Lab Report: Arachni Web Application Scan

By Aaron M. Haze • November 2, 2026 • CIS 2121 Cybersecurity Analysis

Jump to: Overview | What I Did | Results | Takeaway | Skills

I used the Arachni 1.5.1 web application scanner to test a web server two ways, from the command line and from Arachni's web interface, then turned both scans into HTML reports. Both reports came back clean, but only because the target never answered, and finding that out was the most useful part of the lab.

Overview

Course: CIS 2121 Cybersecurity Analysis, State College of Florida, Fall 2026
Lab: Cengage Virtual Lab 9-2, Guided: Using the Arachni Web Application Scanner
Scenario: as an analyst for Hexelo, a company in the lab scenario, confirm that its web server is configured securely
Target: the web server at 192.168.1.37

Lab network

Win10-Admin, 192.168.1.10: Scanning workstation running Arachni 1.5.1 and its web interface, WebUI 0.5.12
GSM, 192.168.1.12: Greenbone Security Manager (Greenbone OS 21.04.4)
Win10-DVWA, 192.168.1.13: Windows 10 lab host
Kali and WS2003: A Kali Linux machine and a Windows Server 2003 machine, also on the lab network

What I Did

I ran the same target through both Arachni interfaces and saved each scan as an Arachni Framework Report (.afr) file.

On Win10-Admin, opened Command Prompt, changed to the Arachni bin folder, and started arachni_shell.bat.
Ran the command-line scan and saved its report: arachni http://192.168.1.37 --report-save-path D:\LabFiles\Reports\ArachniCMD.afr
Allowed PhantomJS, the headless browser Arachni uses to render pages, through Windows Defender Firewall when prompted.
Started the web interface with arachni_web.bat, which serves it on http://localhost:9292 with up to 16 threads.
Signed in to the web interface, started a scan of http://192.168.1.37, and downloaded the finished report as an .afr file.
Stopped the web service with Ctrl+C, then converted both reports to HTML with arachni_reporter <report>.afr --report=html:outfile=D:\LabFiles\Reports\ArachniCMD.zip (and ArachniWEB.zip for the web scan).
Extracted both zip files and reviewed each report's summary page in Edge.

Results

Both reports said “No issues have been identified,” and all seven of the lab's automated checks passed.

Command-line scan: ran for 1 minute 29 seconds and processed 12 HTTP requests. All 12 timed out, and Arachni logged errors for the scan.
Web interface scan: finished with logged errors and saved its report as 192_168_1_37 - Default - 1.afr.
HTML reports: ArachniCMD.zip and ArachniWEB.zip in D:\LabFiles\Reports, each opening to a summary page for http://192.168.1.37/.

Troubleshooting and Takeaway

The clean reports did not mean the server was secure: the target never answered, so Arachni had nothing to test.

The 12 timed-out requests were the first clue. A ping to 192.168.1.37 from Win10-Admin returned “Destination host unreachable.” I then checked the other lab machines with ipconfig. Win10-DVWA was 192.168.1.13 and GSM was 192.168.1.12, so neither was the target.

The lesson

A scanner reporting zero issues against a host it cannot reach is a gap in coverage, not a clean bill of health. Before trusting a result, I now check three things:

the target answers before the scan starts (ping, or loading the URL in a browser)
the report's timed-out request count and the scanner's error log
a rescan once the host is reachable, before calling the server secure

Skills Demonstrated

Running a web application vulnerability scanner (Arachni) from both the command line and a web interface
Saving, converting, and reading scan reports: .afr files exported to HTML with arachni_reporter
Windows command line and PowerShell, including Expand-Archive to unpack reports
Network troubleshooting with ping and ipconfig across lab machines
Reading scanner output critically: timeouts, error logs, and the difference between “no findings” and “no problems”

See my resume and academic transcript for the rest of my coursework.