Arachni - Web Application Security Scanner Framework v1.2.1
   Author: Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>

           (With the support of the community and the Arachni Team.)

   Website:       http://arachni-scanner.com
   Documentation: http://arachni-scanner.com/wiki


[~] No checks were specified, loading all.
[~] No element audit options were specified, will audit links, forms, cookies, JSONs and XMLs.

[*] Initializing...
[*] Preparing plugins...
[*] ... done.
[~] Login script: System paused.
[!] Browser: Spawning PhantomJS...
[!] Browser: Attempt #0, chose port number 23207
[!] Browser: Spawning process: /usr/bin/phantomjs
[!] Browser: Process spawned, waiting for it to boot-up...
[!] Browser: Boot-up complete.
[!] Browser: 2015-08-05T12:45:48 [DEBUG] CookieJar - Created but will not store cookies (use option '--cookies-file=<filename>' to enable persisten cookie storage) 
2015-08-05T12:45:48 [DEBUG] Phantom - execute: Configuration 
2015-08-05T12:45:48 [DEBUG]      0 objectName : "" 
2015-08-05T12:45:48 [DEBUG]      1 cookiesFile : "" 
2015-08-05T12:45:48 [DEBUG]      2 diskCacheEnabled : "true" 
2015-08-05T12:45:48 [DEBUG]      3 maxDiskCacheSize : "-1" 
2015-08-05T12:45:48 [DEBUG]      4 ignoreSslErrors : "true" 
2015-08-05T12:45:48 [DEBUG]      5 localToRemoteUrlAccessEnabled : "false" 
2015-08-05T12:45:48 [DEBUG]      6 outputEncoding : "UTF-8" 
2015-08-05T12:45:48 [DEBUG]      7 proxyType : "http" 
2015-08-05T12:45:48 [DEBUG]      8 proxy : "http://127.0.0.1:5171/:8" 
2015-08-05T12:45:48 [DEBUG]      9 proxyAuth : ":" 
2015-08-05T12:45:48 [DEBUG]      10 scriptEncoding : "UTF-8" 
2015-08-05T12:45:48 [DEBUG]      11 webSecurityEnabled : "true" 
2015-08-05T12:45:48 [DEBUG]      12 offlineStoragePath : "" 
2015-08-05T12:45:48 [DEBUG]      13 offlineStorageDefaultQuota : "-1" 
2015-08-05T12:45:48 [DEBUG]      14 printDebugMessages : "true" 
2015-08-05T12:45:48 [DEBUG]      15 javascriptCanOpenWindows : "true" 
2015-08-05T12:45:48 [DEBUG]      16 javascriptCanCloseWindows : "true" 
2015-08-05T12:45:48 [DEBUG]      17 sslProtocol : "sslv3" 
2015-08-05T12:45:48 [DEBUG]      18 sslCertificatesPath : "" 
2015-08-05T12:45:48 [DEBUG]      19 webdriver : ":23207" 
2015-08-05T12:45:48 [DEBUG]      20 webdriverLogFile : "" 
2015-08-05T12:45:48 [DEBUG]      21 webdriverLogLevel : "INFO" 
2015-08-05T12:45:48 [DEBUG]      22 webdriverSeleniumGridHub : "" 
2015-08-05T12:45:48 [DEBUG] Phantom - execute: Script & Arguments 
2015-08-05T12:45:48 [DEBUG]      script: "main.js" 
2015-08-05T12:45:48 [DEBUG]      0 arg: "--ip=" 
2015-08-05T12:45:48 [DEBUG]      1 arg: "--port=23207" 
2015-08-05T12:45:48 [DEBUG]      2 arg: "--logLevel=INFO" 
2015-08-05T12:45:48 [DEBUG] Phantom - execute: Starting Remote WebDriver mode 
PhantomJS is launching GhostDriver...
2015-08-05T12:45:48 [DEBUG] WebPage - setupFrame "" 
2015-08-05T12:45:48 [DEBUG] FileSystem - _open: ":/modules/fs.js" QMap(("mode", QVariant(QString, "r") ) )  
2015-08-05T12:45:48 [DEBUG] FileSystem - _open: ":/modules/system.js" QMap(("mode", QVariant(QString, "r") ) )  
2015-08-05T12:45:48 [DEBUG] FileSystem - _open: ":/modules/webpage.js" QMap(("mode", QVariant(QString, "r") ) )  
2015-08-05T12:45:48 [DEBUG] FileSystem - _open: ":/ghostdriver/./hub_register.js" QMap(("mode", QVariant(QString, "r") ) )  
2015-08-05T12:45:48 [DEBUG] FileSystem - _open: ":/ghostdriver/./logger.js" QMap(("mode", QVariant(QString, "r") ) )  
2015-08-05T12:45:48 [DEBUG] FileSystem - _open: ":/ghostdriver/./third_party/console++.js" QMap(("mode", QVariant(QString, "r") ) )  
2015-08-05T12:45:48 [DEBUG] FileSystem - _open: ":/modules/webserver.js" QMap(("mode", QVariant(QString, "r") ) )  
2015-08-05T12:45:48 [DEBUG] FileSystem - _open: ":/ghostdriver/./third_party/parseuri.js" QMap(("mode", QVariant(QString, "r") ) )  
2015-08-05T12:45:48 [DEBUG] FileSystem - _open: ":/ghostdriver/./config.js" QMap(("mode", QVariant(QString, "r") ) )  
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: "session.js" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: prepending ":/ghostdriver/" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: "inputs.js" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: prepending ":/ghostdriver/" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: "request_handlers/request_handler.js" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: prepending ":/ghostdriver/" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: "request_handlers/status_request_handler.js" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: prepending ":/ghostdriver/" 
2015-08-05T12:45:48 [DEBUG] FileSystem - _open: ":/ghostdriver/./errors.js" QMap(("mode", QVariant(QString, "r") ) )  
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: "request_handlers/shutdown_request_handler.js" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: prepending ":/ghostdriver/" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: "request_handlers/session_manager_request_handler.js" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: prepending ":/ghostdriver/" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: "request_handlers/session_request_handler.js" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: prepending ":/ghostdriver/" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: "request_handlers/webelement_request_handler.js" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: prepending ":/ghostdriver/" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: "request_handlers/router_request_handler.js" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: prepending ":/ghostdriver/" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: "webelementlocator.js" 
2015-08-05T12:45:48 [DEBUG] Phantom - injectJs: prepending ":/ghostdriver/" 
[INFO  - 2015-08-05T16:45:48.624Z] GhostDriver - Main - running on port 23207

[!] Browser: PhantomJS is ready.
[!] Session: Logging in via sequence: #<Proc:0x00000003062068@/opt/sspider/arachni/components/plugins/login_script.rb:43>
[~] Login script: Running the script.
[-] Session: [Watir::Exception::UnknownObjectException] unable to locate element, using {:id=>"ctl00_Content_Login1_UserName", :tag_name=>"input or textarea", :type=>"(any text type)"}
[-] Session: /opt/sspider/arachni/components/plugins/login_script.rb:29:in `eval'
[-] Session: /var/lib/gems/2.2.0/gems/watir-webdriver-0.8.0/lib/watir-webdriver/elements/element.rb:505:in `assert_exists'
[-] Session: /var/lib/gems/2.2.0/gems/watir-webdriver-0.8.0/lib/watir-webdriver/user_editable.rb:32:in `clear'
[-] Session: /var/lib/gems/2.2.0/gems/watir-webdriver-0.8.0/lib/watir-webdriver/user_editable.rb:11:in `set'
[-] Session: (eval):12:in `block in prepare'
[-] Session: /opt/sspider/arachni/components/plugins/login_script.rb:29:in `eval'
[-] Session: /opt/sspider/arachni/components/plugins/login_script.rb:29:in `block in prepare'
[-] Session: /opt/sspider/arachni/components/plugins/login_script.rb:45:in `call'
[-] Session: /opt/sspider/arachni/components/plugins/login_script.rb:45:in `block in run'
[-] Session: /opt/sspider/arachni/lib/arachni/session.rb:307:in `call'
[-] Session: /opt/sspider/arachni/lib/arachni/session.rb:307:in `login_from_sequence'
[-] Session: /opt/sspider/arachni/lib/arachni/session.rb:237:in `block in login'
[-] Session: /opt/sspider/arachni/lib/arachni/utilities.rb:408:in `call'
[-] Session: /opt/sspider/arachni/lib/arachni/utilities.rb:408:in `exception_jail'
[-] Session: /opt/sspider/arachni/lib/arachni/session.rb:236:in `login'
[-] Session: /opt/sspider/arachni/components/plugins/login_script.rb:50:in `run'
[-] Session: /opt/sspider/arachni/lib/arachni/plugin/manager.rb:75:in `block (3 levels) in run'
[-] Session: /opt/sspider/arachni/lib/arachni/utilities.rb:408:in `call'
[-] Session: /opt/sspider/arachni/lib/arachni/utilities.rb:408:in `exception_jail'
[-] Session: /opt/sspider/arachni/lib/arachni/plugin/manager.rb:67:in `block (2 levels) in run'
[-] Session: 
[-] Session: Parent:
[-] Session: Arachni::Session
[-] Session: 
[-] Session: Block:
[-] Session: #<Proc:0x000000030483c0@/opt/sspider/arachni/lib/arachni/session.rb:236>
[-] Session: 
[-] Session: Caller:
[-] Session: /opt/sspider/arachni/lib/arachni/utilities.rb:408:in `exception_jail'
[-] Session: /opt/sspider/arachni/lib/arachni/session.rb:236:in `login'
[-] Session: /opt/sspider/arachni/components/plugins/login_script.rb:50:in `run'
[-] Session: /opt/sspider/arachni/lib/arachni/plugin/manager.rb:75:in `block (3 levels) in run'
[-] Session: /opt/sspider/arachni/lib/arachni/utilities.rb:408:in `call'
[-] Session: /opt/sspider/arachni/lib/arachni/utilities.rb:408:in `exception_jail'
[-] Session: /opt/sspider/arachni/lib/arachni/plugin/manager.rb:67:in `block (2 levels) in run'
[-] Session: --------------------------------------------------------------------------------
[-] Login script: A runtime error was encountered while executing the login script.
<html><head></head><body></body></html>
[~] Login script: Aborting the scan.
[!] 
[!] Waiting on 4 plugins to finish:
[!] timing_attacks, discovery, uniformity, healthmap
[!] 


================================================================================


[+] Web Application Security Report - Arachni Framework

[~] Report generated on: 2015-08-05 12:45:52 -0400
[~] Report false positives at: http://github.com/Arachni/arachni/issues

[+] System settings:
[~] ---------------
[~] Version:           1.2.1
[~] Audit started on:  2015-08-05 12:45:48 -0400
[~] Audit finished on: 2015-08-05 12:45:52 -0400
[~] Runtime:           00:00:03

[~] URL:        http://<urlhere>/Login.aspx
[~] User agent: Arachni/v1.2.1

[*] Audited elements: 
[~] * Links
[~] * Forms
[~] * Cookies
[~] * XMLs
[~] * JSONs

[*] Checks: rfi, xpath_injection, path_traversal, sql_injection_differential, csrf, xss_tag, file_inclusion, xxe, code_injection_php_input_wrapper, unvalidated_redirect, os_cmd_injection, session_fixation, xss_dom_script_context, no_sql_injection_differential, ldap_injection, code_injection, sql_injection_timing, code_injection_timing, xss_dom, os_cmd_injection_timing, source_code_disclosure, no_sql_injection, response_splitting, xss, unvalidated_redirect_dom, sql_injection, xss_path, trainer, xss_event, xss_dom_inputs, xss_script_context, http_put, origin_spoof_access_restriction_bypass, htaccess_limit, xst, backup_directories, interesting_responses, insecure_cross_domain_policy_access, webdav, backdoors, insecure_client_access_policy, backup_files, directory_listing, insecure_cross_domain_policy_headers, localstart_asp, common_admin_interfaces, common_directories, allowed_methods, insecure_cors_policy, password_autocomplete, cookie_set_for_parent_domain, http_only_cookies, form_upload, cvs_svn_users, unencrypted_password_forms, credit_card, hsts, html_objects, ssn, captcha, private_ip, x_frame_options, mixed_resource, insecure_cookies, emails, common_files

[*] Filters: 
[~]   Exclude:
[~]     (?-mix:logout.aspx)

[~] ===========================

[+] 0 issues were detected.


[+] Plugin data:
[~] ---------------


[*] Login script
[~] ~~~~~~~~~~~~~~
[~] Description: 
Loads and sets an external script as the system's login sequence, to be executed
prior to the scan and whenever a log-out is detected.

The script needn't necessarily perform an actual login operation. If another
process is used to manage sessions, the script can be used to communicate with
that process and, for example, load and set cookies from a shared cookie-jar.

# Ruby

## With browser (slow)

If a [browser](http://watirwebdriver.com/) is available, it will be exposed to
the script via the `browser` variable. Otherwise, that variable will have a
value of `nil`.

    browser.goto 'http://testfire.net/bank/login.aspx'

    form = browser.form( id: 'login' )
    form.text_field( name: 'uid' ).set 'jsmith'
    form.text_field( name: 'passw' ).set 'Demo1234'

    form.submit

    # You can also configure the session check from the script, dynamically,
    # if you don't want to set static options via the user interface.
    framework.options.session.check_url     = browser.url
    framework.options.session.check_pattern = /Sign Off|MY ACCOUNT/

## Without browser (fast)

If a real browser environment is not required for the login operation, then
using the system-wide HTTP interface is preferable, as it will be much faster
and consume much less resources.

    response = http.post( 'http://testfire.net/bank/login.aspx',
        parameters:     {
            'uid'   => 'jsmith',
            'passw' => 'Demo1234'
        },
        mode:           :sync,
        update_cookies: true
    )

    framework.options.session.check_url     = to_absolute( response.headers.location, response.url )
    framework.options.session.check_pattern = /Sign Off|MY ACCOUNT/

## From cookie-jar

If an external process is used to manage sessions, you can keep Arachni in sync
by loading cookies from a shared Netscape-style cookie-jar file.

    http.cookie_jar.load 'cookies.txt'

# Javascript

When the given script has a `.js` file extension, it will be loaded and executed
in the browser, within the page of the target URL.

    document.getElementById( 'uid' ).value   = 'jsmith';
    document.getElementById( 'passw' ).value = 'Demo1234';

    document.getElementById( 'login' ).submit();



[+] A runtime error was encountered while executing the login script.

[~] Report saved at: /opt/sspider/scans_results/test.arf [0.0MB]
[~] The scan has logged errors: /opt/sspider/arachni/logs/error-32003.log

[~] Audited 0 pages.

[~] Sent 0 requests.
[~] Received and analyzed 0 responses.
[~] In 00:00:03
[~] Average: 0 requests/second.

[~] Burst response time sum     0 seconds
[~] Burst response count        0
[~] Burst average response time 0 seconds
[~] Burst average               0 requests/second
[~] Timed-out requests          0
[~] Original max concurrency    20
[~] Throttled max concurrency   20