Zapotek/arachni — Issue #89: http_dicattack module trouble:  Invalid options for component: http_dicattack
Author: speckinpah
Created: 2011-10-13 15:34:38+00:00
State: open

Tried using absolute path as well as specifying http basic credentials old-school style as recommended, while getting the same error:

"Invalid options for component: http_dicattack"

Additional info:
I agree that I'm probably not using perl. I invoke the application using the bash script, the contents of which are pretty short:
"#!/bin/sh
HERE="$(dirname "$(readlink -f "${0}")")"
cd "$HERE/cde-root" && ../cde-exec 'arachni' "$@""

Original communications imported from email below:

Response from developer:
"Did you try including the credentials in the url?:
http://user:passwd@somesite.com

Secondly, Ruby 1.8.7 (Arachni requires 1.9.2)?
I'm surprised you even got it started...so I'll assume that you're using
the CDE packages (in which case you don't need ruby installed).

Anyways, if you're indeed using the CDE package then you should provide
the absolute paths of those files, why this is so is another story.

This hadn't occurred to me before but I will add a notice in the next
version.

As for ways to get support you have a couple of choices:
* Issue tracker: https://github.com/Zapotek/arachni/issues
* Google Groups: http://groups.google.com/group/arachni

If I got something wrong let me know and we'll figure this out."

My original email:
"'m attempting to do some web vulnerability auditing using your tool.
> A couple of the sites that I audit use Basic HTTP authentication. I
> don't see any way to configure Arachni with the HTTP credentials short
> of using the bruteforce feature, which is fine with me really. However
> when I try to audit the site using the command:
>
> ./arachni -v
> --plugin=http_dicattack:username_list=dictionaries/username_list,password_list=dictionaries/password_list
> --report=html http://somesite.com
>
> I get the error:
>
> "[-] Invalid options for component: http_dicattack
> [~] * Invalid type: username_list =_ dictionaries/username_list
> [~] * Expected type: path
>
> [~] * Invalid type: password_list =_ dictionaries/password_list
> [~] * Expected type: path"
>
>
>
>
> Which is funny because I can ls both of those files, and because
> attempting to move the files to the same directory as the executable
> has not changed the results. I also had a quick poke at your source
> code but wasn't able to see where I could easily change something to
> make it work. I apologize for contacting you in this manner but I
> could not find your forum to post on.
>
> FYI I am using ubuntu and ruby 1.8.7 (2010-08-16 patchlevel 302)
> [x86_64-linux]"