Web Application Security Scanner Framework: Arachni

ID N0WHERE:13820
Type n0where
Reporter N0where
Modified 2015-05-04T12:02:57


Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of modern web applications. It is free, with its source code public and available for review. It is multi-platform, supporting all major operating systems (MS Windows, Mac OS X and Linux) and distributed via portable packages which allow for instant deployment.

It is versatile enough to cover a great deal of use cases, ranging from a simple command line scanner utility, to a global high performance grid of scanners, to a Ruby library allowing for scripted audits, to a multi-user multi-scan web collaboration platform. In addition, its simple REST API makes integration a cinch.

Finally, due to its integrated browser environment, it can support highly complicated web applications which make heavy use of technologies such as JavaScript, HTML5, DOM manipulation and AJAX.



  • Cookie-jar/cookie-string support.
  • Custom header support.
  • SSL support.
  • User Agent spoofing.
  • Proxy support for SOCKS4, SOCKS4A, SOCKS5, HTTP/1.1 and HTTP/1.0.
  • Proxy authentication.
  • Site authentication (Automated form-based, Cookie-Jar, Basic-Digest, NTLMv1 and others).
  • Automatic log-out detection and re-login during the scan (when the initial login was performed via the autologin or proxy plugins).
  • Custom 404 page detection.
  • UI abstraction:
  • Pause/resume functionality.
  • Hibernation support — Suspend to and restore from disk.
  • High performance asynchronous HTTP requests.
    • With adjustable concurrency.
    • With the ability to auto-detect server health and adjust its concurrency automatically.
  • Support for custom default input values, using pairs of patterns (to be matched against input names) and values to be used to fill in matching inputs.


Plugins add extra functionality to the system in a modular fashion, this way the core remains lean and makes it easy for anyone to add arbitrary functionality.

  • Passive Proxy ( proxy ) — Analyzes requests and responses between the web app and the browser assisting in AJAX audits, logging-in and/or restricting the scope of the audit.
  • Form based AutoLogin ( autologin ).
  • Dictionary attacker for HTTP Auth ( http_dicattack ).
  • Dictionary attacker for form based authentication ( form_dicattack ).
  • Cookie collector ( cookie_collector ) — Keeps track of cookies while establishing a timeline of changes.
  • WAF (Web Application Firewall) Detector ( waf_detector ) — Establishes a baseline of normal behavior and uses rDiff analysis to determine if malicious inputs cause any behavioral changes.
  • BeepNotify ( beep_notify ) — Beeps when the scan finishes.
  • EmailNotify ( email_notify ) — Sends a notification (and optionally a report) over SMTP at the end of the scan.
  • VectorFeed ( vector_feed ) — Reads in vector data from which it creates elements to be audited. Can be used to perform extremely specialized/narrow audits on a per vector/element basis. Useful for unit-testing or a gazillion other things.
  • Script ( script ) — Loads and runs an external Ruby script under the scope of a plugin, used for debugging and general hackery.
  • Uncommon headers ( uncommon_headers ) — Logs uncommon headers.
  • Content-types ( content_types ) — Logs content-types of server responses aiding in the identification of interesting (possibly leaked) files.

Web Application Security Scanner Framework: Arachni

Web Application Security Scanner Framework: Arachni Documentation

Web Application Security Scanner Framework: Arachni download