Arachni — Vulnerability Scanners | Tools

Description

Arachni is a modular, high-performance web application security scanner. It features a built-in browser engine for JavaScript-heavy apps, extensive vulnerability checks (XSS, SQLi, RFI, LFI, command injection, etc.), and a REST API for integration. Note: The project is currently in maintenance mode.

Installation

                        BASH
                        
                            # Download package from releases
wget https://github.com/Arachni/arachni/releases/download/v1.6.1.3/arachni-1.6.1.3-0.6.1.1-linux-x86_64.tar.gz
tar xzf arachni-*.tar.gz && cd arachni-*/bin/

# Or use Docker
docker pull arachni/arachni

Basic Usage

                        BASH
                        
                            # Quick scan
./arachni https://target.com

# With report output
./arachni https://target.com --report-save-path=report.afr

# Generate HTML report
./arachni_reporter report.afr --reporter=html:outfile=report.html

Advanced Usage

                        BASH
                        
                    

                            # Only check for specific vulnerabilities
./arachni https://target.com --checks=xss*,sql_injection*

# Exclude paths
./arachni https://target.com --exclude-path-patterns="/logout|/static"

# With authentication cookie
./arachni https://target.com --http-cookie-string="session=abc123"

# Custom User-Agent
./arachni https://target.com --http-user-agent="Mozilla/5.0"

# REST API mode
./arachni_rest_server
# Then use API at http://localhost:7331
                        

Common Workflows

BASH

                            # Full web application scan
./arachni https://target.com --scope-include-subdomains --report-save-path=full_scan.afr
./arachni_reporter full_scan.afr --reporter=html:outfile=full_scan.html
                        