... | ... | @@ -27,7 +27,7 @@ auditing links/forms/cookies and following subdomains while also printing verbos |
|
|
|
|
|
The results of the scan will be saved in the the file `test.com.afr`.
|
|
|
|
|
|
arachni --verbose --scope-include-subdomains http://test.com --report-save-path=test.com.afr
|
|
|
arachni --output-verbose --scope-include-subdomains http://test.com --report-save-path=test.com.afr
|
|
|
|
|
|
The Arachni Framework Report (`.afr`) file can later be used to create reports in several formats, like so:
|
|
|
|
... | ... | @@ -68,10 +68,10 @@ in the [knowledge base](http://support.arachni-scanner.com/kb/). |
|
|
* [Version (--version)](#version)
|
|
|
* [Authorized by (--authorized-by)](#authorized-by)
|
|
|
* [Output](#output)
|
|
|
* [Verbose (--verbose)](#verbose)
|
|
|
* [Example](#verbose_example)
|
|
|
* [Debug (--debug)](#debug)
|
|
|
* [Only positives (--only-positives)](#only-positives)
|
|
|
* [Verbose (--output-verbose)](#output-verbose)
|
|
|
* [Example](#output-verbose_example)
|
|
|
* [Debug (--output-debug)](#output-debug)
|
|
|
* [Only positives (--output-only-positives)](#output-only-positives)
|
|
|
* [Scope](#scope)
|
|
|
* [Include (--scope-include-pattern)](#scope-include-pattern)
|
|
|
* [Include subdomains (--scope-include-subdomains)](#scope-include-subdomains)
|
... | ... | @@ -179,7 +179,7 @@ The option value should be the e-mail address of the person who authorized the s |
|
|
|
|
|
<h2 id='output'><a href='#output'>Output</a></h2>
|
|
|
|
|
|
<h3 id='verbose'><a href='#verbose'>Verbose (--verbose)</a></h3>
|
|
|
<h3 id='output-verbose'><a href='#output-verbose'>Verbose (--output-verbose)</a></h3>
|
|
|
|
|
|
**Expects**: `<n/a>`
|
|
|
|
... | ... | @@ -189,7 +189,7 @@ The option value should be the e-mail address of the person who authorized the s |
|
|
|
|
|
When verbose messages are enabled, Arachni will give you detailed information about what's going on during the whole process.
|
|
|
|
|
|
<h4 id='verbose_example'><a href='#verbose_example'>Example</a></h4>
|
|
|
<h4 id='output-verbose_example'><a href='#output-verbose_example'>Example</a></h4>
|
|
|
|
|
|
Let's give this a try:
|
|
|
|
... | ... | @@ -200,7 +200,7 @@ This will load the XSS checks and audit all the forms in `http://testfire.net/`. |
|
|
|
|
|
**Verbose mode disabled**
|
|
|
|
|
|
Observe that there's no `--verbose` flag in the previous run.
|
|
|
Observe that there's no `--output-verbose` flag in the previous run.
|
|
|
|
|
|
_Don't worry about the rest of the parameters right now._
|
|
|
|
... | ... | @@ -262,7 +262,7 @@ Observe the extra information in this run. |
|
|
`[v]` messages are verbose messages.
|
|
|
|
|
|
```
|
|
|
$ arachni --audit-forms --checks=xss http://testfire.net/ --scope-page-limit=1 --verbose
|
|
|
$ arachni --audit-forms --checks=xss http://testfire.net/ --scope-page-limit=1 --output-verbose
|
|
|
Arachni - Web Application Security Scanner Framework v1.0
|
|
|
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com>
|
|
|
|
... | ... | @@ -337,7 +337,7 @@ Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 |
|
|
Cookie: ASP.NET_SessionId=e4h4wy45jmb5vkrg0wl1rj45;amSessionId=15420499882
|
|
|
```
|
|
|
|
|
|
<h3 id='debug'><a href='#debug'>Debug (--debug)</a></h3>
|
|
|
<h3 id='output-debug'><a href='#output-debug'>Debug (--output-debug)</a></h3>
|
|
|
|
|
|
**Expects**: `integer`
|
|
|
|
... | ... | @@ -352,10 +352,10 @@ The level/detail of the messages can be specified in the form of an integer betw |
|
|
If you don't want to be flooded by annoying and obscure messages, you can pipe debugging output to a separate file when running Arachni using:
|
|
|
|
|
|
```
|
|
|
arachni http://example.com --debug 2> debug.log
|
|
|
arachni http://example.com --output-debug 2> debug.log
|
|
|
```
|
|
|
|
|
|
<h3 id='only-positives'><a href='#only-positives'>Only positives (--only-positives)</a></h3>
|
|
|
<h3 id='output-only-positives'><a href='#output-only-positives'>Only positives (--output-only-positives)</a></h3>
|
|
|
|
|
|
**Expects**: `<n/a>`
|
|
|
|
... | ... | |