• Massively decreased RAM consumption.
• Amount of performed requests cut down by 1/3 — and thus 1/3 decrease in scan times.
• Overhauled timing attack and boolean/differential analysis algorithms to fix SQLi false-positives with misbehaving webapps/servers.
• Vulnerability coverage optimizations with 100% scores on WAVSEP’s tests for:
  • SQL injection
  • Local File Inclusion
  • Remote File Inclusion
  • Non-DOM XSS — DOM XSS not supported until Arachni v0.5.

• Implemented Scan Scheduler with support for recurring scans.
• Redesigned Issue table during the Scan progress screen, to group and filter issues by type and severity.

New Changes

• Optimized pattern matching to use less resources by grouping patterns to only be matched against the per-platform payloads. Bottom line, pattern matching operations have been greatly reduced overall and vulnerabilities can be used to fingerprint the remote platform.
• Modules
  • Path traversal ( path_traversal)
    • Updated to use more generic signatures.
    • Added dot-truncation for MS Windows payloads.
    • Moved non-traversal payloads to the file_inclusion module.
  • File inclusion ( file_inclusion) — Extracted from path_traversal.
    • Uses common server-side files and errors to identify issues.
  • SQL Injection ( sqli) — Added support for the following databases:
    • Firebird
    • SAP Max DB
    • Sybase
    • Frontbase
    • IngresDB
    • HSQLDB
    • MS Access
  • localstart_asp — Checks if localstart.asp is accessible.
• Plugins — Added:
  • Uncommon headers ( uncommon_headers) — Logs uncommon headers.

Modules

Recon

New

• X-Forwarded-For Access Restriction Bypass ( x_forwarded_for_access_restriction_bypass)
  • Retries denied requests with a X-Forwarded-For header to try and trick the web application into thinking that the request originates from localhost and checks whether the restrictions were bypassed.
• Form-based upload ( form_upload)
  • Flags file-upload forms as they require manual testing.

Improved

• .htaccess LIMIT misconfiguration ( htaccess_limit)
• Updated to use verb tampering as well.

Audit

New

• Source code disclosure ( source_code_disclosure)
  • Checks whether or not the web application can be forced to reveal source code.
• Code execution via the php://input wrapper ( code_execution_php_input_wrapper)
  • It injects PHP code into the HTTP request body and uses the php://input wrapper to try and load it.

Improved

• Blind SQL Injection (Boolean/Differential analysis) ( sqli_blind_rdiff)
  • Improved accuracy of results.
• Path traversal ( path_traversal)
  • Severity set to “High”.
  • Updated to start with / and go all the way up to /../../../../../../.
  • Added fingerprints for /proc/self/environ.
  • Improved coverage for MS Windows.
• Remote file inclusion ( rfi)
  • Updated to handle cases where the web application appends its own extension to the injected string.

Arachni is a feature-full, modular, high-performance Ruby framework aimed towards helping penetration testers and administrators evaluate the security of web applications.

Changelog v0.4.3

• Stable multi-Instance scans, taking advantage of SMP/Grid architectures for higher efficiency and performance.
• Automated Grid load-balancing.
• Platform fingerprinting for tailor-made audits resulting in less bandwidth consumption, less server stress and smaller scan runtimes.

• Support for PostgreSQL.
• Support for importing data and configuration from the previous 0.4.2-0.4 packages.

• Downgraded to require GLIBC >= 2.12 for improved portability.

Features

• Cookie-jar/cookie-string support.
• Custom header support.
• SSL support.
• User Agent spoofing.
• Proxy support for SOCKS4, SOCKS4A, SOCKS5, HTTP/1.1 and HTTP/1.0.
• Proxy authentication.
• Site authentication (Automated form-based, Cookie-Jar, Basic-Digest, NTLM and others).
• Automatic log-out detection and re-login during the audit (when the initial login was performed via the AutoLogin plugin).
• Custom 404 page detection.
• UI abstraction:
  • Command-line Interface.
  • Web User Interface.
• Pause/resume functionality.
• High performance asynchronous HTTP requests.
  With adjustable concurrency.
  
  
  

Major improvements with 0.4.2

Users

• The ability to easily perform and manage scans via the brand new, Rails-based, simple, intuitive and beautiful web user interface — I’m overselling it a bit out of excitement.
• Much reduced RAM usage.
• More fluid and smoother progress %.
• Issue remarks – Providing extra context to logged issues and assisting you in determining the nature, variation and special circumstances that may apply.
• More resilient stance towards non-responsive servers.
• Much improved profiling and detection of custom 404 responses.
• Improved payloads for Windows machines for path traversal and OS command injection.
• The ability to exclude pages from the scan based on content.

Developers

• Default serialization changed to Marshal, which translates to much faster and less bandwidth consuming RPC calls.
  • YAML serialization is still supported and it is an automatic fallback, YAML requests will still illicit a YAML response. Careful though, the engine has been changed to Psych, which has been the Ruby default for a while now.
• A bunch of convenience methods have been added to Arachni::RPC::Server::Instance, allowing you to perform and control scans much easier than before.
• More data returned for logged Issues during runtime.

Service providers

• Significantly reduced RAM consumption.
• Significantly reduced bandwidth and CPU usage for RPC calls.
• Improved progress information for statistics, issues and progress %.