Home → Questions →

How to find a Poodle security hole with Arachni?

• Edit

Michael

18 Nov, 2015 11:21 AM

Hi!

I'm evaluating some security scanners with the goal to find one that can be used via command line.

I know, I have a web application in my test portfolio that has a Poodle issue. I used the Arachni scanner to perform a full scan on that web application for eight hours. After 8 hours, Arachni found two issues and no Poodle.

I think, Arachni should be able to find a Poodle if either I give it more time or exclude some topics that do not deal with SSLv3.

Does anybody have an idea how I can formulate a command for the command line to achieve a poodle hit?

Unfortunately, the decision makers decide against a tool that is not able to find an obvious issue like a Poodle. But I want to give Arachni a second chance, because it seams to be very flexible.

Michael

1. Support Staff 1 Posted by Tasos Laskos on 18 Nov, 2015 11:27 AM

   

   Hello,

   Arachni can't detect SSL issues because that information isn't being exposed by the HTTP client it uses.

   Also, strictly speaking, an SSL issue isn't a webapp issue but a server one; Arachni tends to focus on web applications.

   Still, there are plans for it, but it may take a while before it's done.

   Cheers

   • Edit

2. 2 Posted by Michael on 18 Nov, 2015 11:43 AM

   

   Hi!

   Thank you for your quick and clarifying answer. So, if Arachni is a tool for scannig web apps and not for web servers, than it seems to be an obvious idea to combine Arachni with something that cannot scan web apps but web servers.

   Somewhere I read that Nikto is a scanner that performs tests against web servers, not against web applications. I should investigate that further. Do you have any recommendation for something that I can combine with Arachni, or do you think that Nikto could be a good supplement?

   Best regards,
   Michael

   • Edit

3. Support Staff 3 Posted by Tasos Laskos on 18 Nov, 2015 11:48 AM

   

   Yeah using a dedicated tool for server issues would be best, although that's out of my area of expertise.

   From what I hear people tend to use OpenVAS + Arachni to cover both infrastructure and webapp issues but I don't know if OpenVAS has specific Poodle checks -- although I believe it does has generic weak SSL cipher ones.

   Cheers

   • Edit

4. 4 Posted by Michael on 18 Nov, 2015 12:00 PM

   

   THX

   :-)

   • Edit

5. Support Staff 5 Posted by Tasos Laskos on 18 Nov, 2015 12:01 PM

   

   No worries, best of luck with your setup.

   Cheers

   • Edit

6. Tasos Laskos closed this discussion on 18 Nov, 2015 12:01 PM.