Home → Questions →

API Question: Launching Arachni from code

• Edit

lsmercer

30 Jan, 2013 09:31 AM

I want to launch Arachni from within a Ruby or Python script.

I can see that there is an API dispatcher service, but that is not really what I am after.

What would be ideal is a way to create an arachni instance, pass it arguments, then get it to run using a ruby or python script.

Does anything like this currently exist or is in the pipeline?

1. Support Staff 1 Posted by Tasos Laskos on 30 Jan, 2013 03:29 PM

   

   I've put some effort into cleaning up the libs to make scripting easier but there aren't any guides available yet because the interface isn't stable yet, I keep updating it.

   Now that I got the boilerplate out of the way, yes you can do what you want quite easily (not from Python though), for example:

   # This depends on your setup.
   #require '../../../lib/arachni'
   require 'arachni'
   
   # Uncomment if you want to see system output.
   #require 'arachni/ui/cli/output'
   
   # By passing a block we ask the Framework to reset itself once the block
   # is executed so that it'll be ready for re-use.
   Arachni::Framework.new do |f|
   
       # You can also set these individually like so:
       #   f.opts.url   = 'http://testfire.net'
       #   f.opts.audit :links, :forms
       #
       # But calling #set is cleaner.
       f.opts.set url:        'http://testfire.net',
                  audit:      [:links, :forms, :cookies],
                  # Only audit one page -- for the purposes of this demo.
                  link_count_limit: 1
   
       # Load all XSS modules -- to load all available modules use '*'.
       f.modules.load 'xss*'
   
       # Run the audit.
       f.run
   
       # Go through the logged issues.
       f.auditstore.issues.each do |i|
           puts "#{i.name.capitalize} in #{i.elem} input '#{i.var}' submitted to '#{i.url}'."
       end
   end
   

   This is the simplest scenario, you can actually audit individual pages or custom pages and the same goes for elements or bypass the modules or issue logging or whatever.

   Right now, the best place to look is the RSpec examples and the Arachni code itself.
   Of course, if you need help you can give me a shout and I'll be glad to clarify things for you.

   • Edit

2. Tasos Laskos closed this discussion on 30 Jan, 2013 03:29 PM.

3. Tasos Laskos re-opened this discussion on 30 Jan, 2013 03:39 PM

4. Support Staff 2 Posted by Tasos Laskos on 30 Jan, 2013 03:39 PM

   

   Or did you mean RPC instance? Working over RPC without the Dispatcher?

   • Edit

5. 3 Posted by lsmercer on 30 Jan, 2013 03:47 PM

   

   No that is perfect.

   I am simply trying to run arachni automatically on web servers found during a scan, and using nmap-parser have list of hosts and services already in my ruby env.

   Fantastic. Thanks!

   • Edit

6. Support Staff 4 Posted by Tasos Laskos on 30 Jan, 2013 04:24 PM

   

   Cool, be careful though to either pass a block to Framework#new (like in the example) or call #reset on a Framework instance you're finished using or run each scan in its own process because Arachni is designed to expect a clean env for each scan, ideally using a process per scan.

   • Edit

7. Tasos Laskos closed this discussion on 30 Jan, 2013 04:24 PM.