Home → Problems →

--scope-extend-paths

• Edit

itscooper

19 Sep, 2014 01:11 PM

Hi,

I am a pentester and have been using Arachni for some time without any issues (and it is an extremely good scanner by comparison), however I have run into some trouble with this option.

TL;DR Using --scope-extend-paths as described does not seem to seed the crawler as expected, at least in this instance.

I've only tested this with one specific application so far, but unfortunately it is for a client and I cannot disclose the generated report or the site itself.

I am using the following command (URLs and credentials sanitised):

./arachni https://example.com/ --output-verbose --scope-exclude-pattern ".*disconnect=true.*" --scope-extend-paths "/mnt/z/example/1409_app/seedURLs.txt" --scope-auto-redundant --audit-links --audit-forms --audit-cookies --audit-headers --plugin 'autologin:url=https://example.com/logon.jsp,parameters=login=user&password=pass,check=operator.login' --output-debug

That's with version v1.0.2.

/mnt/z/example/1409_app/seedURLs.txt contains 1 file path per line. I have tried different styles of URL, for example: - /view/home - /view/home/ - https://example.com/view/home - https://example.com/view/home/

The crawler doesn't seem to even touch any of the defined paths, and the output gives no indication that any extended paths were even specified (i.e. I seem to get the same output if I leave the option out entirely). This includes having debug and verbose output enabled. It includes the following at the end, which appears to give some detail about the scope but does not include any of the extended paths:

 [*] Filters: 
 [~]   Exclude:
 [~]     (?-mix:.*disconnect=true.*)

 [~] ===========================

Autologin and everything else seems to be working fine for this app.

I appreciate it's a pain without having access to the target site, but I was wondering if you can see anything obvious that I'm getting wrong, which might prevent this option from working. If not I can dedicate some more time to testing with another application.

Many thanks,
Chris

1. Support Staff 1 Posted by Tasos Laskos on 19 Sep, 2014 08:23 PM

   

   Hi Chris,

   This is completely my fault, that options wasn't taking effect. I just fixed the issue and will push the fix once I finish testing it, which shouldn't take long.

   I'll update this discussion when I do, thanks for the feedback.

   Cheers,
   Tasos L.

   • Edit

2. Support Staff 2 Posted by Tasos Laskos on 19 Sep, 2014 08:57 PM

   

   I just pushed the fix: https://github.com/Arachni/arachni/commit/8bc3c4bc7dc50574d5b8e296c...

   I'm now uploading nightlies, will let you know once they're up.

   Cheers

   • Edit

3. Support Staff 3 Posted by Tasos Laskos on 19 Sep, 2014 10:33 PM

   

   Done, give them a try and let me know how it works: http://downloads.arachni-scanner.com/nightlies/

   • Edit

4. Tasos Laskos closed this discussion on 23 Sep, 2014 12:02 PM.