{"action":"created","issue":{"url":"https://api.github.com/repos/Arachni/arachni/issues/780","repository_url":"https://api.github.com/repos/Arachni/arachni","labels_url":"https://api.github.com/repos/Arachni/arachni/issues/780/labels{/name}","comments_url":"https://api.github.com/repos/Arachni/arachni/issues/780/comments","events_url":"https://api.github.com/repos/Arachni/arachni/issues/780/events","html_url":"https://github.com/Arachni/arachni/issues/780","id":179945872,"number":780,"title":"Arachni nightlies crawl problem","user":{"login":"blinking-yan","id":17590163,"avatar_url":"https://avatars.githubusercontent.com/u/17590163?v=3","gravatar_id":"","url":"https://api.github.com/users/blinking-yan","html_url":"https://github.com/blinking-yan","followers_url":"https://api.github.com/users/blinking-yan/followers","following_url":"https://api.github.com/users/blinking-yan/following{/other_user}","gists_url":"https://api.github.com/users/blinking-yan/gists{/gist_id}","starred_url":"https://api.github.com/users/blinking-yan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blinking-yan/subscriptions","organizations_url":"https://api.github.com/users/blinking-yan/orgs","repos_url":"https://api.github.com/users/blinking-yan/repos","events_url":"https://api.github.com/users/blinking-yan/events{/privacy}","received_events_url":"https://api.github.com/users/blinking-yan/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-09-29T03:43:52Z","updated_at":"2016-10-11T08:45:16Z","closed_at":null,"body":"I use Arachni [nightlies](http://downloads.arachni-scanner.com/nightlies/) REST API to scan DVWA 1.9 XSS vulnerability.\r\n\r\nthat's my scan configuration.\r\n\r\n```\r\nPOST  http://172.16.1.111/scans\r\n\r\n{\r\n  \"url\": \"http://172.16.1.112/dvwa/vulnerabilities\",\r\n  \"checks\": [\r\n    \"xss*\"\r\n  ],\r\n  \"audit\": {\r\n    \"links\": true,\r\n    \"forms\": true,\r\n    \"cookies\": false,\r\n    \"headers\": false,\r\n    \"jsons\": true,\r\n    \"xmls\": true,\r\n    \"ui_inputs\": true,\r\n    \"ui_forms\": true\r\n  },\r\n  \"scope\": {\r\n    \"exclude_path_patterns\": [\r\n      \"logout\",\r\n      \"security\",\r\n      \"login\",\r\n      \"setup\"\r\n    ]\r\n  },\r\n  \"http\": {\r\n    \"cookies\": {\r\n      \"security\": \"low\",\r\n      \"PHPSESSID\": \"d9lg9j3baj27r8tv3faug2nti6\"\r\n    }\r\n  }\r\n}\r\n```\r\n\r\nI set cookies manually and  also set `exclude_path_patterns`  in order to keep the session valid during the scan. \r\n\r\nthe scan report (json):\r\n\r\n```\r\n\r\n{\r\n  \"version\" : \"2.0dev\",\r\n  \"seed\" : \"78f2e978261faf552e2fcd47a1dab989\",\r\n  \"options\" : {\r\n    \"session\" : {},\r\n    \"http\" : {\r\n      \"user_agent\" : \"Arachni/v2.0dev\",\r\n      \"request_timeout\" : 10000,\r\n      \"request_redirect_limit\" : 5,\r\n      \"request_concurrency\" : 20,\r\n      \"request_queue_size\" : 100,\r\n      \"request_headers\" : {},\r\n      \"response_max_size\" : 500000,\r\n      \"cookies\" : {\r\n        \"security\" : \"low\",\r\n        \"PHPSESSID\" : \"d9lg9j3baj27r8tv3faug2nti6\"\r\n      },\r\n      \"authentication_type\" : \"auto\"\r\n    },\r\n    \"input\" : {\r\n      \"values\" : {},\r\n      \"default_values\" : {\r\n        \"name\" : \"arachni_name\",\r\n        \"user\" : \"arachni_user\",\r\n        \"usr\" : \"arachni_user\",\r\n        \"pass\" : \"5543!%arachni_secret\",\r\n        \"txt\" : \"arachni_text\",\r\n        \"num\" : \"132\",\r\n        \"amount\" : \"100\",\r\n        \"mail\" : \"arachni@email.gr\",\r\n        \"account\" : \"12\",\r\n        \"id\" : \"1\"\r\n      },\r\n      \"without_defaults\" : false,\r\n      \"force\" : false\r\n    },\r\n    \"scope\" : {\r\n      \"redundant_path_patterns\" : {},\r\n      \"dom_depth_limit\" : 5,\r\n      \"exclude_file_extensions\" : [],\r\n      \"exclude_path_patterns\" : [\r\n        \"logout\",\r\n        \"security\",\r\n        \"login\",\r\n        \"setup\"\r\n      ],\r\n      \"exclude_content_patterns\" : [],\r\n      \"include_path_patterns\" : [],\r\n      \"restrict_paths\" : [],\r\n      \"extend_paths\" : [],\r\n      \"url_rewrites\" : {}\r\n    },\r\n    \"datastore\" : {\r\n      \"report_path\" : null,\r\n      \"token\" : \"6705633931ca668bae835323a0f4c949\"\r\n    },\r\n    \"browser_cluster\" : {\r\n      \"local_storage\" : {},\r\n      \"wait_for_elements\" : {},\r\n      \"pool_size\" : 6,\r\n      \"job_timeout\" : 10,\r\n      \"worker_time_to_live\" : 100,\r\n      \"ignore_images\" : false,\r\n      \"screen_width\" : 1600,\r\n      \"screen_height\" : 1200\r\n    },\r\n    \"audit\" : {\r\n      \"parameter_values\" : true,\r\n      \"exclude_vector_patterns\" : [],\r\n      \"include_vector_patterns\" : [],\r\n      \"link_templates\" : [],\r\n      \"links\" : true,\r\n      \"forms\" : true,\r\n      \"cookies\" : false,\r\n      \"headers\" : false,\r\n      \"jsons\" : true,\r\n      \"xmls\" : true,\r\n      \"ui_inputs\" : true,\r\n      \"ui_forms\" : true\r\n    },\r\n    \"checks\" : [\r\n      \"xss_tag\",\r\n      \"xss_dom\",\r\n      \"xss_path\",\r\n      \"xss_script_context\",\r\n      \"xss_event\",\r\n      \"xss\",\r\n      \"xss_dom_script_context\"\r\n    ],\r\n    \"platforms\" : [],\r\n    \"plugins\" : {},\r\n    \"no_fingerprinting\" : false,\r\n    \"authorized_by\" : null,\r\n    \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities\"\r\n  },\r\n  \"sitemap\" : {\r\n    \"http://172.16.1.112/dvwa/vulnerabilities\" : 301,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/\" : 200,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/?C=N;O=D\" : 200,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/?C=S;O=A\" : 200,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/?C=D;O=A\" : 200,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/?C=M;O=A\" : 200,\r\n    \"http://172.16.1.112/dvwa/\" : 302,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/brute/\" : 200,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/captcha/\" : 200,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/csrf/\" : 200,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/exec/\" : 200,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/fi/\" : 302,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/sqli/\" : 200,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/view_source.php\" : 302,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\" : 302,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/xss_s/\" : 302,\r\n    \"http://172.16.1.112/dvwa/dvwa/css/main.css\" : 200,\r\n    \"http://172.16.1.112/dvwa/favicon.ico\" : 200,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/sqli_blind/\" : 302,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/upload/\" : 302,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/view_help.php\" : 302,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/view_source_all.php\" : 302,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/fi/?page=include.php\" : 302,\r\n    \"http://172.16.1.112/dvwa/dvwa/js/dvwaPage.js\" : 200,\r\n    \"http://172.16.1.112/dvwa/phpinfo.php\" : 302,\r\n    \"http://172.16.1.112/dvwa/about.php\" : 200,\r\n    \"http://172.16.1.112/dvwa/instructions.php\" : 200,\r\n    \"http://172.16.1.112/dvwa/instructions.php?doc=PHPIDS-license\" : 200,\r\n    \"http://172.16.1.112/dvwa/docs/DVWA_v1.3.pdf\" : 200,\r\n    \"http://172.16.1.112/dvwa/instructions.php?doc=readme\" : 200,\r\n    \"http://172.16.1.112/dvwa/instructions.php?doc=PDF\" : 200,\r\n    \"http://172.16.1.112/dvwa/instructions.php?doc=changelog\" : 200,\r\n    \"http://172.16.1.112/dvwa/instructions.php?doc=copying\" : 200\r\n  },\r\n  \"start_datetime\" : \"2016-09-29 10:50:28 +0800\",\r\n  \"finish_datetime\" : \"2016-09-29 10:50:44 +0800\",\r\n  \"delta_time\" : \"00:00:16\",\r\n  \"issues\" : [],\r\n  \"plugins\" : {}\r\n}\r\n```\r\n\r\nThe report shows there are not any issues.  But it's not correct. I'm confirmed that following urls are vulnerable to XSS.\r\n\r\n```\r\nhttp://172.16.1.112/dvwa/vulnerabilities/xss_r/\r\nhttp://172.16.1.112/dvwa/vulnerabilities/xss_s/\r\n```\r\n\r\nAnd i also notice some strange part in sitemap. The response code is 302 while it's 200 if i access the page directly.\r\n\r\n```\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\" : 302,\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/xss_s/\" : 302,\r\n```\r\n\r\n![image](https://cloud.githubusercontent.com/assets/17590163/18939927/d485f452-8636-11e6-96b3-725ce4fa50c7.png)\r\n\r\nAnd then i scan one of the urls to check if Arachni can find XSS.\r\n\r\nscan configuration, there i set `page_limit` to 1.\r\n\r\n```\r\nPOST  http://172.16.1.111/scans\r\n\r\n{\r\n  \"url\": \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\",\r\n  \"checks\": [\r\n    \"xss*\"\r\n  ],\r\n  \"audit\": {\r\n    \"links\": true,\r\n    \"forms\": true,\r\n    \"cookies\": false,\r\n    \"headers\": false,\r\n    \"jsons\": true,\r\n    \"xmls\": true,\r\n    \"ui_inputs\": true,\r\n    \"ui_forms\": true\r\n  },\r\n  \"scope\": {\r\n  \t\"page_limit\": 1,\r\n  \t\"exclude_path_patterns\": [\"logout\", \"security\", \"login\", \"setup\"]\r\n  },\r\n  \"http\": {\r\n    \"cookies\": {\r\n      \"security\": \"low\",\r\n      \"PHPSESSID\": \"d9lg9j3baj27r8tv3faug2nti6\"\r\n    }\r\n  }\r\n}\r\n```\r\n\r\nscan report (i delete something to make report more readable ):\r\n\r\n```\r\n\r\n{\r\n  \"version\" : \"2.0dev\",\r\n  \"seed\" : \"654371aeb2ecfcccdf64450ddf74f6d8\",\r\n  \"options\" : {\r\n    \"session\" : {},\r\n    \"http\" : {\r\n      \"user_agent\" : \"Arachni/v2.0dev\",\r\n      \"request_timeout\" : 10000,\r\n      \"request_redirect_limit\" : 5,\r\n      \"request_concurrency\" : 20,\r\n      \"request_queue_size\" : 100,\r\n      \"request_headers\" : {},\r\n      \"response_max_size\" : 500000,\r\n      \"cookies\" : {\r\n        \"security\" : \"low\",\r\n        \"PHPSESSID\" : \"d9lg9j3baj27r8tv3faug2nti6\"\r\n      },\r\n      \"authentication_type\" : \"auto\"\r\n    },\r\n    \"input\" : {\r\n      \"values\" : {},\r\n      \"default_values\" : {\r\n        \"name\" : \"arachni_name\",\r\n        \"user\" : \"arachni_user\",\r\n        \"usr\" : \"arachni_user\",\r\n        \"pass\" : \"5543!%arachni_secret\",\r\n        \"txt\" : \"arachni_text\",\r\n        \"num\" : \"132\",\r\n        \"amount\" : \"100\",\r\n        \"mail\" : \"arachni@email.gr\",\r\n        \"account\" : \"12\",\r\n        \"id\" : \"1\"\r\n      },\r\n      \"without_defaults\" : false,\r\n      \"force\" : false\r\n    },\r\n    \"scope\" : {\r\n      \"redundant_path_patterns\" : {},\r\n      \"dom_depth_limit\" : 5,\r\n      \"exclude_file_extensions\" : [],\r\n      \"exclude_path_patterns\" : [\r\n        \"logout\",\r\n        \"security\",\r\n        \"login\",\r\n        \"setup\"\r\n      ],\r\n      \"exclude_content_patterns\" : [],\r\n      \"include_path_patterns\" : [],\r\n      \"restrict_paths\" : [],\r\n      \"extend_paths\" : [],\r\n      \"url_rewrites\" : {},\r\n      \"page_limit\" : 1\r\n    },\r\n    \"datastore\" : {\r\n      \"report_path\" : null,\r\n      \"token\" : \"45b78c8c3a7ebca90127a7fdef17fbac\"\r\n    },\r\n    \"browser_cluster\" : {\r\n      \"local_storage\" : {},\r\n      \"wait_for_elements\" : {},\r\n      \"pool_size\" : 6,\r\n      \"job_timeout\" : 10,\r\n      \"worker_time_to_live\" : 100,\r\n      \"ignore_images\" : false,\r\n      \"screen_width\" : 1600,\r\n      \"screen_height\" : 1200\r\n    },\r\n    \"audit\" : {\r\n      \"parameter_values\" : true,\r\n      \"exclude_vector_patterns\" : [],\r\n      \"include_vector_patterns\" : [],\r\n      \"link_templates\" : [],\r\n      \"links\" : true,\r\n      \"forms\" : true,\r\n      \"cookies\" : false,\r\n      \"headers\" : false,\r\n      \"jsons\" : true,\r\n      \"xmls\" : true,\r\n      \"ui_inputs\" : true,\r\n      \"ui_forms\" : true\r\n    },\r\n    \"checks\" : [\r\n      \"xss_tag\",\r\n      \"xss_dom\",\r\n      \"xss_path\",\r\n      \"xss_script_context\",\r\n      \"xss_event\",\r\n      \"xss\",\r\n      \"xss_dom_script_context\"\r\n    ],\r\n    \"platforms\" : [],\r\n    \"plugins\" : {},\r\n    \"no_fingerprinting\" : false,\r\n    \"authorized_by\" : null,\r\n    \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\"\r\n  },\r\n  \"sitemap\" : {\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\" : 200\r\n  },\r\n  \"start_datetime\" : \"2016-09-29 11:26:06 +0800\",\r\n  \"finish_datetime\" : \"2016-09-29 11:26:17 +0800\",\r\n  \"delta_time\" : \"00:00:10\",\r\n  \"issues\" : [\r\n    {\r\n      \"name\" : \"Cross-Site Scripting (XSS) in script context\",\r\n      \"description\" : \"...\",\r\n      \"references\" : {\r\n      },\r\n      \"tags\" : [\r\n        \"xss\",\r\n        \"script\",\r\n        \"dom\",\r\n        \"injection\"\r\n      ],\r\n      \"cwe\" : 79,\r\n      \"severity\" : \"high\",\r\n      \"remedy_guidance\" : \"...\",\r\n      \"check\" : {\r\n        \"name\" : \"XSS in script context\",\r\n        \"description\" : \"\\nInjects JS taint code and check to see if it gets executed as proof of vulnerability.\\n\",\r\n        \"elements\" : [\r\n          \"form\",\r\n          \"link\",\r\n          \"cookie\",\r\n          \"header\",\r\n          \"link_template\"\r\n        ],\r\n        \"author\" : \"Tasos \\\"Zapotek\\\" Laskos <tasos.laskos@arachni-scanner.com> \",\r\n        \"version\" : \"0.2.5\",\r\n        \"shortname\" : \"xss_script_context\"\r\n      },\r\n      \"vector\" : {\r\n        \"class\" : \"Arachni::Element::Form\",\r\n        \"type\" : \"form\",\r\n        \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\",\r\n        \"source\" : \"<form name=\\\"XSS\\\" action=\\\"#\\\" method=\\\"GET\\\">\\n  <input type=\\\"text\\\" name=\\\"name\\\">\\n  </input>\\n  <input type=\\\"submit\\\" value=\\\"Submit\\\">\\n  </input>\\n</form>\",\r\n        \"inputs\" : {\r\n          \"name\" : \"</script><script>window.top._arachni_js_namespace_taint_tracer.log_execution_flow_sink()</script>\"\r\n        },\r\n        \"raw_inputs\" : [],\r\n        \"default_inputs\" : {\r\n          \"name\" : \"\"\r\n        },\r\n        \"action\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\",\r\n        \"method\" : \"get\",\r\n        \"affected_input_name\" : \"name\",\r\n        \"affected_input_value\" : \"</script><script>window.top._arachni_js_namespace_taint_tracer.log_execution_flow_sink()</script>\",\r\n        \"seed\" : \"</script><script>window.top._arachni_js_namespace_taint_tracer.log_execution_flow_sink()</script>\"\r\n      },\r\n      \"proof\" : \"</script><script>window.top._arachni_js_namespace_taint_tracer.log_execution_flow_sink()</script>\",\r\n      \"referring_page\" : {\r\n        \"body\" : \"...\",\r\n        \"dom\" : {\r\n          \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\",\r\n          \"transitions\" : [],\r\n          \"digest\" : null,\r\n          \"data_flow_sinks\" : [],\r\n          \"execution_flow_sinks\" : []\r\n        }\r\n      },\r\n      \"platform_name\" : null,\r\n      \"platform_type\" : null,\r\n      \"page\" : {\r\n        \"body\" : \"...\",\r\n        \"dom\" : {\r\n          \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/?name=%3C/script%3E%3Cscript%3Ewindow.top._arachni_js_namespace_taint_tracer.log_execution_flow_sink()%3C/script%3E\",\r\n          \"transitions\" : [\r\n            {\r\n              \"element\" : \"page\",\r\n              \"event\" : \"load\",\r\n              \"options\" : {\r\n                \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/?name=%3C/script%3E%3Cscript%3Ewindow.top._arachni_js_namespace_taint_tracer.log_execution_flow_sink()%3C/script%3E\",\r\n                \"cookies\" : {}\r\n              },\r\n              \"time\" : 0.462338063\r\n            },\r\n            {\r\n              \"element\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/?name=%3C/script%3E%3Cscript%3Ewindow.top._arachni_js_namespace_taint_tracer.log_execution_flow_sink()%3C/script%3E\",\r\n              \"event\" : \"request\",\r\n              \"options\" : {},\r\n              \"time\" : 0.100021394\r\n            }\r\n          ],\r\n          \"digest\" : null,\r\n          \"data_flow_sinks\" : [],\r\n          \"execution_flow_sinks\" : [\r\n            {\r\n              \"data\" : [],\r\n              \"trace\" : [\r\n                {\r\n                  \"function\" : {\r\n                    \"name\" : \"global code\"\r\n                  },\r\n                  \"line\" : 93,\r\n                  \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/?name=%3C/script%3E%3Cscript%3Ewindow.top._arachni_js_namespace_taint_tracer.log_execution_flow_sink()%3C/script%3E\"\r\n                }\r\n              ]\r\n            }\r\n          ]\r\n        }\r\n      },\r\n      \"remarks\" : {},\r\n      \"trusted\" : true,\r\n      \"cwe_url\" : \"http://cwe.mitre.org/data/definitions/79.html\",\r\n      \"digest\" : 733435024,\r\n      \"response\" : {\r\n        \"headers\" : {\r\n          \"Date\" : \"Thu, 29 Sep 2016 03:26:09 GMT\",\r\n          \"Server\" : \"Apache/2.4.23 (Unix) OpenSSL/1.0.2h PHP/5.6.24 mod_perl/2.0.8-dev Perl/v5.16.3\",\r\n          \"X-Powered-By\" : \"PHP/5.6.24\",\r\n          \"Expires\" : \"Tue, 23 Jun 2009 12:00:00 GMT\",\r\n          \"Cache-Control\" : \"no-cache, must-revalidate\",\r\n          \"Pragma\" : \"no-cache\",\r\n          \"Content-Length\" : \"6812\",\r\n          \"Content-Type\" : \"text/html;charset=utf-8\"\r\n        },\r\n        \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/?name=%3C/script%3E%3Cscript%3Ewindow.top._arachni_js_namespace_taint_tracer.log_execution_flow_sink()%3C/script%3E\",\r\n        \"code\" : 200,\r\n        \"ip_address\" : \"172.16.1.112\",\r\n        \"headers_string\" : \"HTTP/1.1 200 OK\\r\\nDate: Thu, 29 Sep 2016 03:26:09 GMT\\r\\nServer: Apache/2.4.23 (Unix) OpenSSL/1.0.2h PHP/5.6.24 mod_perl/2.0.8-dev Perl/v5.16.3\\r\\nX-Powered-By: PHP/5.6.24\\r\\nExpires: Tue, 23 Jun 2009 12:00:00 GMT\\r\\nCache-Control: no-cache, must-revalidate\\r\\nPragma: no-cache\\r\\nContent-Length: 5064\\r\\nContent-Type: text/html;charset=utf-8\\r\\n\\r\\n\",\r\n        \"body\" : \"...\",\r\n        \"time\" : 0.004459,\r\n        \"total_time\" : 0.004459,\r\n        \"return_code\" : \"ok\",\r\n        \"return_message\" : \"No error\"\r\n      },\r\n      \"request\" : {\r\n        \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/?name=%3C/script%3E%3Cscript%3Ewindow.top._arachni_js_namespace_taint_tracer.log_execution_flow_sink()%3C/script%3E\",\r\n        \"parameters\" : {},\r\n        \"headers\" : {\r\n          \"Accept\" : \"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\r\n          \"User-Agent\" : \"Mozilla/5.0 AppleWebKit/538.1 (KHTML, like Gecko) Arachni/2.0dev Safari/538.1\",\r\n          \"Cookie\" : \"security=low; PHPSESSID=d9lg9j3baj27r8tv3faug2nti6\",\r\n          \"Accept-Language\" : \"zh-CN,en,*\",\r\n          \"Host\" : \"172.16.1.112\"\r\n        },\r\n        \"headers_string\" : null,\r\n        \"effective_body\" : null,\r\n        \"body\" : \"\",\r\n        \"method\" : \"get\"\r\n      }\r\n    },\r\n    {\r\n      \"name\" : \"Cross-Site Scripting (XSS)\",\r\n      \"description\" : \"...\",\r\n      \"references\" : {\r\n      },\r\n      \"tags\" : [\r\n        \"xss\",\r\n        \"regexp\",\r\n        \"injection\",\r\n        \"script\"\r\n      ],\r\n      \"cwe\" : 79,\r\n      \"severity\" : \"high\",\r\n      \"remedy_guidance\" : \"...\",\r\n      \"check\" : {\r\n        \"name\" : \"XSS\",\r\n        \"description\" : \"\\nInjects an HTML element into page inputs and then parses the HTML markup of\\ntainted responses to look for proof of vulnerability.\\n\",\r\n        \"elements\" : [\r\n          \"form\",\r\n          \"link\",\r\n          \"cookie\",\r\n          \"header\",\r\n          \"link_template\"\r\n        ],\r\n        \"author\" : \"Tasos \\\"Zapotek\\\" Laskos <tasos.laskos@arachni-scanner.com> \",\r\n        \"version\" : \"0.4.9\",\r\n        \"shortname\" : \"xss\"\r\n      },\r\n      \"vector\" : {\r\n        \"class\" : \"Arachni::Element::Form\",\r\n        \"type\" : \"form\",\r\n        \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\",\r\n        \"source\" : \"<form name=\\\"XSS\\\" action=\\\"#\\\" method=\\\"GET\\\">\\n  <input type=\\\"text\\\" name=\\\"name\\\">\\n  </input>\\n  <input type=\\\"submit\\\" value=\\\"Submit\\\">\\n  </input>\\n</form>\",\r\n        \"inputs\" : {\r\n          \"name\" : \"arachni_name<xss_654371aeb2ecfcccdf64450ddf74f6d8/>\"\r\n        },\r\n        \"raw_inputs\" : [],\r\n        \"default_inputs\" : {\r\n          \"name\" : \"\"\r\n        },\r\n        \"action\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\",\r\n        \"method\" : \"get\",\r\n        \"affected_input_name\" : \"name\",\r\n        \"affected_input_value\" : \"arachni_name<xss_654371aeb2ecfcccdf64450ddf74f6d8/>\",\r\n        \"seed\" : \"<xss_654371aeb2ecfcccdf64450ddf74f6d8/>\"\r\n      },\r\n      \"proof\" : \"<xss_654371aeb2ecfcccdf64450ddf74f6d8/>\",\r\n      \"referring_page\" : {\r\n        \"body\" : \"...\",\r\n        \"dom\" : {\r\n          \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\",\r\n          \"transitions\" : [],\r\n          \"digest\" : null,\r\n          \"data_flow_sinks\" : [],\r\n          \"execution_flow_sinks\" : []\r\n        }\r\n      },\r\n      \"platform_name\" : null,\r\n      \"platform_type\" : null,\r\n      \"page\" : {\r\n        \"body\" : \"...\",\r\n        \"dom\" : {\r\n          \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/?name=arachni_name%3Cxss_654371aeb2ecfcccdf64450ddf74f6d8/%3E\",\r\n          \"transitions\" : [],\r\n          \"digest\" : null,\r\n          \"data_flow_sinks\" : [],\r\n          \"execution_flow_sinks\" : []\r\n        }\r\n      },\r\n      \"remarks\" : {},\r\n      \"trusted\" : true,\r\n      \"cwe_url\" : \"http://cwe.mitre.org/data/definitions/79.html\",\r\n      \"digest\" : 3432277987,\r\n      \"response\" : {\r\n        \"headers\" : {\r\n          \"Date\" : \"Thu, 29 Sep 2016 03:26:09 GMT\",\r\n          \"Server\" : \"Apache/2.4.23 (Unix) OpenSSL/1.0.2h PHP/5.6.24 mod_perl/2.0.8-dev Perl/v5.16.3\",\r\n          \"X-Powered-By\" : \"PHP/5.6.24\",\r\n          \"Expires\" : \"Tue, 23 Jun 2009 12:00:00 GMT\",\r\n          \"Cache-Control\" : \"no-cache, must-revalidate\",\r\n          \"Pragma\" : \"no-cache\",\r\n          \"Content-Length\" : \"5018\",\r\n          \"Content-Type\" : \"text/html;charset=utf-8\"\r\n        },\r\n        \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/?name=arachni_name%3Cxss_654371aeb2ecfcccdf64450ddf74f6d8/%3E\",\r\n        \"code\" : 200,\r\n        \"ip_address\" : \"172.16.1.112\",\r\n        \"headers_string\" : \"HTTP/1.1 200 OK\\r\\nDate: Thu, 29 Sep 2016 03:26:09 GMT\\r\\nServer: Apache/2.4.23 (Unix) OpenSSL/1.0.2h PHP/5.6.24 mod_perl/2.0.8-dev Perl/v5.16.3\\r\\nX-Powered-By: PHP/5.6.24\\r\\nExpires: Tue, 23 Jun 2009 12:00:00 GMT\\r\\nCache-Control: no-cache, must-revalidate\\r\\nPragma: no-cache\\r\\nContent-Length: 5018\\r\\nContent-Type: text/html;charset=utf-8\\r\\n\\r\\n\",\r\n        \"body\" : \"...\",\r\n        \"time\" : 0.004533,\r\n        \"app_time\" : 0.004164,\r\n        \"total_time\" : 0.004533,\r\n        \"return_code\" : \"ok\",\r\n        \"return_message\" : \"No error\"\r\n      },\r\n      \"request\" : {\r\n        \"url\" : \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\",\r\n        \"parameters\" : {\r\n          \"name\" : \"arachni_name<xss_654371aeb2ecfcccdf64450ddf74f6d8/>\"\r\n        },\r\n        \"headers\" : {\r\n          \"Accept\" : \"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\r\n          \"User-Agent\" : \"Arachni/v2.0dev\",\r\n          \"Accept-Language\" : \"en-US,en;q=0.8,he;q=0.6\",\r\n          \"X-Arachni-Scan-Seed\" : \"654371aeb2ecfcccdf64450ddf74f6d8\",\r\n          \"Cookie\" : \"security=low;PHPSESSID=d9lg9j3baj27r8tv3faug2nti6\"\r\n        },\r\n        \"headers_string\" : \"GET /dvwa/vulnerabilities/xss_r/?name=arachni_name%3Cxss_654371aeb2ecfcccdf64450ddf74f6d8%2F%3E HTTP/1.1\\r\\nHost: 172.16.1.112\\r\\nAccept-Encoding: gzip, deflate\\r\\nUser-Agent: Arachni/v2.0dev\\r\\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.8,he;q=0.6\\r\\nX-Arachni-Scan-Seed: 654371aeb2ecfcccdf64450ddf74f6d8\\r\\nCookie: security=low;PHPSESSID=d9lg9j3baj27r8tv3faug2nti6\\r\\n\\r\\n\",\r\n        \"effective_body\" : null,\r\n        \"body\" : null,\r\n        \"method\" : \"get\"\r\n      }\r\n    }\r\n  ],\r\n  \"plugins\" : {}\r\n}\r\n```\r\n\r\nIt shows there are two XSS issues.   And url's response code is  200 in sitemap.\r\n\r\n```\r\n  \"sitemap\" : {\r\n    \"http://172.16.1.112/dvwa/vulnerabilities/xss_r/\" : 200\r\n  }\r\n```\r\n\r\nSo why the response code is different (302 vs 200) with the same url , and why Arachni can not find XSS in crawl way?\r\n \r\nIs there something wrong while Arachni crawling the page?\r\n\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/Arachni/arachni/issues/comments/252849606","html_url":"https://github.com/Arachni/arachni/issues/780#issuecomment-252849606","issue_url":"https://api.github.com/repos/Arachni/arachni/issues/780","id":252849606,"user":{"login":"blinking-yan","id":17590163,"avatar_url":"https://avatars.githubusercontent.com/u/17590163?v=3","gravatar_id":"","url":"https://api.github.com/users/blinking-yan","html_url":"https://github.com/blinking-yan","followers_url":"https://api.github.com/users/blinking-yan/followers","following_url":"https://api.github.com/users/blinking-yan/following{/other_user}","gists_url":"https://api.github.com/users/blinking-yan/gists{/gist_id}","starred_url":"https://api.github.com/users/blinking-yan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blinking-yan/subscriptions","organizations_url":"https://api.github.com/users/blinking-yan/orgs","repos_url":"https://api.github.com/users/blinking-yan/repos","events_url":"https://api.github.com/users/blinking-yan/events{/privacy}","received_events_url":"https://api.github.com/users/blinking-yan/received_events","type":"User","site_admin":false},"created_at":"2016-10-11T08:45:16Z","updated_at":"2016-10-11T08:45:16Z","body":"The [online DVWA](http://54.153.86.200:18888/) is up.\r\n\r\nUsername and password is `admin/password`"}}
{"actor":{"display_login":"blinking-yan"}}