:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/platform/manager.rb:247:in `block (2 levels) in fingerprint' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `call' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `exception_jail' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/platform/manager.rb:246:in `block in fingerprint' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/platform/manager.rb:245:in `each' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/platform/manager.rb:245:in `fingerprint' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/page.rb:169:in `initialize' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/parser.rb:99:in `new' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/parser.rb:99:in `page' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/page.rb:60:in `from_response' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/response.rb:159:in `to_page' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/client.rb:517:in `block (2 levels) in forward_request' [-] /home/cyber/arachni-1.1-0.5.7/system/usr/lib/ruby/2.2.0/monitor.rb:211:in `mon_synchronize' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/client.rb:509:in `block in forward_request' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:304:in `call' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:304:in `block in handle_response' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:304:in `each' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:304:in `handle_response' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:393:in `block in to_typhoeus' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/callbacks.rb:129:in `call' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/callbacks.rb:129:in `block in execute_callbacks' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/callbacks.rb:128:in `map' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/callbacks.rb:128:in `execute_callbacks' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/operations.rb:35:in `finish' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/easy_factory.rb:105:in `block in set_callback' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/ethon-0.7.3/lib/ethon/easy/response_callbacks.rb:65:in `call' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/ethon-0.7.3/lib/ethon/easy/response_callbacks.rb:65:in `block in complete' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/ethon-0.7.3/lib/ethon/easy/response_callbacks.rb:65:in `each' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/ethon-0.7.3/lib/ethon/easy/response_callbacks.rb:65:in `complete' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/ethon-0.7.3/lib/ethon/easy/operations.rb:25:in `perform' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/operations.rb:16:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/cacheable.rb:18:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/block_connection.rb:31:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/stubbable.rb:23:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/before.rb:26:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:506:in `client_run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:299:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/proxy_server.rb:250:in `perform_proxy_request' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/proxy_server.rb:114:in `do_GET' [-] /home/cyber/arachni-1.1-0.5.7/system/usr/lib/ruby/2.2.0/webrick/httpproxy.rb:117:in `proxy_service' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/proxy_server.rb:217:in `call' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/proxy_server.rb:217:in `service' [-] /home/cyber/arachni-1.1-0.5.7/system/usr/lib/ruby/2.2.0/webrick/httpserver.rb:94:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/usr/lib/ruby/2.2.0/webrick/server.rb:294:in `block in start_thread' [-] [-] Parent: [-] Class [-] [-] Block: [-] # [-] [-] Caller: [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `exception_jail' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/platform/manager.rb:246:in `block in fingerprint' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/platform/manager.rb:245:in `each' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/platform/manager.rb:245:in `fingerprint' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/page.rb:169:in `initialize' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/parser.rb:99:in `new' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/parser.rb:99:in `page' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/page.rb:60:in `from_response' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/response.rb:159:in `to_page' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/client.rb:517:in `block (2 levels) in forward_request' [-] /home/cyber/arachni-1.1-0.5.7/system/usr/lib/ruby/2.2.0/monitor.rb:211:in `mon_synchronize' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/client.rb:509:in `block in forward_request' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:304:in `call' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:304:in `block in handle_response' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:304:in `each' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:304:in `handle_response' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:393:in `block in to_typhoeus' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/callbacks.rb:129:in `call' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/callbacks.rb:129:in `block in execute_callbacks' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/callbacks.rb:128:in `map' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/callbacks.rb:128:in `execute_callbacks' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/operations.rb:35:in `finish' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/easy_factory.rb:105:in `block in set_callback' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/ethon-0.7.3/lib/ethon/easy/response_callbacks.rb:65:in `call' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/ethon-0.7.3/lib/ethon/easy/response_callbacks.rb:65:in `block in complete' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/ethon-0.7.3/lib/ethon/easy/response_callbacks.rb:65:in `each' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/ethon-0.7.3/lib/ethon/easy/response_callbacks.rb:65:in `complete' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/ethon-0.7.3/lib/ethon/easy/operations.rb:25:in `perform' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/operations.rb:16:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/cacheable.rb:18:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/block_connection.rb:31:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/stubbable.rb:23:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/typhoeus-0.6.9/lib/typhoeus/request/before.rb:26:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:506:in `client_run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/request.rb:299:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/proxy_server.rb:250:in `perform_proxy_request' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/proxy_server.rb:114:in `do_GET' [-] /home/cyber/arachni-1.1-0.5.7/system/usr/lib/ruby/2.2.0/webrick/httpproxy.rb:117:in `proxy_service' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/proxy_server.rb:217:in `call' [-] /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/http/proxy_server.rb:217:in `service' [-] /home/cyber/arachni-1.1-0.5.7/system/usr/lib/ruby/2.2.0/webrick/httpserver.rb:94:in `run' [-] /home/cyber/arachni-1.1-0.5.7/system/usr/lib/ruby/2.2.0/webrick/server.rb:294:in `block in start_thread' [-] -------------------------------------------------------------------------------- [-] Session: [ArgumentError] wrong number of arguments (0 for 1) [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/components/plugins/login_script.rb:23:in `eval' [-] Session: (eval):6:in `block in prepare' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/components/plugins/login_script.rb:23:in `eval' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/components/plugins/login_script.rb:23:in `block in prepare' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/components/plugins/login_script.rb:32:in `call' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/components/plugins/login_script.rb:32:in `block in run' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/session.rb:296:in `call' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/session.rb:296:in `login_from_sequence' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/session.rb:232:in `block in login' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `call' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `exception_jail' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/session.rb:231:in `login' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/components/plugins/login_script.rb:37:in `run' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/plugin/manager.rb:75:in `block (3 levels) in run' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `call' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `exception_jail' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/plugin/manager.rb:67:in `block (2 levels) in run' [-] Session: [-] Session: Parent: [-] Session: Arachni::Session [-] Session: [-] Session: Block: [-] Session: # [-] Session: [-] Session: Caller: [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `exception_jail' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/session.rb:231:in `login' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/components/plugins/login_script.rb:37:in `run' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/plugin/manager.rb:75:in `block (3 levels) in run' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `call' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/utilities.rb:400:in `exception_jail' [-] Session: /home/cyber/arachni-1.1-0.5.7/system/gems/gems/arachni-1.1/lib/arachni/plugin/manager.rb:67:in `block (2 levels) in run' [-] Session: -------------------------------------------------------------------------------- [-] Login script: A runtime error was encountered while executing the login script. [~] Login script: Aborting the scan. ================================================================================ [+] Web Application Security Report - Arachni Framework [~] Report generated on: 2015-06-18 11:36:50 -0400 [~] Report false positives at: http://github.com/Arachni/arachni/issues [+] System settings: [~] --------------- [~] Version: 1.1 [~] Audit started on: 2015-06-18 11:36:41 -0400 [~] Audit finished on: 2015-06-18 11:36:50 -0400 [~] Runtime: 00:00:09 [~] URL: [target URL] [~] User agent: Arachni/v1.1 [*] Audited elements: [~] * Links [~] * Forms [~] * Cookies [*] Checks: code_injection, code_injection_php_input_wrapper, xss_dom_script_context, xss_path, rfi, xss_dom, ldap_injection, sql_injection_timing, session_fixation, os_cmd_injection_timing, xpath_injection, code_injection_timing, unvalidated_redirect, xss_script_context, xss_event, no_sql_injection, xss_tag, xxe, xss, no_sql_injection_differential, source_code_disclosure, os_cmd_injection, path_traversal, file_inclusion, xss_dom_inputs, sql_injection, csrf, response_splitting, trainer, unvalidated_redirect_dom, sql_injection_differential, allowed_methods, insecure_cross_domain_policy_access, insecure_client_access_policy, backup_directories, interesting_responses, common_directories, backdoors, htaccess_limit, mixed_resource, captcha, insecure_cookies, x_frame_options, hsts, cookie_set_for_parent_domain, form_upload, private_ip, insecure_cors_policy, ssn, password_autocomplete, html_objects, http_only_cookies, unencrypted_password_forms, credit_card, cvs_svn_users, emails, backup_files, http_put, xst, webdav, directory_listing, localstart_asp, common_files, origin_spoof_access_restriction_bypass, insecure_cross_domain_policy_headers [~] =========================== [+] 0 issues were detected. [+] Plugin data: [~] --------------- [*] Login script [~] ~~~~~~~~~~~~~~ [~] Description: Loads and sets an external script as the system's login sequence, to be executed prior to the scan and whenever a log-out is detected. The script needn't necessarily perform an actual login operation. If another process is used to manage sessions, the script can be used to communicate with that process and, for example, load and set cookies from a shared cookie-jar. **With browser (slow):** If a [browser](http://watirwebdriver.com/) is available, it will be exposed to the script via the `browser` variable. Otherwise, that variable will have a value of `nil`. browser.goto 'http://testfire.net/bank/login.aspx' form = browser.form( id: 'login' ) form.text_field( name: 'uid' ).set 'jsmith' form.text_field( name: 'passw' ).set 'Demo1234' form.submit # You can also configure the session check from the script, dynamically, # if you don't want to set static options via the user interface. framework.options.session.check_url = browser.url framework.options.session.check_pattern = /Sign Off|MY ACCOUNT/ **Without browser (fast):** If a real browser environment is not required for the login operation, then using the system-wide HTTP interface is preferable, as it will be much faster and consume much less resources. response = http.post( 'http://testfire.net/bank/login.aspx', parameters: { 'uid' => 'jsmith', 'passw' => 'Demo1234' }, mode: :sync, update_cookies: true ) framework.options.session.check_url = to_absolute( response.headers.location, response.url ) framework.options.session.check_pattern = /Sign Off|MY ACCOUNT/ **From cookie-jar:** If an external process is used to manage sessions, you can keep Arachni in sync by loading cookies from a shared Netscape-style cookie-jar file. http.cookie_jar.load 'cookies.txt' [+] A runtime error was encountered while executing the login script. [~] Report saved at: /home/cyber/arachni.afr [0.0MB] [~] The scan has logged errors: /home/cyber/arachni-1.1-0.5.7/bin/../system/logs/framework/error-12137.log [~] Audited 0 pages. [~] Sent 24 requests. [~] Received and analyzed 24 responses. [~] In 00:00:09 [~] Average: 2.5378965799637836 requests/second. [~] Burst response time sum 13.851412 seconds [~] Burst response count 24 [~] Burst average response time 0.5771421666666666 seconds [~] Burst average 2.5378948902971445 requests/second [~] Timed-out requests 0 [~] Original max concurrency 20 [~] Throttled max concurrency 20