Skip to content
GitLab

RPC client · Changes

Page history
Updated RPC-client (markdown) authored by Tasos Laskos's avatar Tasos Laskos
Hide whitespace changes
Inline Side-by-side
guides/user/RPC-client.md
View page @ 4ea57ec0
## Version 1.0 ## Version 1.1
The RPC client command line interface is similar to the The RPC client command line interface is similar to the
[[Command line user interface | Command line user interface]]. [[Command line user interface | Command line user interface]].
...@@ -11,8 +11,8 @@ The differences between the two are: ...@@ -11,8 +11,8 @@ The differences between the two are:
* Support for SSL peer verification for Dispatch server. * Support for SSL peer verification for Dispatch server.
``` ```
Arachni - Web Application Security Scanner Framework v1.0 Arachni - Web Application Security Scanner Framework v1.1
Author: Tasos "Zapotek" Laskos <tasos.laskos@gmail.com> Author: Tasos "Zapotek" Laskos <tasos.laskos@arachni-scanner.com>
(With the support of the community and the Arachni Team.) (With the support of the community and the Arachni Team.)
...@@ -24,89 +24,89 @@ Usage: ./bin/arachni_rpc [options] --dispatcher-url HOST:PORT URL ...@@ -24,89 +24,89 @@ Usage: ./bin/arachni_rpc [options] --dispatcher-url HOST:PORT URL
Generic Generic
-h, --help Output this message. -h, --help Output this message.
--version Show version information. --version Show version information.
--authorized-by EMAIL_ADDRESS --authorized-by EMAIL_ADDRESS
E-mail address of the person who authorized the scan. E-mail address of the person who authorized the scan.
(It'll make it easier on the sys-admins during log reviews.) (It'll make it easier on the sys-admins during log reviews.)
(Will be used as a value for the 'From' HTTP request header.) (Will be used as a value for the 'From' HTTP request header.)
Scope Scope
--scope-include-pattern PATTERN --scope-include-pattern PATTERN
Only include resources whose path/action matches PATTERN. Only include resources whose path/action matches PATTERN.
(Can be used multiple times.) (Can be used multiple times.)
--scope-include-subdomains --scope-include-subdomains
Follow links to subdomains. Follow links to subdomains.
(Default: false) (Default: false)
--scope-exclude-pattern PATTERN --scope-exclude-pattern PATTERN
Exclude resources whose path/action matches PATTERN. Exclude resources whose path/action matches PATTERN.
(Can be used multiple times.) (Can be used multiple times.)
--scope-exclude-content-pattern PATTERN --scope-exclude-content-pattern PATTERN
Exclude pages whose content matches PATTERN. Exclude pages whose content matches PATTERN.
(Can be used multiple times.) (Can be used multiple times.)
--scope-exclude-binaries --scope-exclude-binaries
Exclude non text-based pages. Exclude non text-based pages.
(Binary content can confuse passive checks that perform pattern matching.) (Binary content can confuse passive checks that perform pattern matching.)
--scope-redundant-path-pattern PATTERN:LIMIT --scope-redundant-path-pattern PATTERN:LIMIT
Limit crawl on redundant pages like galleries or catalogs. Limit crawl on redundant pages like galleries or catalogs.
(URLs matching PATTERN will be crawled LIMIT amount of times.) (URLs matching PATTERN will be crawled LIMIT amount of times.)
(Can be used multiple times.) (Can be used multiple times.)
--scope-auto-redundant [LIMIT] --scope-auto-redundant [LIMIT]
Only follow URLs with identical query parameter names LIMIT amount of times. Only follow URLs with identical query parameter names LIMIT amount of times.
(Default: 10) (Default: 10)
--scope-directory-depth-limit LIMIT --scope-directory-depth-limit LIMIT
Directory depth limit. Directory depth limit.
(Default: inf) (Default: inf)
(How deep Arachni should go into the site structure.) (How deep Arachni should go into the site structure.)
--scope-page-limit LIMIT --scope-page-limit LIMIT
How many pages to crawl and audit. How many pages to crawl and audit.
(Default: inf) (Default: inf)
--scope-extend-paths FILE --scope-extend-paths FILE
Add the paths in FILE to the ones discovered by the crawler. Add the paths in FILE to the ones discovered by the crawler.
(Can be used multiple times.) (Can be used multiple times.)
--scope-restrict-paths FILE --scope-restrict-paths FILE
Use the paths in FILE instead of crawling. Use the paths in FILE instead of crawling.
(Can be used multiple times.) (Can be used multiple times.)
--scope-url-rewrite PATTERN:SUBSTITUTION --scope-url-rewrite PATTERN:SUBSTITUTION
Rewrite URLs based on the given PATTERN and SUBSTITUTION. Rewrite URLs based on the given PATTERN and SUBSTITUTION.
To convert: http://test.com/articles/some-stuff/23 to http://test.com/articles.php?id=23 To convert: http://test.com/articles/some-stuff/23 to http://test.com/articles.php?id=23
Use: /articles\/[\w-]+\/(\d+)/:articles.php?id=\1 Use: /articles\/[\w-]+\/(\d+)/:articles.php?id=\1
--scope-dom-depth-limit LIMIT --scope-dom-depth-limit LIMIT
How deep to go into the DOM tree of each page, for pages with JavaScript code. How deep to go into the DOM tree of each page, for pages with JavaScript code.
(Default: 10) (Default: 5)
(Setting it to '0' will disable browser analysis.) (Setting it to '0' will disable browser analysis.)
--scope-https-only Forces the system to only follow HTTPS URLs. --scope-https-only Forces the system to only follow HTTPS URLs.
(Default: false) (Default: false)
Audit Audit
--audit-links Audit links. --audit-links Audit links.
--audit-forms Audit forms. --audit-forms Audit forms.
--audit-cookies Audit cookies. --audit-cookies Audit cookies.
--audit-cookies-extensively --audit-cookies-extensively
Submit all links and forms of the page along with the cookie permutations. Submit all links and forms of the page along with the cookie permutations.
(*WARNING*: This will severely increase the scan-time.) (*WARNING*: This will severely increase the scan-time.)
--audit-headers Audit headers. --audit-headers Audit headers.
--audit-link-template TEMPLATE --audit-link-template TEMPLATE
Regular expression with named captures to use to extract input information from generic paths. Regular expression with named captures to use to extract input information from generic paths.
To extract the 'input1' and 'input2' inputs from: To extract the 'input1' and 'input2' inputs from:
...@@ -114,207 +114,244 @@ Audit ...@@ -114,207 +114,244 @@ Audit
Use: Use:
/input1\/(?<input1>\w+)\/input2\/(?<input2>\w+)/ /input1\/(?<input1>\w+)\/input2\/(?<input2>\w+)/
(Can be used multiple times.) (Can be used multiple times.)
--audit-jsons Audit JSON request inputs.
--audit-xmls Audit XML request inputs.
--audit-parameter-names Inject payloads into parameter names.
--audit-with-extra-parameter
Inject payloads into extra element parameters.
--audit-with-both-methods --audit-with-both-methods
Audit elements with both GET and POST requests. Audit elements with both GET and POST requests.
(*WARNING*: This will severely increase the scan-time.) (*WARNING*: This will severely increase the scan-time.)
--audit-exclude-vector PATTERN --audit-exclude-vector PATTERN
Exclude input vectorS whose name matches PATTERN. Exclude input vectorS whose name matches PATTERN.
(Can be used multiple times.) (Can be used multiple times.)
--audit-include-vector PATTERN --audit-include-vector PATTERN
Include only input vectors whose name matches PATTERN. Include only input vectors whose name matches PATTERN.
(Can be used multiple times.) (Can be used multiple times.)
Input Input
--input-value PATTERN:VALUE --input-value PATTERN:VALUE
PATTERN to match against input names and VALUE to use for them. PATTERN to match against input names and VALUE to use for them.
(Can be used multiple times.) (Can be used multiple times.)
--input-values-file FILE --input-values-file FILE
YAML file containing a Hash object with regular expressions, to match against input names, as keys and input values as values. YAML file containing a Hash object with regular expressions, to match against input names, as keys and input values as values.
--input-without-defaults --input-without-defaults
Do not use the system default input values. Do not use the system default input values.
--input-force Fill-in even non-empty inputs. --input-force Fill-in even non-empty inputs.
HTTP HTTP
--http-user-agent USER_AGENT --http-user-agent USER_AGENT
Value for the 'User-Agent' HTTP request header. Value for the 'User-Agent' HTTP request header.
(Default: Arachni/v1.0) (Default: Arachni/v2.0dev)
--http-request-concurrency MAX_CONCURRENCY --http-request-concurrency MAX_CONCURRENCY
Maximum HTTP request concurrency. Maximum HTTP request concurrency.
(Default: 20) (Default: 20)
(Be careful not to kill your server.) (Be careful not to kill your server.)
(*NOTE*: If your scan seems unresponsive try lowering the limit.) (*NOTE*: If your scan seems unresponsive try lowering the limit.)
--http-request-timeout TIMEOUT --http-request-timeout TIMEOUT
HTTP request timeout in milliseconds. HTTP request timeout in milliseconds.
(Default: 50000) (Default: 10000)
--http-request-redirect-limit LIMIT --http-request-redirect-limit LIMIT
Maximum amount of redirects to follow for each HTTP request. Maximum amount of redirects to follow for each HTTP request.
(Default: 5) (Default: 5)
--http-request-queue-size QUEUE_SIZE --http-request-queue-size QUEUE_SIZE
Maximum amount of requests to keep in the queue. Maximum amount of requests to keep in the queue.
Bigger size means better scheduling and better performance, Bigger size means better scheduling and better performance,
smaller means less RAM consumption. smaller means less RAM consumption.
(Default: 500) (Default: 500)
--http-request-header NAME=VALUE --http-request-header NAME=VALUE
Specify custom headers to be included in the HTTP requests. Specify custom headers to be included in the HTTP requests.
(Can be used multiple times.) (Can be used multiple times.)
--http-response-max-size LIMIT --http-response-max-size LIMIT
Do not download response bodies larger than the specified LIMIT, in bytes. Do not download response bodies larger than the specified LIMIT, in bytes.
(Default: inf) (Default: 500000)
--http-cookie-jar COOKIE_JAR_FILE --http-cookie-jar COOKIE_JAR_FILE
Netscape-styled HTTP cookiejar file. Netscape-styled HTTP cookiejar file.
--http-cookie-string COOKIE --http-cookie-string COOKIE
Cookie representation as an 'Cookie' HTTP request header. Cookie representation as an 'Cookie' HTTP request header.
--http-authentication-username USERNAME --http-authentication-username USERNAME
Username for HTTP authentication. Username for HTTP authentication.
--http-authentication-password PASSWORD --http-authentication-password PASSWORD
Password for HTTP authentication. Password for HTTP authentication.
--http-proxy ADDRESS:PORT --http-proxy ADDRESS:PORT
Proxy to use. Proxy to use.
--http-proxy-authentication USERNAME:PASSWORD --http-proxy-authentication USERNAME:PASSWORD
Proxy authentication credentials. Proxy authentication credentials.
--http-proxy-type http,http_1_0,socks4,socks5,socks4a --http-proxy-type http,http_1_0,socks4,socks5,socks4a
Proxy type. Proxy type.
(Default: auto) (Default: auto)
--http-ssl-verify-peer Verify SSL peer.
(Default: false)
--http-ssl-verify-host Verify SSL host.
(Default: false)
--http-ssl-certificate PATH
SSL certificate to use.
--http-ssl-certificate-type pem,der
SSL certificate type.
--http-ssl-key PATH SSL private key to use.
--http-ssl-key-type pem,der
SSL key type.
--http-ssl-key-password PASSWORD
Password for the SSL private key.
--http-ssl-ca PATH File holding one or more certificates with which to verify the peer.
--http-ssl-ca-directory PATH
Directory holding multiple certificate files with which to verify the peer.
--http-ssl-version TLSv1,TLSv1_0,TLSv1_1,TLSv1_2,SSLv2,SSLv3
SSL version to use.
Checks Checks
--checks-list [PATTERN] List available checks based on the provided pattern. --checks-list [PATTERN] List available checks based on the provided pattern.
(If no pattern is provided all checks will be listed.) (If no pattern is provided all checks will be listed.)
--checks CHECK,CHECK2,... --checks CHECK,CHECK2,...
Comma separated list of checks to load. Comma separated list of checks to load.
Checks are referenced by their filename without the '.rb' extension, use '--checks-list' to list all. Checks are referenced by their filename without the '.rb' extension, use '--checks-list' to list all.
Use '*' as a check name to load all checks or as a wildcard, like so: Use '*' as a check name to load all checks or as a wildcard, like so:
xss* to load all XSS checks xss* to load all XSS checks
sqli* to load all SQL injection checks sql_injection* to load all SQL injection checks
etc. etc.
You can exclude checks by prefixing their name with a minus sign: You can exclude checks by prefixing their name with a minus sign:
--checks=*,-backup_files,-xss --checks=*,-backup_files,-xss
The above will load all checks except for the 'backup_files' and 'xss' checks. The above will load all checks except for the 'backup_files' and 'xss' checks.
Or mix and match: Or mix and match:
-xss* to unload all XSS checks. -xss* to unload all XSS checks.
Plugins Plugins
--plugins-list [PATTERN] --plugins-list [PATTERN]
List available plugins based on the provided pattern. List available plugins based on the provided pattern.
(If no pattern is provided all plugins will be listed.) (If no pattern is provided all plugins will be listed.)
--plugin 'PLUGIN:OPTION=VALUE,OPTION2=VALUE2' --plugin 'PLUGIN:OPTION=VALUE,OPTION2=VALUE2'
PLUGIN is the name of the plugin as displayed by '--plugins-list'. PLUGIN is the name of the plugin as displayed by '--plugins-list'.
(Plugins are referenced by their filename without the '.rb' extension, use '--plugins-list' to list all.) (Plugins are referenced by their filename without the '.rb' extension, use '--plugins-list' to list all.)
(Can be used multiple times.) (Can be used multiple times.)
Platforms Platforms
--platforms-list List available platforms. --platforms-list List available platforms.
--platforms-no-fingerprinting --platforms-no-fingerprinting
Disable platform fingerprinting. Disable platform fingerprinting.
(By default, the system will try to identify the deployed server-side platforms automatically (By default, the system will try to identify the deployed server-side platforms automatically
in order to avoid sending irrelevant payloads.) in order to avoid sending irrelevant payloads.)
--platforms PLATFORM,PLATFORM2,... --platforms PLATFORM,PLATFORM2,...
Comma separated list of platforms (by shortname) to audit. Comma separated list of platforms (by shortname) to audit.
(The given platforms will be used *in addition* to fingerprinting. In order to restrict the audit to (The given platforms will be used *in addition* to fingerprinting. In order to restrict the audit to
these platforms enable the '--platforms-no-fingerprinting' option.) these platforms enable the '--platforms-no-fingerprinting' option.)
Session Session
--session-check-url URL URL to use to verify that the scanner is still logged in to the web application. --session-check-url URL URL to use to verify that the scanner is still logged in to the web application.
(Requires 'session-check-pattern'.) (Requires 'session-check-pattern'.)
--session-check-pattern PATTERN --session-check-pattern PATTERN
Pattern used against the body of the 'session-check-url' to verify that the scanner is still logged in to the web application. Pattern used against the body of the 'session-check-url' to verify that the scanner is still logged in to the web application.
(Requires 'session-check-url'.) (Requires 'session-check-url'.)
Profiles Profiles
--profile-save-filepath FILEPATH --profile-save-filepath FILEPATH
Save the current configuration profile/options to FILEPATH. Save the current configuration profile/options to FILEPATH.
--profile-load-filepath FILEPATH --profile-load-filepath FILEPATH
Load a configuration profile from FILEPATH. Load a configuration profile from FILEPATH.
Browser cluster Browser cluster
--browser-cluster-pool-size SIZE --browser-cluster-pool-size SIZE
Amount of browser workers to keep in the pool and put to work. Amount of browser workers to keep in the pool and put to work.
(Default: 6) (Default: 6)
--browser-cluster-job-timeout SECONDS --browser-cluster-job-timeout SECONDS
Maximum allowed time for each job. Maximum allowed time for each job.
(Default: 120) (Default: 15)
--browser-cluster-worker-time-to-live LIMIT --browser-cluster-worker-time-to-live LIMIT
Re-spawn the browser of each worker every LIMIT jobs. Re-spawn the browser of each worker every LIMIT jobs.
(Default: 100) (Default: 100)
--browser-cluster-ignore-images --browser-cluster-ignore-images
Do not load images. Do not load images.
--browser-cluster-screen-width --browser-cluster-screen-width
Browser screen width. Browser screen width.
(Default: 1600) (Default: 1600)
--browser-cluster-screen-height --browser-cluster-screen-height
Browser screen height. Browser screen height.
(Default: 1200) (Default: 1200)
Distribution Distribution
--dispatcher-url HOST:PORT --dispatcher-url HOST:PORT
Dispatcher server to use. Dispatcher server to use.
--spawns SPAWNS How many slaves to spawn for a high-performance mult-Instance scan. --spawns SPAWNS How many slaves to spawn for a high-performance mult-Instance scan.
(When no grid mode has been specified, all slaves will all be from the same Dispatcher machine. (When no grid mode has been specified, all slaves will all be from the same Dispatcher machine.
When a grid-mode has been specified, this option will be treated as a possible maximum and When a grid-mode has been specified, this option will be treated as a possible maximum and
not a hard value.) not a hard value.)
--grid-mode balance,aggregate --grid-mode balance,aggregate
Sets the Grid mode of operation for this scan. Sets the Grid mode of operation for this scan.
Valid modes are: Valid modes are:
* balance -- Slaves will be provided by the least burdened Grid Dispatchers. * balance -- Slaves will be provided by the least burdened Grid Dispatchers.
* aggregate -- In addition to balancing, slaves will all be from Dispatchers * aggregate -- In addition to balancing, slaves will all be from Dispatchers
with unique bandwidth Pipe-IDs to result in application-level line-aggregation. with unique bandwidth Pipe-IDs to result in application-level line-aggregation.
--grid Shorthand for '--grid-mode=balance'. --grid Shorthand for '--grid-mode=balance'.
SSL SSL
--ssl-ca FILE Location of the CA certificate (.pem). --ssl-ca FILE Location of the CA certificate (.pem).
--ssl-private-key FILE Location of the client SSL private key (.pem). --ssl-private-key FILE Location of the client SSL private key (.pem).
--ssl-certificate FILE Location of the client SSL certificate (.pem). --ssl-certificate FILE Location of the client SSL certificate (.pem).
Report Report
--report-save-path PATH Directory or file path where to store the scan report. --report-save-path PATH Directory or file path where to store the scan report.
You can use the generated file to create reports in several formats with the 'arachni_reporter' executable. You can use the generated file to create reports in several formats with the 'arachni_reporter' executable.
Timeout Timeout
--timeout HOURS:MINUTES:SECONDS --timeout HOURS:MINUTES:SECONDS
......