Skip to content
GitLab

Command line user interface · Changes

Page history
Fixing markdown authored by Tasos Laskos's avatar Tasos Laskos
Show whitespace changes
Inline Side-by-side
guides/user/Command-line-user-interface.md
View page @ 8a54e5f0
...@@ -157,7 +157,8 @@ in your gems path._ ...@@ -157,7 +157,8 @@ in your gems path._
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Outputs the Arachni banner and version information. Outputs the Arachni banner and version information.
...@@ -167,7 +168,8 @@ Outputs the Arachni banner and version information. ...@@ -167,7 +168,8 @@ Outputs the Arachni banner and version information.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
When verbosity is enabled Arachni will give you detailed information about what's going on during the whole process. When verbosity is enabled Arachni will give you detailed information about what's going on during the whole process.
...@@ -288,7 +290,8 @@ Arachni - Web Application Security Scanner Framework v0.4.2 ...@@ -288,7 +290,8 @@ Arachni - Web Application Security Scanner Framework v0.4.2
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
When this flag is enabled the system will output a lot of messages detailing what's happening internally. When this flag is enabled the system will output a lot of messages detailing what's happening internally.
...@@ -404,7 +407,8 @@ $ cat debug.log ...@@ -404,7 +407,8 @@ $ cat debug.log
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
This will suppress all messages except for positive matches -- vulnerabilities. This will suppress all messages except for positive matches -- vulnerabilities.
...@@ -414,7 +418,8 @@ This will suppress all messages except for positive matches -- vulnerabilities. ...@@ -414,7 +418,8 @@ This will suppress all messages except for positive matches -- vulnerabilities.
**Default**: 60 **Default**: 60
*Multiple invocations?*: no **Multiple invocations**: no
Limit how many concurrent HTTP request are sent. Limit how many concurrent HTTP request are sent.
...@@ -428,7 +433,8 @@ Limit how many concurrent HTTP request are sent. ...@@ -428,7 +433,8 @@ Limit how many concurrent HTTP request are sent.
**Default**: 50000 **Default**: 50000
*Multiple invocations?*: no **Multiple invocations**: no
Limit how long the HTTP client should wait for a response from the server. Limit how long the HTTP client should wait for a response from the server.
...@@ -438,7 +444,8 @@ Limit how long the HTTP client should wait for a response from the server. ...@@ -438,7 +444,8 @@ Limit how long the HTTP client should wait for a response from the server.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Forces the system to only follow HTTPS URLs. Forces the system to only follow HTTPS URLs.
_(Target URL must be an HTTPS one as well.)_ _(Target URL must be an HTTPS one as well.)_
...@@ -449,7 +456,8 @@ _(Target URL must be an HTTPS one as well.)_ ...@@ -449,7 +456,8 @@ _(Target URL must be an HTTPS one as well.)_
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Arachni allows you to pass your own cookies in the form of a Netscape cookie-jar file. Arachni allows you to pass your own cookies in the form of a Netscape cookie-jar file.
If you want to audit restricted parts of a website that are accessible only to logged in users you should pass the session cookies to Arachni. If you want to audit restricted parts of a website that are accessible only to logged in users you should pass the session cookies to Arachni.
...@@ -466,7 +474,8 @@ You should also take a look at the _--exclude-cookie_ option discussed later. ...@@ -466,7 +474,8 @@ You should also take a look at the _--exclude-cookie_ option discussed later.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Cookies, as a string, to be sent to the web application. Cookies, as a string, to be sent to the web application.
...@@ -482,7 +491,8 @@ Cookies, as a string, to be sent to the web application. ...@@ -482,7 +491,8 @@ Cookies, as a string, to be sent to the web application.
**Default**: "Arachni/<version>" **Default**: "Arachni/<version>"
*Multiple invocations?*: no **Multiple invocations**: no
You can pass your own user agent string which will be sent to the webserver under audit. You can pass your own user agent string which will be sent to the webserver under audit.
Default is _Arachni/&lt;version&gt;_. Default is _Arachni/&lt;version&gt;_.
...@@ -493,7 +503,8 @@ Default is _Arachni/&lt;version&gt;_. ...@@ -493,7 +503,8 @@ Default is _Arachni/&lt;version&gt;_.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: yes **Multiple invocations**: yes
Allows you to specify custom headers in the form of key-value pairs. Allows you to specify custom headers in the form of key-value pairs.
...@@ -510,7 +521,8 @@ Allows you to specify custom headers in the form of key-value pairs. ...@@ -510,7 +521,8 @@ Allows you to specify custom headers in the form of key-value pairs.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
The string passed to this option will be included in the user-agent string and be the value of the "From" HTTP header field. The string passed to this option will be included in the user-agent string and be the value of the "From" HTTP header field.
...@@ -528,7 +540,8 @@ The _--authed-by_ value should contain information about the person who authoriz ...@@ -528,7 +540,8 @@ The _--authed-by_ value should contain information about the person who authoriz
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
*Requires*: "login-check-pattern":#login-check-pattern *Requires*: "login-check-pattern":#login-check-pattern
The URL passed to this option will be used to verify that the scanner is still The URL passed to this option will be used to verify that the scanner is still
...@@ -543,7 +556,8 @@ this should indicate that the scanner is logged in. ...@@ -543,7 +556,8 @@ this should indicate that the scanner is logged in.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
*Requires*: "login-check-url":#login-check-url *Requires*: "login-check-url":#login-check-url
A pattern used against the body of the "login-check-url":#login-check-url to A pattern used against the body of the "login-check-url":#login-check-url to
...@@ -559,7 +573,8 @@ A positive match should indicate that the scanner is logged in. ...@@ -559,7 +573,8 @@ A positive match should indicate that the scanner is logged in.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
This option allows you to save your current running configuration, all the options passed to Arachni, to an Arachni Framework Profile (.afp) file. This option allows you to save your current running configuration, all the options passed to Arachni, to an Arachni Framework Profile (.afp) file.
...@@ -576,7 +591,8 @@ This option allows you to save your current running configuration, all the optio ...@@ -576,7 +591,8 @@ This option allows you to save your current running configuration, all the optio
**Default**: disabled **Default**: disabled
*Multiple invocations?*: yes **Multiple invocations**: yes
This option allows you to load and run a saved profile. This option allows you to load and run a saved profile.
The load profile option does not restrict your ability to specify more options or even resave the profile. The load profile option does not restrict your ability to specify more options or even resave the profile.
...@@ -593,7 +609,8 @@ The load profile option does not restrict your ability to specify more options o ...@@ -593,7 +609,8 @@ The load profile option does not restrict your ability to specify more options o
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
This option will output the running configuration as a string of command line arguments. This option will output the running configuration as a string of command line arguments.
...@@ -610,7 +627,8 @@ This option will output the running configuration as a string of command line ar ...@@ -610,7 +627,8 @@ This option will output the running configuration as a string of command line ar
**Default**: disabled **Default**: disabled
*Multiple invocations?*: yes **Multiple invocations**: yes
The _--exclude_ option expects a regular expression or plain string and excludes URLs matching that expression from the crawling process. The _--exclude_ option expects a regular expression or plain string and excludes URLs matching that expression from the crawling process.
...@@ -708,7 +726,8 @@ Arachni - Web Application Security Scanner Framework v0.4.2 ...@@ -708,7 +726,8 @@ Arachni - Web Application Security Scanner Framework v0.4.2
**Default**: disabled **Default**: disabled
*Multiple invocations?*: yes **Multiple invocations**: yes
The _--exclude-page_ option expects a regular expression or plain string The _--exclude-page_ option expects a regular expression or plain string
and excludes pages whose content matching that expression from the crawl process. and excludes pages whose content matching that expression from the crawl process.
...@@ -719,7 +738,8 @@ and excludes pages whose content matching that expression from the crawl process ...@@ -719,7 +738,8 @@ and excludes pages whose content matching that expression from the crawl process
**Default**: '.*' **Default**: '.*'
*Multiple invocations?*: yes **Multiple invocations**: yes
This is the exact oposite of the _--exclude_ option. This is the exact oposite of the _--exclude_ option.
When a regular expression is passed to the _--include_ option, *only* URLs matching that regular expression will be crawled. When a regular expression is passed to the _--include_ option, *only* URLs matching that regular expression will be crawled.
...@@ -730,7 +750,8 @@ When a regular expression is passed to the _--include_ option, *only* URLs match ...@@ -730,7 +750,8 @@ When a regular expression is passed to the _--include_ option, *only* URLs match
**Default**: disabled **Default**: disabled
*Multiple invocations?*: yes **Multiple invocations**: yes
The redundant option expects a regular expression and a counter, like so: The redundant option expects a regular expression and a counter, like so:
...@@ -747,7 +768,8 @@ This option is useful when auditing a website that has a lot of redundant pages ...@@ -747,7 +768,8 @@ This option is useful when auditing a website that has a lot of redundant pages
**Default**: disabled (with a value of 10 if none has been specified) **Default**: disabled (with a value of 10 if none has been specified)
*Multiple invocations?*: no **Multiple invocations**: no
The auto-redundant option sets the limit of how many URLs with identical parameters The auto-redundant option sets the limit of how many URLs with identical parameters
should be followed. should be followed.
...@@ -783,7 +805,8 @@ http://test.com/path.php?stuff=blah&stuff2=1 ...@@ -783,7 +805,8 @@ http://test.com/path.php?stuff=blah&stuff2=1
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
This flag will cause Arachni to follow links to subdomains. This flag will cause Arachni to follow links to subdomains.
...@@ -793,7 +816,8 @@ This flag will cause Arachni to follow links to subdomains. ...@@ -793,7 +816,8 @@ This flag will cause Arachni to follow links to subdomains.
**Default**: infinite **Default**: infinite
*Multiple invocations?*: no **Multiple invocations**: no
It specifies how deep into the site structure the crawler should go. It specifies how deep into the site structure the crawler should go.
...@@ -803,7 +827,8 @@ It specifies how deep into the site structure the crawler should go. ...@@ -803,7 +827,8 @@ It specifies how deep into the site structure the crawler should go.
**Default**: infinite **Default**: infinite
*Multiple invocations?*: no **Multiple invocations**: no
It specifies how many links the crawler should follow. It specifies how many links the crawler should follow.
...@@ -813,7 +838,8 @@ It specifies how many links the crawler should follow. ...@@ -813,7 +838,8 @@ It specifies how many links the crawler should follow.
**Default**: infinite **Default**: infinite
*Multiple invocations?*: no **Multiple invocations**: no
It specifies how many redirects the crawler should follow. It specifies how many redirects the crawler should follow.
...@@ -823,7 +849,8 @@ It specifies how many redirects the crawler should follow. ...@@ -823,7 +849,8 @@ It specifies how many redirects the crawler should follow.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: yes **Multiple invocations**: yes
Allows you to extend the scope of the audit by supplementing the paths discovered by the crawler with the paths in the file. Allows you to extend the scope of the audit by supplementing the paths discovered by the crawler with the paths in the file.
The file must contains one path per line. The file must contains one path per line.
...@@ -834,7 +861,8 @@ The file must contains one path per line. ...@@ -834,7 +861,8 @@ The file must contains one path per line.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: yes **Multiple invocations**: yes
Uses the paths contained in file instead of performing a crawl. Uses the paths contained in file instead of performing a crawl.
...@@ -847,7 +875,8 @@ Uses the paths contained in file instead of performing a crawl. ...@@ -847,7 +875,8 @@ Uses the paths contained in file instead of performing a crawl.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Tells Arachni to audit the link elements of the page and their variables. Tells Arachni to audit the link elements of the page and their variables.
...@@ -857,7 +886,8 @@ Tells Arachni to audit the link elements of the page and their variables. ...@@ -857,7 +886,8 @@ Tells Arachni to audit the link elements of the page and their variables.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Tells Arachni to audit the form elements of the page and their inputs. Tells Arachni to audit the form elements of the page and their inputs.
...@@ -867,7 +897,8 @@ Tells Arachni to audit the form elements of the page and their inputs. ...@@ -867,7 +897,8 @@ Tells Arachni to audit the form elements of the page and their inputs.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Tells Arachni to audit the cookies of the page. Tells Arachni to audit the cookies of the page.
...@@ -877,7 +908,8 @@ Tells Arachni to audit the cookies of the page. ...@@ -877,7 +908,8 @@ Tells Arachni to audit the cookies of the page.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: yes **Multiple invocations**: yes
Tells Arachni to exclude -- not audit -- a cookie by name. Tells Arachni to exclude -- not audit -- a cookie by name.
Usually used to avoid auditing a session ID cookie from the cookie-jar. Usually used to avoid auditing a session ID cookie from the cookie-jar.
...@@ -892,7 +924,8 @@ This is very unlikely but it's better to err on the side of caution. ...@@ -892,7 +924,8 @@ This is very unlikely but it's better to err on the side of caution.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: yes **Multiple invocations**: yes
Tells Arachni to exclude -- not audit -- an input vector by name. Tells Arachni to exclude -- not audit -- an input vector by name.
...@@ -902,7 +935,8 @@ Tells Arachni to exclude -- not audit -- an input vector by name. ...@@ -902,7 +935,8 @@ Tells Arachni to exclude -- not audit -- an input vector by name.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Tells Arachni to audit the HTTP headers of the page. Tells Arachni to audit the HTTP headers of the page.
...@@ -917,7 +951,8 @@ Tells Arachni to audit the HTTP headers of the page. ...@@ -917,7 +951,8 @@ Tells Arachni to audit the HTTP headers of the page.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
If enabled Arachni will submit all links and forms of the page along with the cookie permutations. If enabled Arachni will submit all links and forms of the page along with the cookie permutations.
...@@ -929,7 +964,8 @@ If enabled Arachni will submit all links and forms of the page along with the co ...@@ -929,7 +964,8 @@ If enabled Arachni will submit all links and forms of the page along with the co
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
If enabled Arachni will submit all links and forms using both the _GET_ and _POST_ If enabled Arachni will submit all links and forms using both the _GET_ and _POST_
HTTP request methods. HTTP request methods.
...@@ -942,7 +978,8 @@ HTTP request methods. ...@@ -942,7 +978,8 @@ HTTP request methods.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Disables inclusion of binary HTTP response bodies in the audit. Disables inclusion of binary HTTP response bodies in the audit.
...@@ -956,7 +993,8 @@ Disables inclusion of binary HTTP response bodies in the audit. ...@@ -956,7 +993,8 @@ Disables inclusion of binary HTTP response bodies in the audit.
**Default**: disabled OR .* **Default**: disabled OR .*
*Multiple invocations?*: yes **Multiple invocations**: yes
Tells Arachni to list all available modules based on the regular expressions provided and exit. Tells Arachni to list all available modules based on the regular expressions provided and exit.
...@@ -1096,7 +1134,8 @@ Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/modules/audit/xs ...@@ -1096,7 +1134,8 @@ Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/modules/audit/xs
**Default**: '*' -- all modules **Default**: '*' -- all modules
*Multiple invocations?*: no **Multiple invocations**: no
Tells Arachni which modules to load. Tells Arachni which modules to load.
Modules are referenced by their filename without the '.rb' extension, use '--lsmod' to see all. Modules are referenced by their filename without the '.rb' extension, use '--lsmod' to see all.
...@@ -1136,7 +1175,8 @@ The above will load all modules except for the 'backup_files' and 'xss' modules. ...@@ -1136,7 +1175,8 @@ The above will load all modules except for the 'backup_files' and 'xss' modules.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Lists all available reports. Lists all available reports.
...@@ -1305,7 +1345,8 @@ Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/stdout.r ...@@ -1305,7 +1345,8 @@ Path: /home/zapotek/builds/arachni/gems/gems/arachni-0.4.1dev/reports/stdout.r
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Tells Arachni to load an Arachni Framework Report (.afr) file. Tells Arachni to load an Arachni Framework Report (.afr) file.
You can use this option to load a report file and convert it to another format. You can use this option to load a report file and convert it to another format.
...@@ -1459,7 +1500,8 @@ Arachni - Web Application Security Scanner Framework v0.4.2 ...@@ -1459,7 +1500,8 @@ Arachni - Web Application Security Scanner Framework v0.4.2
**Default**: stdout **Default**: stdout
*Multiple invocations?*: yes **Multiple invocations**: yes
Tells Arachni which report component to use. Tells Arachni which report component to use.
Reports are referenced by their filename without the '.rb' extension, use '--lsrep' to see all. Reports are referenced by their filename without the '.rb' extension, use '--lsrep' to see all.
...@@ -1571,7 +1613,8 @@ Arachni - Web Application Security Scanner Framework v0.4.2 ...@@ -1571,7 +1613,8 @@ Arachni - Web Application Security Scanner Framework v0.4.2
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Lists all available plugins. Lists all available plugins.
...@@ -2069,7 +2112,8 @@ Path: /home/zapotek/workspace/arachni/plugins/form_dicattack.rb ...@@ -2069,7 +2112,8 @@ Path: /home/zapotek/workspace/arachni/plugins/form_dicattack.rb
**Default**: disabled **Default**: disabled
*Multiple invocations?*: yes **Multiple invocations**: yes
Tells Arachni which plugin components to run. Tells Arachni which plugin components to run.
Plugins are referenced by their filename without the '.rb' extension, use '--lsplug' to see all. Plugins are referenced by their filename without the '.rb' extension, use '--lsplug' to see all.
...@@ -2377,7 +2421,8 @@ Arachni - Web Application Security Scanner Framework v0.4.2 ...@@ -2377,7 +2421,8 @@ Arachni - Web Application Security Scanner Framework v0.4.2
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Tells Arachni to send all requests via a proxy server. Tells Arachni to send all requests via a proxy server.
...@@ -2387,7 +2432,8 @@ Tells Arachni to send all requests via a proxy server. ...@@ -2387,7 +2432,8 @@ Tells Arachni to send all requests via a proxy server.
**Default**: disabled **Default**: disabled
*Multiple invocations?*: no **Multiple invocations**: no
Tells Arachni authenticate itself with the proxy server using the supplied username and password. Tells Arachni authenticate itself with the proxy server using the supplied username and password.
...@@ -2397,7 +2443,8 @@ Tells Arachni authenticate itself with the proxy server using the supplied usern ...@@ -2397,7 +2443,8 @@ Tells Arachni authenticate itself with the proxy server using the supplied usern
**Default**: disabled OR http **Default**: disabled OR http
*Multiple invocations?*: no **Multiple invocations**: no
Tells Arachni what protocol to use to connect and comunicate with the proxy server. Tells Arachni what protocol to use to connect and comunicate with the proxy server.
...@@ -2618,5 +2665,3 @@ Arachni - Web Application Security Scanner Framework v0.4.2 ...@@ -2618,5 +2665,3 @@ Arachni - Web Application Security Scanner Framework v0.4.2
(Default: http) (Default: http)
``` ```
\ No newline at end of file