Arachni Scan
Arachni Scan is a security scanner designed to identify vulnerabilities and security issues in web applications.
Auditor Job Name: Arachni Auditor image: registry.gitlab.com/whitespots-public/security-images/arachni:1.5.1 AppSec Portal Importer Name: Arachni Scan
It utilizes a combination of black-box scanning techniques and a comprehensive set of built-in checks to assess the security posture of web applications.
One of the notable features of Arachni is its ability to crawl and scan web applications in a way that mimics the behavior of a real user. This allows the scanner to detect vulnerabilities that would not be visible through a standard scan. Arachni also has the ability to identify vulnerabilities in various technologies and programming languages including PHP, Ruby on Rails, and Java.
Curl example
curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./arachni.json" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Arachni Scan" -F "branch=dev" -F "domain=whitespots.io"
In this command, the following parameters are used:
-X POST
: specifies the HTTP method to be used (in this case, POST)-H "Authorization: Token <authorization_token>"
: specifies the authorization token obtained from AppSec Portal.-H "Content-Type: multipart/form-data"
: specifies the content type of the request.-F "file=@<report_file_path>"
: specifies the path to the report file generated by the scanner.-F "product_name=<product_name>"
: specifies the name of the product being scanned.-F "product_type=<product_type>"
: specifies the type of the product being scanned.-F "scanner_name=<scanner_name>"
: specifies the name of the scanner used to generate the report (Arachni Scan)-F "branch=<branch_name>"
: (optional) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch
Asset information, if an auditor is used
-F "repository=<repository SSH URL>"
: If your product is code in a repository enter the address of your repository in a specific format, for example: [email protected]:whitespots-public/appsec-portal.git-F "docker_image=<registry address>"
: If your product is image enter the address of the registry where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto_validator:latest-F "domain=<domain>"
: If your product is web enter the domain name of your product, for example: whitespots.io-F "host=<host>"
: If your product is web enter the IP address of your product, for example: 0.0.0.0
Last updated
Was this helpful?