Arachni

Arachni Integration with DefectDojo

Arachni is a feature-rich, open-source web application security scanner designed for security researchers and penetration testers who need flexible, scriptable DAST coverage without a commercial license. It handles a broad attack surface — XSS, SQL injection, CSRF, file inclusion, code injection, and more — with a modular architecture that lets teams extend its capabilities with custom checks. The challenge, as with any point-in-time scanner, is what happens after the scan completes. Arachni produces detailed findings, but without a vulnerability management platform behind it those findings live in scan reports rather than in a workflow. Integrating Arachni with DefectDojo moves findings into a persistent lifecycle: deduplicated, tracked, assigned, and reportable across scan cycles and across your entire web application portfolio.

Why Arachni Matters

Arachni occupies a practical niche in security programs — it delivers capable DAST coverage with no licensing cost, making it well-suited for teams that need to scan frequently, scan many targets, or integrate scanning into pipelines without per-scan commercial overhead.

• Arachni's modular check system covers a comprehensive range of web vulnerability classes including reflected and stored XSS, SQL injection, blind SQL injection, LDAP injection, code injection, file inclusion (local and remote), path traversal, CSRF, unvalidated redirects, and insecure cookie attributes — all configurable per scan
• Its browser-based crawler handles JavaScript-heavy applications and single-page applications by executing client-side code, giving better coverage of modern web frontends than HTTP-only crawlers
• Authenticated scanning is supported through configurable session handling, allowing coverage of application functionality behind login flows
• Arachni produces output in multiple formats including JSON and XML, both of which DefectDojo can consume via its Arachni parser
• The REST API and CLI interfaces make it straightforward to integrate Arachni into CI/CD pipelines and automated scan schedules
• Its open-source nature allows security teams to inspect, modify, and extend the scanner's behavior in ways commercial tools do not permit

Advantages of This Integration

Arachni gives you DAST findings on demand. DefectDojo gives those findings a home beyond the scan report.

• Persistent finding records across scan cycles: Each time Arachni scans an application, reimporting into DefectDojo updates existing findings rather than creating a fresh pile of duplicates. You can see whether a finding was resolved between scan cycles, how long it has been open, and whether it re-appeared after a claimed fix — without manually diffing JSON reports.
• SLA enforcement with breach tracking: DefectDojo applies configurable SLA policies by severity across all imported Arachni findings. Critical and High DAST vulnerabilities get remediation deadlines; breach dates are tracked and surfaced in dashboards automatically — something Arachni's native output formats cannot provide.
• False positive management that persists: DAST scanners produce false positives, and Arachni is no exception. Findings marked as false positives in DefectDojo are retained across reimports — the next Arachni scan won't re-open them, and the rationale is documented for audit purposes rather than relying on scanner-side suppression.
• Cross-application portfolio visibility: Security teams scanning multiple web applications with Arachni get a consolidated view of open DAST findings across their entire portfolio in DefectDojo — filterable by severity, finding type, age, and SLA status — without manually reviewing individual scan reports per application.
• Remediation assignment and ticketing workflow: Triaged Arachni findings push from DefectDojo to Jira, GitHub Issues, or ServiceNow with vulnerability type, affected URL, and remediation guidance included — giving developers actionable context without requiring access to Arachni reports or the ability to run the scanner themselves.
• Longitudinal trend tracking: DefectDojo retains scan history, enabling trend analysis over time — whether DAST findings for a given application are increasing, decreasing, or cycling between open and re-introduced. This trend data informs decisions about code quality, developer security training, and testing cadence.

How This Integration Works

Arachni produces scan output in JSON and XML formats. DefectDojo's Arachni parser supports both, with JSON being the recommended format for import.

Step 1 — Run Arachni and export results

Using the Arachni CLI for a standard scan with JSON output:

# Basic scan with JSON report output

arachni https://target-application.example.com \

--report-save-path=arachni-scan.afr

# Convert the saved scan file to JSON report

arachni_reporter arachni-scan.afr \

--reporter=json:outfile=arachni-results.json

# Convert to XML (alternative format, also supported)

arachni_reporter arachni-scan.afr \

--reporter=xml:outfile=arachni-results.xml

# Authenticated scan with session cookie

arachni https://target-application.example.com \

--http-cookie-string="session=<session-token>" \

--report-save-path=arachni-scan-auth.afr

For CI pipeline integration using Arachni's REST API:

# Start the Arachni REST API server

arachni_rest_server --authentication-token <api-token>

# Submit a scan via API

curl -X POST http://localhost:7331/scans \

-H "Content-Type: application/json" \

-H "X-Token: <api-token>" \

-d '{

"url": "https://target-application.example.com",

"checks": ["xss*", "sql_injection*", "csrf"]

}'

# Retrieve completed scan report as JSON

curl -X GET http://localhost:7331/scans/<scan-id>/report.json \

-H "X-Token: <api-token>" \

-o arachni-results.json

Step 2 — Import into DefectDojo

Use Arachni Scan as the scan type:

curl -X POST https://<defectdojo-host>/api/v2/import-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Arachni Scan" \

-F "file=@arachni-results.json" \

-F "engagement=<engagement-id>" \

-F "product=<product-id>" \

-F "active=true" \

-F "verified=false"

Step 3 — Reimport for recurring scans

For applications scanned on a regular cadence, use the reimport endpoint to update existing findings rather than stack redundant test records:

curl -X POST https://<defectdojo-host>/api/v2/reimport-scan/ \

-H "Authorization: Token <your-api-token>" \

-F "scan_type=Arachni Scan" \

-F "file=@arachni-results.json" \

-F "test=<test-id>"

DefectDojo marks findings absent from the new scan as resolved, creates records for new findings, and leaves previously false-positived or risk-accepted findings untouched.

Data Granularity: What Gets Imported

Use Cases

In a pre-deployment security review pipeline: Arachni scans run against a staging environment as part of a deployment gate process. Results import into a DefectDojo engagement scoped to the release version. Security and engineering teams triage findings in DefectDojo, with verified vulnerabilities assigned to developers and tracked through to remediation before promotion to production. The engagement record serves as documented evidence of DAST coverage for the release — auditable and timestamped without manual report archiving.

For recurring application security assessments: Production-facing applications are scanned on a monthly schedule. Each scan reimports into the same DefectDojo engagement, automatically updating finding status. Security teams immediately see what's new, what regressed after a claimed fix, and which findings have been open the longest — without manually comparing JSON output between scan cycles.

When running open-source DAST at scale across a portfolio: An organization scanning 20+ web applications with Arachni uses DefectDojo to aggregate results across all applications. Security leadership gets a portfolio-level dashboard showing total open High and Critical DAST findings, SLA compliance rates, and which applications have the most unresolved vulnerability debt — enabling resource prioritization that isn't possible when findings live in individual scan report files.

During penetration test augmentation: Security engineers use Arachni to augment manual penetration testing — running automated scans to baseline coverage before deeper manual testing begins. Arachni findings import into DefectDojo alongside manual findings from the pen test engagement, giving reviewers a combined view of automated and manual DAST results in a single tracked record rather than two separate artifacts.

Operational Tips

• Save the .afr file before converting to JSON or XML: Arachni's native .afr format retains full scan data including session state and browser interaction logs. Keep the .afr file as an artifact alongside the imported JSON — it allows re-reporting in different formats or re-examining scan behavior if a finding needs deeper investigation.
• Use authenticated scans wherever possible: Unauthenticated Arachni scans miss vulnerabilities behind login flows, which are often the most sensitive parts of an application. Configuring session cookie or form-based authentication significantly improves coverage and reduces the risk of security decisions based on incomplete scan data.
• Scope scans deliberately to avoid crawler sprawl: Arachni's crawler can follow links outside the intended target scope if not configured carefully, resulting in scan data that includes unrelated endpoints and inflated finding counts in DefectDojo. Always set explicit scope constraints (--scope-include-pattern, --scope-exclude-pattern) before running scans that feed into a tracked engagement.
• Create one engagement per application per scan cycle: A naming convention like Arachni DAST - Q2 2025 - <App Name> keeps engagement history organized and makes it straightforward to compare findings across quarters without ambiguity about which scan record corresponds to which period.
• Mark Informational findings inactive on import: Arachni's Informational findings cover items like cookie attribute observations and server banner disclosure that are rarely actionable as standalone vulnerabilities. Importing them as inactive in DefectDojo keeps your active queue focused on real risk while preserving the data for completeness.
• Correlate Arachni findings with SAST results in DefectDojo: DAST findings that correspond to SAST findings in the same application — for example, an XSS confirmed by Arachni that was also flagged by a code scanner — can be linked in DefectDojo. This correlation strengthens the case for prioritization and provides richer evidence for the remediation ticket.
• Document false positives during triage, not after the next scan: DAST false positives are easier to document while the scan context is fresh. Building a habit of marking and annotating false positives in DefectDojo immediately after triage — rather than at the next reimport — prevents the same finding from entering the triage queue repeatedly and keeps your active finding counts accurate.