How to find a Poodle security hole with Arachni?

Michael's Avatar

Michael

18 Nov, 2015 11:21 AM

Hi!

I'm evaluating some security scanners with the goal to find one that can be used via command line.

I know, I have a web application in my test portfolio that has a Poodle issue. I used the Arachni scanner to perform a full scan on that web application for eight hours. After 8 hours, Arachni found two issues and no Poodle.

I think, Arachni should be able to find a Poodle if either I give it more time or exclude some topics that do not deal with SSLv3.

Does anybody have an idea how I can formulate a command for the command line to achieve a poodle hit?

Unfortunately, the decision makers decide against a tool that is not able to find an obvious issue like a Poodle. But I want to give Arachni a second chance, because it seams to be very flexible.

Michael

  1. Support Staff 1 Posted by Tasos Laskos on 18 Nov, 2015 11:27 AM

    Tasos Laskos's Avatar

    Hello,

    Arachni can't detect SSL issues because that information isn't being exposed by the HTTP client it uses.

    Also, strictly speaking, an SSL issue isn't a webapp issue but a server one; Arachni tends to focus on web applications.

    Still, there are plans for it, but it may take a while before it's done.

    Cheers

  2. 2 Posted by Michael on 18 Nov, 2015 11:43 AM

    Michael's Avatar

    Hi!

    Thank you for your quick and clarifying answer. So, if Arachni is a tool for scannig web apps and not for web servers, than it seems to be an obvious idea to combine Arachni with something that cannot scan web apps but web servers.

    Somewhere I read that Nikto is a scanner that performs tests against web servers, not against web applications. I should investigate that further. Do you have any recommendation for something that I can combine with Arachni, or do you think that Nikto could be a good supplement?

    Best regards,
    Michael

  3. Support Staff 3 Posted by Tasos Laskos on 18 Nov, 2015 11:48 AM

    Tasos Laskos's Avatar

    Yeah using a dedicated tool for server issues would be best, although that's out of my area of expertise.

    From what I hear people tend to use OpenVAS + Arachni to cover both infrastructure and webapp issues but I don't know if OpenVAS has specific Poodle checks -- although I believe it does has generic weak SSL cipher ones.

    Cheers

  4. 4 Posted by Michael on 18 Nov, 2015 12:00 PM

    Michael's Avatar

    THX

    :-)

  5. Support Staff 5 Posted by Tasos Laskos on 18 Nov, 2015 12:01 PM

    Tasos Laskos's Avatar

    No worries, best of luck with your setup.

    Cheers

  6. Tasos Laskos closed this discussion on 18 Nov, 2015 12:01 PM.

Comments are currently closed for this discussion. You can start a new one.

Keyboard shortcuts

Generic

? Show this help
ESC Blurs the current field

Comment Form

r Focus the comment reply box
^ + ↩ Submit the comment

You can use Command ⌘ instead of Control ^ on Mac