Skipfish Security Scanner for Web Apps
Google's online security teams has come out with a free security scanner for web apps, named Skipfish.
The command line tool acts as Web crawler and prepares an interactive sitemap for the targeted site. The Web app is then subjected to a number of nondisruptive security probes, such as for cross-site scripting (XSS), cross-site request forgery (XSRF) and server-side SQL injection. The software can probe websites developed under multiple technologies and frameworks.
Skipfish produces HTML reports that read like sitemaps.
Skipfish is written in C and, according to its developers, shows great performance: Internet requests can produce over 500 responses per second, LAN/MAN requests over 2,000 responses and local requests over 7,000 responses per second. The developers implemented a custom HTTP stack for Skipfish.
The Skipfish developers indicate that their tool digs up many relevant security vulnerabilities, but not all. As with many security scanners, permission to test the website is the prerequisite, unless you own it outright.
Skipfish is open source software under Apache 2.0 licensing. The Google Code site has its own Skipfish page, with downloads of a source tarball and online documentation.
Issue 200/2017
Buy this issue as a PDF
News
-
Trojan Turns Raspberry Pi into a Cryptocurrency Mining Device
Two trojans in the wild are targeting Linux machines.
-
Fedora 26 Beta Comes with New Features
The workstation comes with the latest Gnome desktop environment and support for many application build systems.
-
Raspberry Pi Foundation Merges with CoderDojo Foundation
The two foundations join forces to expand their efforts to reach young people.
-
Samba Security Hole Patched but Risk is Bigger
Millions of devices that use Samba Server are vulnerable to attacks.
-
Red Hat Announces OpenShift.io
Red Hat takes its IDE online.
-
Microsoft Bakes Linux into Windows Server
Microsoft is slowly becoming a Linux vendor.
-
Fearless Coyote, Linux Kernel 4.11 is Out
The new kernel makes swap implementation more scalable, which will help cloud providers.
-
Docker Appoints Steve Singh CEO
The new CEO comes from a very strong SaaS background.
-
Docker Announces Linux Kit and Moby Project
Both projects help organizations build their own containerized systems.
-
Ubuntu Returns to Gnome as Its Mobile Plans Shatter
Mark Shuttleworth has resumed the position of CEO of Canonical.