<% content_for :title, 'Help' %>

Fear not,

help is at hand.

Warning! You will need to clear your browser's cookies for the site before using the proxy.

Recording a log-in sequence

Warning!

Log-out detection and automated re-login are performed on a best-effort basis.

They do not remove the need to exclude paths which can interfere with the session (like log-out links) using the appropriate options (like --exclude='pattern' for the command line UI).

In fact, accurately specifying destructive paths to exclude should be your priority.

You can click the little circle on the left of the control-panel to start recording a login sequence. Once you are done, you will be asked to provide some more details and verify that the information the proxy managed to deduce is accurate.

If everything goes as planned, by the end, Arachni will have been configured in a way that will allow it to maintain a valid session with the web application and re-login as needed.

Caveats

If there is JavaScript involved in the generation of the login form the proxy may be unable to spot it.

Inspecting discovered pages

Heads up! The proxy will actually log all sorts of responses, even images and documents, however you won't be presented with these.

You can review the logged pages along with their elements by clicking the open-eye icon.

Shutting down and starting the scan

To shutdown the proxy and continue with the audit, hit the power-off button. After a couple of seconds the proxy will shutdown and the system will move on with the scan.