Arachni Integration with DefectDojo

Arachni Integration with DefectDojo

Arachni is a Ruby-based web application security scanner framework written by Tasos Laskos. It crawls a target site, runs checks for issues such as injection flaws, cross-site scripting, file inclusion, and insecure configuration, and records the HTTP request and response behind each issue. Scans save to Arachni's native AFR (Arachni Framework Report) format, which the arachni_reporter tool converts to JSON for DefectDojo. The project has since been archived, and its repository describes Arachni as obsolete and points users to a successor from Ecsypno.

Arachni Integration with DefectDojo

Plenty of teams still have Arachni wired into older pipelines and scheduled jobs, and ours was one of them. Arachni's JSON output is detailed, but nobody wanted to read a fresh copy after every run to figure out what changed. Importing Arachni reports into DefectDojo gives each issue type a single Finding on the application's Asset, with every affected URL attached and the request and response kept as evidence. Repeat scans update that record, and the findings live alongside results from whatever tools we add or replace Arachni with later.

Why Arachni Matters

Dynamic testing finds what static analysis can't: how the deployed application responds to hostile input.

• Arachni tests the running application over HTTP, covering server behavior, client-side code, and configuration.
• Each issue includes the request and response that triggered it, plus CWE classification, remediation guidance, and reference links.
• Arachni tags issues with descriptive keywords (for example sql, injection, database), which helps when filtering.
• Because the project is archived, results from existing Arachni scans may need to coexist with findings from a replacement scanner. Keeping both in one platform makes that transition traceable.

Advantages of This Integration

What we gained by sending Arachni results through DefectDojo:

• Grouped issues. The parser merges issues with the same name and severity into one Finding, attaches every affected URL as an endpoint, and counts occurrences, so one weakness across many pages is tracked once.
• Evidence for developers. Request and response pairs from each occurrence are stored with the Finding, including the response body.
• Lifecycle across scans. Reimporting a new report into the same Test mitigates issues that disappeared and reactivates any that return.
• Arachni's tags carried over. Issue tags become DefectDojo tags, so findings can be filtered by class without custom queries.
• A clean path off a retired tool. When the team moves to another DAST scanner, Arachni history stays on the same Asset, and new scanner findings can be compared against it.

How This Integration Works

DefectDojo imports Arachni output with the Arachni Scan scan type, which expects the JSON produced by arachni_reporter.

1. Run a scan and convert the report. Arachni saves an AFR file at the end of a scan. Convert it to JSON with the JSON reporter:

arachni https://staging.example.com --report-save-path=staging.afr
arachni_reporter staging.afr --reporter=json:outfile=staging.json

Arachni passes reporter options after the reporter name, so outfile sets the JSON file name. The parser reads the issues array and uses the report's finish_datetime as the finding date.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select Arachni Scan, and upload the JSON. For automation, use the import API, available in Community Edition and DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=Arachni Scan" \
  -F "file=@staging.json" \
  -F "product_name=intranet-portal" \
  -F "engagement_name=DAST" \
  -F "auto_create_context=true"

DefectDojo Pro users can run the same import with Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "Arachni Scan" \
  --report-path "./staging.json" \
  --product-name "intranet-portal" \
  --engagement-name "DAST" \
  --auto-create-context

3. Reimport on a schedule. Send later reports for the same site to /api/v2/reimport-scan/ against the same Test so fixed issues close automatically.

Data Granularity: What Gets Imported

Arachni Scan has no scan-specific deduplication entry in DefectDojo's settings, so the default (legacy) algorithm applies, comparing those fields and taking endpoints into account.

Use Cases

For legacy scheduled scans: A nightly Arachni job against a staging environment reimports into a stable Test. The team reviews only the overnight changes instead of the full report.

When replacing Arachni: A team moving to a maintained DAST scanner imports both tools' results into the same Asset for a few cycles. Comparing the two sets shows whether the new scanner covers what Arachni found before Arachni is switched off.

For internal applications: Arachni runs from inside the network, so it can reach intranet sites. Importing each site into its owning Asset gives security leads DAST coverage for applications external scanners can't reach.

For remediation follow-up: Because each issue type is one Finding with its URLs listed, a developer can fix the root cause, rescan, and confirm closure when the reimport mitigates the Finding.

Operational Tips

• Plan a replacement. The Arachni project is archived, so its checks will not be updated for new vulnerability classes. Keep importing existing scans while you evaluate alternatives.
• Response bodies are stored as evidence. Large pages make large findings, so consider scan scope if storage is a concern.
• Use one Test per target site and reimport into it, so merged endpoints and status history stay consistent.
• Use Arachni's tags to build filtered views, for example all findings tagged injection across Assets.
• Set minimum_severity=Low to leave informational issues out if they add noise.
• Every Finding gets the impact text "No impact provided". Add impact notes during triage for anything you push to Jira, so the ticket explains why it matters.