Arachni scan

arachni <url> --report-save-path=report.afr

Scans the web application with Arachni, the vulnerability scanner with its own analysis framework and report format.

Run it when you want DAST with Arachni's framework: the scanner crawls the app and runs the checks (injection, XSS, CSRF, file inclusion, XXE) and saves the report in .afr format (or exports it). It's the open-source scanner with its own architecture (the framework, configurable audits). In DevSecOps, Arachni is one of the DAST options in the pipeline (or for point-in-time scans): selected checks and the findings report with detail (the proof, the payload).

Don't use it for the pipeline if ZAP is already there: ZAP is the reference option (maintenance and integration) — Arachni is the complement with its own checks. Active scanning generates real traffic: the test environment is the site. And watch out: Arachni's framework has a learning curve (audit configuration, modules) and its development slowed down; findings need triage (false positives). DAST complements SAST: the app at runtime with the team's scanner.