Netsparker Desktop has a command line interface which you can use to fire up a scan. The command line interface can be used to integrate automated web application security scans, for example trigger a scan via a third party application once new source code is submitted to a project.
You can also use the command line feature to automate complex scan sequences that target many domains as explained in Scanning multiple websites with Netsparker Desktop's command line.
List of Command Line Arguments for Netsparker Desktop
When using the command line interface you can use arguments to pre-configure the web vulnerability scanner and also specify post scan tasks, such as the generation of a scan report. Below is a list of all the arguments available:
Name: Autopilot Mode
Argument: /a, /auto
For: When this argument is used Netsparker will execute the designated scan, generate a report in the specified location using the specified report template and then exit. The autopilot option is most commonly used when Netsparker is invoked as part of a batch process.
Name: Scan Profile Name
Argument: /p, /profile
For: Use this argument to specify the name of the Scan Profile that should be used during the scan. If not specified, the default Scan Profile will be used. Scan Profiles provide a powerful and convenient mechanism to pass complex sets of scan configuration data during command line execution. For example, a profile allows the following scan settings to be defined within Netsparker, and accessed as a single named configuration:
- The target URL and the scope of the scan, relative to that URL
- The range of selected security tests
- The number of threads used for crawling and attacking
- The active parsers and how their extracted links will be interpreted
- The target back-end database
Scan Profiles also support advanced scanning concepts, such as the ability to manually import links or add HTTP requests. Read the Configuring and Managing Scan Profiles in Netsparker Desktop for more detailed information on Scan Profiles.
Name: Target URL
Argument: /u, /url
For: Use this option to specify the address (URL) of the target web application or web service. This is a mandatory argument unless a Scan Profile which includes a URL has been specified. If a Scan Profile is specified Netsparker will derive its target URL from the Scan Profile. If a Scan Profile is specified and the URL configuration parameter is also specified, Netsparker will ignore the Scan Profile and derive its target URL from the target URL parameter.
Name: Report Path
Argument: /r, /report
For: Use this option to either specify the filename or the path where the report should be saved. If only the filename is specified the report will be created in the folder from which Netsparker Desktop is launched. If the target path contains space characters, the path must be specified in double quotes.
Note: This argument should always be used in conjunction with the /auto argument.
Name: Report Template Name
Argument: /rt, /reporttemplate
For: Use this argument to specify the name of the report template. If not specified, the first report template file will be used. You can also use this argument multiple times to export several reports using different templates.
Argument: /h, /help
For: Use this argument to see a list of all the available argument.
Name: Silent Mode
Argument: /s, /silent
For: Use this argument to suppress error messages. This argument is ideal for scheduling scans and automated jobs.
Name: Authentication Credentials
For: Use this argument to specify a combination of username, password and domain information that Netsparker should use with Basic, Digest and NTLM authentication. Some examples follow:
/auth username password
/auth username password "host or domain"
/auth username@domain password
/auth host\username password
If the username, password or domain contain a space character, they must be specified in double quotes, as shown in the above examples. As an alternative to using the /auth argument, credentials can be configured as part of a Scan Profile.
Name: Log HTTP Requests
Argument: /lr, /logrequests
For: Use this option to log all HTTP requests that the Netsparker scanner sends and receives during a web application security scan. The HTTP requests will be saved in a file called "HttpRequests.saz" and will be located within the current scan directory. You can use Fiddler to view the contents of the log file.
Name: Resume Scan
Argument: /rs, /resumescan
For: Use this argument to resume a previously unfinished scan. When using this argument you need to specify where the unfinished scan file is, for example: "Netsparker.exe /resumescan C:\scans\scan1.nss"
Name: Generate only HTML reports
For: Use this option to only generate a HTML report. Unless this switch is used, the scanner will automatically generate a HTML and a PDF report.
Examples of Netsparker Desktop Command Line Usage
Scan a Website and Generate a Report
Command: Netsparker /a /url http://test23.example.com /rt "Detailed Scan Report" /r "C:\reports\scan report.html"
Explanation: Scan http://test23.example.com and generate a report using the Detailed Scan Report template. Save the report to C:\reports\scan report.html.
Scan a Website and Generate Two Reports
Command: Netsparker /a /url http://test23.example.com /r "C:\reports\scan report-1.html" /rt "Detailed Scan Report" /r "C:\reports\scan report-2.html" /rt "OWASP Top Ten 2013 Report"
Explanation: Scan http://test23.example.com and generate two reports; scan report-1.html using the Detailed Scan report template, and scan report-2.html using the OWASP Top Ten 2013 report template.
Scan a Website with NTLM Authentication
Command: Netsparker /a /url http://test23.example.com /auth john.doe "secret password" example.com
Explanation: Scan http://test22.example.com, and use the username john.doe and password secret password when challenged for credentials.