Zapotek/arachni — Issue #135: --plugin=proxy not detecting FORM
Author: ChrisJohnRiley
Created: 2012-01-10 12:48:14+00:00
State: open

I'm trying to use the proxy plugin to restrict Arachni to specific resources using the following command .:

arachni http://192.168.29.131 --mods=*,-common* --link-count=0 --depth=0 --redirect-limit=0 --report=html:outfile=my_html_report_repeat_low_proxy.html --plugin=proxy:port=8282,bind_address=127.0.0.1

However in testing with DVWA, the proxy doesn't seem to pickup the presense of a FORM on the page.

Example Output:

Arachni - Web Application Security Scanner Framework v0.4.1 [0.2.5]
Author: Tasos "Zapotek" Laskos

(With the support of the community and the Arachni Team.)

Website: http://arachni.segfault.gr - http://github.com/Zapotek/arachni
Documentation: http://github.com/Zapotek/arachni/wiki

[~] No audit options were specified.
[~] -> Will audit links, forms and cookies.
/usr/lib/ruby/site_ruby/1.9.1/rubygems/custom_require.rb:36:in `require': iconv will be deprecated in the future, use String#encode instead.
[*] Initing...
[*] Waiting for plugins to settle...
[~] Proxy: System paused.
[*] Proxy: Listening on: http://127.0.0.1:8282
[*] Proxy: Shutdown URL: http://arachni.proxy.shutdown/
[~] Proxy: The scan will resume once you visit the shutdown URL.
[*] Proxy: Requesting: http://192.168.29.131/login.php
[~] Proxy: * 0 forms
[~] Proxy: * 0 links
[~] Proxy: * 0 cookies
[*] Proxy: Requesting: http://192.168.29.131/dvwa/images/login_logo.png
[*] Proxy: Requesting: http://192.168.29.131/dvwa/css/login.css
[~] Proxy: * 0 forms
[~] Proxy: * 0 links
[~] Proxy: * 0 cookies
[~] Proxy: * 0 forms
[~] Proxy: * 0 links
[~] Proxy: * 0 cookies
[*] Proxy: Requesting: http://192.168.29.131/login.php
[~] Proxy: * 1 forms
[~] Proxy: * 0 links
[~] Proxy: * 0 cookies
[*] Proxy: Requesting: http://192.168.29.131/index.php
[~] Proxy: * 0 forms
[~] Proxy: * 0 links
[~] Proxy: * 0 cookies
[*] Proxy: Requesting: http://192.168.29.131/vulnerabilities/sqli/
[*] Proxy: Requesting: http://192.168.29.131/vulnerabilities/sqli/
[~] Proxy: * 0 forms
[~] Proxy: * 0 links
[~] Proxy: * 0 cookies
[~] Proxy: * 0 forms
[~] Proxy: * 0 links
[~] Proxy: * 0 cookies
[*] Proxy: Requesting: http://192.168.29.131/vulnerabilities/sqli/?id=1&Submit=Submit
[~] Proxy: * 0 forms
[~] Proxy: * 0 links
[~] Proxy: * 0 cookies

The http://192.168.29.131/vulnerabilities/sqli/ resource has a form present, but when loading the page through the proxy it doesn't pick it up. Even when you submit a value to the form through the proxy it still doesn't detect it ( [~] Proxy: * 0 forms). The Login.php is however detected ([~] Proxy: * 1 forms). Could this be because the form is only a single entry field?

source-code snippet: