Arachni Remote Scanner Script

Remote Arachni vulnerability scanner that executes scans on a remote Linux server via SSH and retrieves results.

Overview

The arachni_scan_remote.bat script connects to a remote Linux server running Arachni, executes a comprehensive vulnerability scan, generates HTML reports, and downloads the results. It uses PuTTY tools (plink and pscp) for SSH communication.

Parameters

Parameter	Position	Description
`Proyecto`	1	Project name for identification
`URL`	2	Target URL to scan
`Documentacion`	3	Local output directory for reports
`Timestamp`	4	Timestamp for file naming
`NRO`	5	Scan number identifier
`Server`	6	Remote server hostname or IP address
`Username`	7	SSH username for remote server
`Password`	8	SSH password for authentication

Usage

arachni_scan_remote.bat "MyWebApp" "http://example.com" ^
  "C:\Reports" "20260303_120000" "1" ^
  "scanner.company.com" "scanuser" "SecureP@ss123"

Prerequisites

Required tools in script directory:

plink.exe - PuTTY command-line SSH client
pscp.exe - PuTTY secure copy (SCP) client
Login_fast.rb - Login script template (copied to remote server)

Remote server requirements:

Arachni installed and in PATH
SSH server running on port 22
Write access to /tmp directory
Ruby installed (for login scripts)

Script Workflow

Copies the local login script to the remote server:

pscp.exe -P 22 -l USERNAME -pw PASSWORD -C "%Documentacion%Login_fast.rb" SERVER:"/tmp/Login"
plink.exe -ssh -P 22 -l USERNAME -pw PASSWORD -C SERVER "chmod 755 /tmp/Login"

Source: %~dp0Login_fast.rb → Destination: /tmp/Login on remote server

2. Execute Arachni Scan

Runs a comprehensive Arachni scan on the remote server:

arachni --output-verbose --output-only-positives \
  --http-user-agent='USER_AGENT' \
  --audit-links --audit-forms --audit-cookies --audit-headers \
  --audit-jsons --audit-xmls --audit-ui-inputs --audit-ui-forms \
  --checks=* \
  --plugin=login_script:script=/tmp/Login \
  --scope-exclude-pattern=PATTERN \
  --platforms=PLATFORM \
  --report-save-path='/tmp/ArachniReport - TIMESTAMP.afr' \
  URL

3. Generate HTML Report

Converts the Arachni Framework Report (.afr) to HTML:

arachni_reporter '/tmp/ArachniReport - TIMESTAMP.afr' \
  --reporter=html:outfile='/tmp/ArachniReport - TIMESTAMP.zip'

4. Download and Cleanup

Retrieves the report and removes remote files:

pscp.exe -P 22 -l USERNAME -pw PASSWORD -C SERVER:"/tmp/ArachniReport - TIMESTAMP.zip" "%Documentacion%\ArachniReport - TIMESTAMP.zip"
plink.exe -ssh -P 22 -l USERNAME -pw PASSWORD -C SERVER "rm -fr '/tmp/Login' '/tmp/ArachniReport - TIMESTAMP.zip' '/tmp/ArachniReport - TIMESTAMP.afr'"

Scan Configuration

Default Platform Settings

The script is configured for Windows/IIS/ASP.NET applications:

set plataform=windows,sql,iis,aspx

For Linux/Apache/PHP applications, uncomment arachni_scan_remote.bat:23:

set plataform=linux,mysql,apache,php

View all available platforms:

arachni --platforms-list

Scope Exclusion

The script excludes logout pages to prevent session termination:

set scope-exclude-pattern=Logout

Modify at arachni_scan_remote.bat:21 to exclude other patterns:

set scope-exclude-pattern=Logout|admin|manager|phpmyadmin

User Agent

Default user agent:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36

Audit Modules

The script enables all audit modules:

Module	Description
`--audit-links`	Audit links and query parameters
`--audit-forms`	Audit HTML forms
`--audit-cookies`	Audit cookies for vulnerabilities
`--audit-headers`	Audit HTTP headers
`--audit-jsons`	Audit JSON inputs
`--audit-xmls`	Audit XML inputs
`--audit-ui-inputs`	Audit UI input elements
`--audit-ui-forms`	Audit UI form elements
`--checks=*`	Run all vulnerability checks

The script uses the login_script plugin with /tmp/Login for authenticated scanning. Example login script structure in Login_fast.rb:

response = http.post( 'http://example.com/login.php',
    parameters:     {
        'username' => 'test',
        'password' => 'test'
    },
    mode:           :sync,
    update_cookies: true
)
framework.options.session.check_url     = to_absolute( response.headers.location, response.url )
framework.options.session.check_pattern = /Logout|Sign out|Cerrar Sesion/

For complex login forms requiring JavaScript, see comments at arachni_scan_remote.bat:32-44:

browser.goto 'http://testphp.acunetix.com/login.php'
form = browser.form( id: 'loginform' )
form.text_field( name: 'uname' ).set 'test'
form.text_field( name: 'pass' ).set 'test'
form.submit
framework.options.session.check_url     = browser.url
framework.options.session.check_pattern = /Logout/

Note: Browser-based login requires additional gems:

gem install watir-webdriver
gem install selenium-webdriver

Alternative: AutoLogin Plugin

For simple form-based authentication, use the autologin plugin (see comments at arachni_scan_remote.bat:63-65):

set LoginPage=%URL%/login.php
--plugin=autologin:url=%LoginPage%,parameters='username=test&password=test',check='Logout'

HTTP Authentication

For HTTP Basic/Digest authentication, uncomment and configure arachni_scan_remote.bat:16-19:

set http-username=Admin
set http-password=Password
--http-authentication-username=%http-username% --http-authentication-password=%http-password%

Output Files

Local Report

Downloaded to:

%Documentacion%\ArachniReport - {Timestamp}.zip

Extract the ZIP to access the HTML report.

Remote Files (Auto-Deleted)

/tmp/Login - Login script
/tmp/ArachniReport - {Timestamp}.afr - Arachni Framework Report
/tmp/ArachniReport - {Timestamp}.zip - HTML report archive

All remote files are deleted after download.

Example Usage Scenarios

Windows/IIS Application

arachni_scan_remote.bat "CorporatePortal" "https://portal.company.com" ^
  "D:\Scans" "20260303_140000" "1" ^
  "arachni-server.local" "scanuser" "P@ssw0rd"

Linux/Apache/PHP Application

Modify platform at arachni_scan_remote.bat:23, then:

arachni_scan_remote.bat "PHPApp" "http://webapp.example.com" ^
  "C:\Reports" "20260303_150000" "1" ^
  "192.168.1.100" "root" "SecurePass"

Multiple Scans with Different Logins

Create custom login scripts for different applications:

rem Copy app-specific login script before each scan
copy Login_App1.rb %Documentacion%\Login_fast.rb
arachni_scan_remote.bat "App1" "http://app1.com" ...

copy Login_App2.rb %Documentacion%\Login_fast.rb  
arachni_scan_remote.bat "App2" "http://app2.com" ...

Security Considerations

Passwords in plain text: The script passes SSH passwords on the command line
Use key-based authentication in production environments instead of passwords
Secure the remote server: Ensure only authorized users have SSH access
Network security: Use VPN or private network for scanner traffic

Using SSH Keys Instead

Modify the script to use Pageant (PuTTY’s SSH agent) or convert to use SSH keys:

rem Remove -pw PASSWORD and use Pageant-loaded keys
plink.exe -ssh -P 22 -l USERNAME SERVER "command"

Troubleshooting

SSH Connection Failed

Symptoms: Script hangs or shows connection errors Solutions:

Verify server hostname/IP is reachable: ping SERVER
Check SSH is running on port 22
Verify credentials are correct
Test manual connection: plink.exe -ssh -P 22 -l USERNAME -pw PASSWORD SERVER

Arachni Command Not Found

Symptoms: Remote command fails with “arachni: command not found” Solutions:

Install Arachni on remote server
Ensure Arachni is in PATH: which arachni
Use full path: /opt/arachni/bin/arachni

Symptoms: Scan completes but misses authenticated pages Solutions:

Test login script manually on remote server
Verify session check pattern matches logged-in state
Check credentials in Login_fast.rb are correct
Review Arachni scan log for authentication errors

Report Download Fails

Symptoms: pscp.exe fails to download report Solutions:

Verify local Documentacion path exists and is writable
Check remote /tmp has sufficient space
Ensure firewall allows SCP traffic
Test manual download: pscp.exe -P 22 -l USER -pw PASS SERVER:/tmp/test.txt C:\

Insufficient Disk Space

Symptoms: Scan fails or report generation fails Solutions:

Check remote /tmp disk space: plink.exe ... SERVER "df -h /tmp"
Clean up old scan files in /tmp
Configure Arachni to use different output directory with more space

Performance Tuning

Concurrent Scans

The script does not limit concurrent scans. For multiple targets, stagger execution manually:

start arachni_scan_remote.bat ... "1" ...
timeout /t 60
start arachni_scan_remote.bat ... "2" ...

Scan Speed

To adjust scan aggressiveness, add to the Arachni command:

--http-request-concurrency=20    # Default: 20 concurrent HTTP requests
--http-request-timeout=10000     # Timeout in milliseconds
--scope-page-limit=1000          # Maximum pages to crawl

Resource Limits

Monitor remote server resources during scans:

plink.exe ... SERVER "top -b -n 1 | grep arachni"

Web Scanners

Service Scanners

Mobile Analysis

Information Gathering

Utilities

Overview

Parameters

Usage

Prerequisites

Script Workflow

2. Execute Arachni Scan

3. Generate HTML Report

4. Download and Cleanup

Scan Configuration

Default Platform Settings

Scope Exclusion

User Agent

Audit Modules

Alternative: AutoLogin Plugin

HTTP Authentication

Output Files

Local Report

Remote Files (Auto-Deleted)

Example Usage Scenarios

Windows/IIS Application

Linux/Apache/PHP Application

Multiple Scans with Different Logins

Security Considerations

Using SSH Keys Instead

Troubleshooting

SSH Connection Failed

Arachni Command Not Found

Report Download Fails

Insufficient Disk Space

Performance Tuning

Concurrent Scans

Scan Speed

Resource Limits

Web Scanners

Service Scanners

Mobile Analysis

Information Gathering

Utilities

​Overview

​Parameters

​Usage

​Prerequisites

​Script Workflow

​1. Upload Login Script

​2. Execute Arachni Scan

​3. Generate HTML Report

​4. Download and Cleanup

​Scan Configuration

​Default Platform Settings

​Scope Exclusion

​User Agent

​Audit Modules

​Login Script Configuration

​Fast Login (No Browser)

​Browser-Based Login (Commented)

​Alternative: AutoLogin Plugin

​HTTP Authentication

​Output Files

​Local Report

​Remote Files (Auto-Deleted)

​Example Usage Scenarios

​Windows/IIS Application

​Linux/Apache/PHP Application

​Multiple Scans with Different Logins

​Security Considerations

​Using SSH Keys Instead

​Troubleshooting

​SSH Connection Failed

​Arachni Command Not Found

​Login Script Errors

​Report Download Fails

​Insufficient Disk Space

​Performance Tuning

​Concurrent Scans

​Scan Speed

​Resource Limits

Overview

Parameters

Usage

Prerequisites

Script Workflow

1. Upload Login Script

2. Execute Arachni Scan

3. Generate HTML Report

4. Download and Cleanup

Scan Configuration

Default Platform Settings

Scope Exclusion

User Agent

Audit Modules

Login Script Configuration

Fast Login (No Browser)

Browser-Based Login (Commented)

Alternative: AutoLogin Plugin

HTTP Authentication

Output Files

Local Report

Remote Files (Auto-Deleted)

Example Usage Scenarios

Windows/IIS Application

Linux/Apache/PHP Application

Multiple Scans with Different Logins

Security Considerations

Using SSH Keys Instead

Troubleshooting

SSH Connection Failed

Arachni Command Not Found

Login Script Errors

Report Download Fails

Insufficient Disk Space

Performance Tuning

Concurrent Scans

Scan Speed

Resource Limits