From f381839f569614a020f1996378b6cfab8e62a3ae Mon Sep 17 00:00:00 2001 From: Daniel Patanin Date: Mon, 19 Nov 2018 14:05:57 +0100 Subject: [PATCH 1/3] adjusted arachni-bodgeit-example fo rate limit documentation --- .idea/misc.xml | 6 + .idea/modules.xml | 8 + .idea/vcs.xml | 6 + .idea/workspace.xml | 266 ++++++++++++++++++ .../usage-examples/arachni-bodgeit-example.md | 35 ++- 5 files changed, 306 insertions(+), 15 deletions(-) create mode 100644 .idea/misc.xml create mode 100644 .idea/modules.xml create mode 100644 .idea/vcs.xml create mode 100644 .idea/workspace.xml diff --git a/.idea/misc.xml b/.idea/misc.xml new file mode 100644 index 0000000000..28a804d893 --- /dev/null +++ b/.idea/misc.xml @@ -0,0 +1,6 @@ + + + + + \ No newline at end of file diff --git a/.idea/modules.xml b/.idea/modules.xml new file mode 100644 index 0000000000..b53bea06f0 --- /dev/null +++ b/.idea/modules.xml @@ -0,0 +1,8 @@ + + + + + + + + \ No newline at end of file diff --git a/.idea/vcs.xml b/.idea/vcs.xml new file mode 100644 index 0000000000..35eb1ddfbb --- /dev/null +++ b/.idea/vcs.xml @@ -0,0 +1,6 @@ + + + + + + \ No newline at end of file diff --git a/.idea/workspace.xml b/.idea/workspace.xml new file mode 100644 index 0000000000..ac6652936d --- /dev/null +++ b/.idea/workspace.xml @@ -0,0 +1,266 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + true + DEFINITION_ORDER + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - 1542619266586 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - \ No newline at end of file From 4e653753c29b02153b25a68625fc96cfe7d8379d Mon Sep 17 00:00:00 2001 From: Daniel Patanin Date: Mon, 19 Nov 2018 17:10:15 +0100 Subject: [PATCH 3/3] split documentation of arachni-bodgeit-example into test and full config --- .../usage-examples/arachni-bodgeit-example.md | 39 +++++++++++++++---- 1 file changed, 31 insertions(+), 8 deletions(-) diff --git a/docs/user-guide/usage-examples/arachni-bodgeit-example.md b/docs/user-guide/usage-examples/arachni-bodgeit-example.md index 18b2539a0b..cb8a6c1467 100644 --- a/docs/user-guide/usage-examples/arachni-bodgeit-example.md +++ b/docs/user-guide/usage-examples/arachni-bodgeit-example.md @@ -11,8 +11,7 @@ In this example we'll be using Arachni controlled by the secureCodeBox to scan f ## Testing the setup -This is a straight forward configuration including defined rate limits. This configuration could be improved by -defining the login credentials and/or providing a login script. +This is a straight forward configuration by simply configuring the target. ### Start the scan via HTTP API @@ -22,17 +21,41 @@ defining the login credentials and/or providing a login script. `run_scanner.sh --payload payloadFile.json arachni` -### Payload +### Test Payload +```json +[ + { + "location": "http://bodgeit:8080/bodgeit/", + "name": "Arachni BodgeIt Scan" + } +] +``` +This scan should finish in about a minute and should return a couple of findings. + +## Full Scan + +The following example contains a fully configured Arachni Scan for the BodgeIt Store. This can be improved by +configuring login credentials and/or providing a login script. + +### Start the scan via HTTP API + +`PUT http://localhost:8080/box/processes/arachni_webapplicationscan` + +### Start the scan via CLI + +`run_scanner.sh --payload payloadFile.json arachni` + +### Full Payload ```json [ { "location": "http://bodgeit:8080/bodgeit/", "name": "Arachni BodgeIt Scan", "attributes": { - "ARACHNI_DOM_DEPTH_LIMIT": 10, - "ARACHNI_DIR_DEPTH_LIMIT": 62, - "ARACHNI_PAGE_LIMIT": 22, + "ARACHNI_DOM_DEPTH_LIMIT": 15, + "ARACHNI_DIR_DEPTH_LIMIT": 5, + "ARACHNI_PAGE_LIMIT": 50, "ARACHNI_EXCLUDE_PATTERNS": [ ".*\\.png", ".*util\\.js", @@ -43,10 +66,10 @@ defining the login credentials and/or providing a login script. "ARACHNI_POOL_SIZE": 6, "ARACHNI_REQUEST_CONCURRENCY": 20 } - } + } ] ``` - This scan should finish in about a minute and should return a couple of findings. +