Arachni Scan
Arachni Scan is a security scanner designed to identify vulnerabilities and security issues in web applications.
Auditor Job Name: Arachni Auditor image: registry.gitlab.com/whitespots-public/security-images/arachni:1.5.1 AppSec Portal Importer Name: Arachni Scan
It utilizes a combination of black-box scanning techniques and a comprehensive set of built-in checks to assess the security posture of web applications.
One of the notable features of Arachni is its ability to crawl and scan web applications in a way that mimics the behavior of a real user. This allows the scanner to detect vulnerabilities that would not be visible through a standard scan. Arachni also has the ability to identify vulnerabilities in various technologies and programming languages including PHP, Ruby on Rails, and Java.
Curl example
In this command, the following parameters are used:
-X POST: specifies the HTTP method to be used (in this case, POST)-H "Authorization: Token <authorization_token>": specifies the authorization token obtained from AppSec Portal.-H "Content-Type: multipart/form-data": specifies the content type of the request.-F "file=@<report_file_path>": specifies the path to the report file generated by the scanner.-F "product_name=<product_name>": specifies the name of the product being scanned.-F "product_type=<product_type>": specifies the type of the product being scanned.-F "scanner_name=<scanner_name>": specifies the name of the scanner used to generate the report (Arachni Scan)-F "branch=<branch_name>": (optional) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch
Asset information, if an auditor is used
-F "repository=<repository SSH URL>": If your product is code in a repository enter the address of your repository in a specific format, for example: git@gitlab.com:whitespots-public/appsec-portal.git-F "docker_image=<registry address>": If your product is image enter the address of the registry where your product is located, for example: registry.gitlab.com/whitespots-public/appsec-portal/back/auto_validator:latest-F "domain=<domain>": If your product is web enter the domain name of your product, for example: whitespots.io-F "host=<host>": If your product is web enter the IP address of your product, for example: 0.0.0.0
Last updated