Balu
Balu Platform Engineer | Devops | Monitoring | CICD | ODD | SQL/NoSQL | ELK | AWS | Jhipster | Microservices | Agile | Scrum

Arachni - VAPT Tool

Arachni - VAPT Tool

Free, Simple, Distributed, Intelligent, Powerful, Friendly.

Arachni

1 Introduction:

Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of modern web applications.

Detailed recommendations check with the Arachni Website. In this reading, we will define the docker-compose with which we can run with the default SQLite with volume mounting in production too.

Containerization

Environment variables

Name Default Options

| ————- | ————- | ————- |

SERVER_ROOT_PASSWORD arachni any
ARACHNI_USERNAME arachni any
ARACHNI_PASSWORD password any
DB_ADAPTER sqlite sqlite, postgresql
DB_HOST {empty} any
DB_NAME {empty} any
DB_USER {empty} any
DB_PASS {empty} any

Run the docker container

1
2
3
4
5
6
docker run -d \
  -p 222:22 \
  -p 7331:7331 \
  -p 9292:9292 \
  --name arachni \
  arachni/arachni:latest

SSH

ssh -p 222 root@docker-machineIP with default password is "arachni"

Web endpoint can be access as:

http://${docker-machineIP}:9292

  • Web-UI Admin’s username and password

username: admin@admin.admin

password: administrator

  • Web-UI User’s username and password

username: user@user.user

password: regular_user

RESTful API endpoint will be

http://${docker-machineIP}:7331

Customize container with with Password and Params

  1. RUN
1
2
3
4
5
6
7
8
9
10
docker run -d \
  -p 222:22 \
  -p 7331:7331 \
  -p 9292:9292 \
  --name arachni \
  -e SERVER_ROOT_PASSWORD="DockerArachniPWD" \
  -e ARACHNI_PARAMS="--authentication-username arachni --authentication-password Pass123 --only-positives"  \
  arachni:1.4

  1. SSH

ssh -p 222 root@docker-machineIP with password is "DockerArachniPWD"

  1. RESTful API customized username and password

username: arachni

password: Pass123

Archani with Database adopter as postgreSQL

RUN using docker run command

1
2
3
4
5
6
7
8
9
10
11
docker run -d \
  -e "DB_ADAPTER=postgresql" \
  -e "DB_HOST=sample_host" \
  -e "DB_NAME=sample_db_name" \
  -e "DB_USER=sample_db_user" \
  -e "DB_PASS=sample_db_pass" \
  -p 222:22 \
  -p 7331:7331 \
  -p 9292:9292 \
  --name arachni \
  arachni/arachni:latest

Run using docker-compose

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
version: '3'
services:
  postgres:
    image: postgres:9.6
    container_name: postgres
    restart: always
    environment:
      POSTGRES_DB: arachni
      POSTGRES_USER: test_username
      POSTGRES_PASSWORD: test_username
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - ./cache/postgres/data/:/var/lib/postgresql/data/pgdata
    ports:
      - "5432:5432"
  arachni:
    image: arachni/arachni:latest
    conatiner_name: arachni
    environment:
      DB_ADAPTER: postgresql
      DB_HOST: postgres
      DB_NAME: arachni
      DB_USER: test_username
      DB_PASS: test_username
    ports:
      - "7331:7331"
      - "9292:9292"
      - "222:22"
    depends_on:
      - postgres

Web UI

As you run arachni successfully, service will be available on http://localhost:9292 or http://HOST_IP:9292

  • Open the application in the browser and go to Scans menu and click on New

Scan menu

  • In start scanning screen fill the form and click on go. Only website url would be more enough to scan through, else use the specified functionalities to reduce the load

Arachni Start Scanning

  • On Successful scan, you can check with the recent scans, go to scans menu and select recent scan

    In this step we have options to download the scanned report in different formats(html, json, marshal, XML, yaml, AFR)

Download Options

comments powered by Disqus