Skip to content
This repository was archived by the owner on Oct 14, 2020. It is now read-only.

Commit fe2807b

Browse files
committed
Improved spelling and wording
1 parent 3337b35 commit fe2807b

2 files changed

Lines changed: 18 additions & 18 deletions

File tree

docs/user-guide/usage-examples/arachni-bodgeit-example.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,24 @@
1-
# Scanning modern Server Side Rendered Apps using arachni
1+
# Scanning Server Side Rendered Apps using arachni
22

3-
Scanning for Vulnerabilities in BodgeIt using arachni and the secureCodeBox API.
3+
Scanning for Vulnerabilities in BodgeIt using Arachni and the secureCodeBox.
44

55
## Introduction
66

77
BodgeIt is a intentionally vulnarable web application written in JSPs with only very few usages of JavaScript.
88
This makes the app relativly straight forward to scan using pretty much any tool.
99

10-
In this example we'll be using arachni controlled by the secureCodeBox to scan for vulnarabilties in the BodgeIt Store.
10+
In this example we'll be using Arachni controlled by the secureCodeBox to scan for vulnarabilties in the BodgeIt Store.
1111

1212
## Testing the setup
1313

1414
This is a straight forward configuration.
1515
This configuration could be improved by configuring a login method for the scanner.
1616

17-
### Start scan via HTTP API
17+
### Start the scan via HTTP API
1818

1919
`PUT http://localhost:8080/box/processes/arachni_webapplicationscan`
2020

21-
### Start scan via CLI
21+
### Start the scan via CLI
2222

2323
`run_scanner.sh --payload payloadFile.json`
2424

@@ -28,7 +28,7 @@ This configuration could be improved by configuring a login method for the scann
2828
[
2929
{
3030
"name": "Arachni BodgeIt Scan",
31-
"location": "http://bodgeit:8080/",
31+
"location": "http://bodgeit:8080/bodgeit/",
3232
"attributes": {
3333
"ARACHNI_DOM_DEPTH_LIMIT": 15,
3434
"ARACHNI_DIR_DEPTH_LIMIT": 5,

docs/user-guide/usage-examples/arachni-juice-shop-example.md

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
1-
# Scanning modern Single Page Application like OWASP JuiceShop using arachni
1+
# Scanning modern Single Page Application like OWASP JuiceShop using Arachni
22

3-
Scanning for Vulnerabilities in OWASP JuiceShop using arachni and the secureCodeBox API.
3+
Scanning for Vulnerabilities in OWASP JuiceShop using Arachni and the secureCodeBox.
44

55
## Introduction
66

77
JuiceShop poses some problems for many scanners, as it is written as a single page application. This means that the scanner needs to be able to execute JavaScript to spider the application.
88

9-
Luckily arachni is intended for exactly this case!
9+
Luckily Arachni is intended for exactly this case!
1010

1111
## Testing the setup
1212

13-
To start of we should test weather the secureCodeBox and JuiceShop is properly set up. To do this we can start a minimal scan which will finish relatively quickly. This is done by setting the Page Limit to `1` so that arachni will only test the first page of the application.
13+
To start of we should test weather the secureCodeBox and JuiceShop is properly set up. To do this we can start a minimal scan which will finish relatively quickly. This is done by setting the Page Limit to `1` so that Arachni will only test the first page of the application.
1414

15-
### Start test scan via HTTP API
15+
### Start the test scan via HTTP API
1616

1717
`PUT http://localhost:8080/box/processes/arachni_webapplicationscan`
1818

19-
### Start test scan via CLI
19+
### Start the test scan via CLI
2020

2121
`run_scanner.sh --payload payloadFile.json`
2222

@@ -42,20 +42,20 @@ This scan should finish in about a minute and should return a couple of findings
4242

4343
## Full JuiceShop Arachni Config
4444

45-
A full arachni scan config for JuiceShop includes optimisations to maximise the amount of vulnerabilities discovered and optimise the scan time.
45+
A full Arachni scan config for JuiceShop includes optimisations to maximise the amount of vulnerabilities discovered and optimise the scan time.
4646

4747
This is done by configuring the following parameters:
4848

4949
1. Increase Scan Depth (DOM_DEPTH, DIR_DEPTH and PAGE_LIMIT) to more sensible values for the application.
50-
2. Exclude non relevant endpoints. This greatly decreases the scan time as arachni doesn't have to waste time scanning non relevant resources like static css/js files or socket.io endpoints.
51-
3. Extending the spider by routes we know about but arachni wont be able to find via its spider because the are not linked anywhere in the application.
52-
4. Provide arachni with the ability to log into the application. This is often the hardest part of the scan config. Without it the scanner will not be able access restricted pages, so that the scanner will only scan a subset of the application. In this case the login is performed using the `login-script` plugin of arachni which lets us script how to to the login. This script is included in the default `docker-compose` setup of the secureCodeBox. This script is located in `plugins/arachni-login-scripts/login_juice_shop.rb`. You can add custom login scripts for your application into the same directory, the will get mounted into the arachni container.
50+
2. Exclude non relevant endpoints. This greatly decreases the scan time as Arachni doesn't have to waste time scanning non relevant resources like static css/js files or socket.io endpoints.
51+
3. Extending the spider by routes we know about but Arachni wont be able to find via its spider because the are not linked anywhere in the application.
52+
4. Provide Arachni with the ability to log into the application. This is often the hardest part of the scan config. Without it the scanner will not be able access restricted pages, so that the scanner will only scan a subset of the application. In this case the login is performed using the `login-script` plugin of Arachni which lets us script how to to the login. This script is included in the default `docker-compose` setup of the secureCodeBox. This script is located in `plugins/Arachni-login-scripts/login_juice_shop.rb`. You can add custom login scripts for your application into the same directory, the will get mounted into the Arachni container.
5353

54-
### Start full scan via HTTP API
54+
### Start the full scan via HTTP API
5555

5656
`PUT http://localhost:8080/box/processes/arachni_webapplicationscan`
5757

58-
### Start full scan via CLI
58+
### Start the full scan via CLI
5959

6060
`run_scanner.sh --payload payloadFile.json`
6161

0 commit comments

Comments
 (0)