Hands-On Bug Hunting for Penetration Testers

Going Beyond Defaults

Like many scanners, arachni can be point-and-click almost to a fault. Though no extra arguments are required to start spidering a URL from the command-line, there are several critical options we should be aware of to get better functionality.

--timeout

When you set arachni loose on a URL it spins up multiple threads that start bombarding the target with the malicious snippets and exploratory requests all scanners use to flush out interesting behavior. If you're going too quickly though and get hit by a WAF throttling your traffic, you might find some or all of those threads hanging, sometimes indefinitely. The --timeout parameter allows you to pass as an argument to specify how long arachni should wait before shutting ...