Home → Questions →

Scanning REST Application

• Edit

John

06 May, 2015 10:28 AM

Hi. Is it possible to scan REST application which uses AngularJS on client side, so requests and responses contains only json data?

1. Support Staff 1 Posted by Tasos Laskos on 06 May, 2015 10:42 AM

   

   Hello,

   There are no service crawlers at the moment but if you have a REST test suite you can proxy its requests via Arachni's proxy so that it can learn the input vectors and then audit them.

   You can setup Arachni's proxy like so:

   ./bin/arachni http://target-url --plugin=proxy
   

   The default URL will be: http://localhost:8282

   You can then export it prior to running your test suite and if it respects the env variable (as it should) the requests will go through Arachni.

   export http_proxy=http://localhost:8282
   

   Then, in Arachni's terminal you'll see something like:

   [*] Proxy: Requesting http://target-url/my-resource
   [~] Proxy:  *  0 forms
   [~] Proxy:  *  0 links
   [~] Proxy:  *  0 cookies
   [~] Proxy:  *  1 JSON
   [~] Proxy:  *  0 XML
   

   You can debug the proxy manually via simple curl commands, like so:

   http_proxy=http://localhost:8282 curl -H "Content-Type: application/json" -X POST -d '{ "input": "value" }' http://target-url/my-resource
   

   Once everything is done, you need to shutdown the proxy so that the scan will start:

   http_proxy=http://localhost:8282 curl http://arachni.proxy/shutdown
   

   I think this pretty much covers it, let me know if you require further assistance.

   Cheers

   • Edit

2. Support Staff 2 Posted by Tasos Laskos on 06 May, 2015 10:45 AM

   

   I forgot to mention, you may want to cherry pick the checks you load, in this case ones that look for files and directories will be irrelevant so they should be skipped.

   • Edit

3. Support Staff 3 Posted by Tasos Laskos on 06 May, 2015 01:05 PM

   

   I just wrote a KB article about this: http://support.arachni-scanner.com/kb/general-use/service-scanning

   • Edit

4. 4 Posted by John on 06 May, 2015 01:59 PM

   

   Thanks a lot, it should help.

   • Edit

5. Tasos Laskos closed this discussion on 06 May, 2015 02:03 PM.