Zapotek/arachni — Issue #84: Vulnerabilities in DVWA not identified
Author: walterl
Created: 2011-10-11 14:49:49+00:00
State: open

Scanning a local DVWA (http://www.dvwa.co.uk/) VM with Arachni, an alarmingly small amount of issues are reported.

My most recent scan reported the following issues:
* 1 x XST
* 1 x Path traversal
* 20 x Common directories
* 3 x Common files
* 1 x CVS/SVN Users
* 1 x E-mail address disclosure
* 24 x Interesting response (various URLs)

Although all these issues are technically valid, most of the more important issues were not identified. DVWA includes deliberately vulnerable pages for the following vulnerabilities: Command execution, CSRF, SQL injection, blind SQL injection, file upload, reflected XSS and stored XSS. None of these vulnerabilities were detected. The path traversal issue was the only successfully identified "real" issue.

This scan was done via the XML-RPC server interface, but scanning via the web front-end or command-line interface gave similar results. I have also hard-coded the DVWA setup to set its security level (cookie) to "low" by default. Furthermore I have manually confirmed (from the debugging output) that a request was sent that would result in a valid SQL injection (to the relevant URL) and that the response matches regular expressions from modules/audit/sqli/regexp_ids.txt. Still the issue was not detected or recorded.

This failure to detect deliberate vulnerabilities causes a major lack of confidence in Arachni's results which could lead one to doubt other, more positive/realistic results.

Please let me know if any further information is required.

DVWA version: 1.0.7
Arachni version: 0.3 (CDE package)
Arachni scanning parameters (XML-RPC interface):
Options:
"audit_headers": true,
"audit_links": true,
"audit_forms": true,
"audit_cookies": true,
"exclude": "logout",
"user_agent": "Mozilla/5.0 (X11; Linux i686; rv:6.0) Gecko/20100101 Firefox/6.0"
Modules:
["*", "-private_ip"]
Plug-ins:
"autologin": {"url": "http://192.168.56.102/login.php", "params": "username=admin&password=password"}

Arachni scanning parameters (command-line interface):
./arachni \
--debug \
-v \
--only-positives \
--mods='*,-private_ip' \
--exclude=logout \
--user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:7.0.1) Gecko/20100101 Firefox/7.0.1" \
--plugin=autologin:url=http://192.168.56.102/login.php,params='username=admin&password=password' \
http://192.168.56.102/