arachni
arachni copied to clipboard
Arachni does not maintain session across scan
I'm running arachni version 1.5.1-0.5.12 on the WIVET application using the following script:
./arachni http://192.168.0.18:8090/ \
--scope-include-pattern 'http://192.168.0.18:8090/' \
--scope-exclude-pattern 'http://192.168.0.18:8090/offscanpages.*' \
--scope-exclude-pattern 'http://192.168.0.18:8090/logout.php' \
--scope-exclude-pattern 'http://192.168.0.18:8090/pages/100.php' \
--http-cookie-string="PHPSESSID=77d4ad6bbe505bba989152390e4e9e25"
As can be seen I remove all the logout links (so that the session is not destroyed) and add a cookie string which according to this link forces Arachni to maintain a single session. However, it seems the script opens multiple sessions during the scan.