Skipfish Security Scanner for Web Apps

Mar 24, 2010

Mathias Huber

Google's online security teams has come out with a free security scanner for web apps, named Skipfish.

The command line tool acts as Web crawler and prepares an interactive sitemap for the targeted site. The Web app is then subjected to a number of nondisruptive security probes, such as for cross-site scripting (XSS), cross-site request forgery (XSRF) and server-side SQL injection. The software can probe websites developed under multiple technologies and frameworks.

Skipfish produces HTML reports that read like sitemaps.

Skipfish is written in C and, according to its developers, shows great performance: Internet requests can produce over 500 responses per second, LAN/MAN requests over 2,000 responses and local requests over 7,000 responses per second. The developers implemented a custom HTTP stack for Skipfish.

The Skipfish developers indicate that their tool digs up many relevant security vulnerabilities, but not all. As with many security scanners, permission to test the website is the prerequisite, unless you own it outright.

Skipfish is open source software under Apache 2.0 licensing. The Google Code site has its own Skipfish page, with downloads of a source tarball and online documentation.

Related content

Stopping Drive-By Attacks

You won't find a perfect solution to the growing problem of drive-by attacks, but many tools are available to help you keep malicious code off your network.

more »
Command Line: SANE

Running your scanner from the command line offers greater control of tasks. We show you how to get started.

more »
Moth: Virtual Testbed for Web Application Security

The Bonsai Information Security firm has released Moth, a VMware image with a set of vulnerable web applications and scripts. It serves for testing and developing security scanners and can be instructional in all matters application security.

more »
ESAPI 1.4: Security Methods for the Web

The Enterprise Security API (ESAPI), a set of documentation focusing on application software security, has released a new version 1.4. Javadocs were updated and old interfaces were replaced.

more »
Apache ModSecurity

The Apache ModSecurity module provides extra protection for your web server. We'll show you why this optional application firewall is quickly becoming a favorite of webmasters and security experts.

more »

comments powered by Disqus

Issue 166/2014

Buy this issue as a PDF

News

Heartbleed Bleeds On

According to a report, many potential victims of the Heartbleed attack have patched their systems, but few have cleaned up the crime scene to protect themselves from the effects of a previous intrusion.
Drone Brain Goes Open Source

DARPA and NICTA release the code for the ultra-secure microkernel system used in aerial drones.
Password Management Services Vulnerable to Attack

Should you trust an online service to store your online passwords?
New Raspberry Pi Adds Two USB Ports

New B+ board lets you build cool things without the complication of a powered USB hub.
Microsoft Grabs No-IP.com Domains

Redmond rushes in to root out alleged malware haven.
Firefox Steps into 3D

New initiative will bring futuristic virtual reality effects to the web surfing experience.
New Trojan Targets Online Banking

Dyreza malware launches a man-in-the-middle attack that compromises SSL.
HP Rolls Out Massive Cloud Network

New cloud combines worldwide access with local attention to data security.
New Attack Targets Wireless Logins

A first cousin of the recent Heartbleed attack affects EAP-based wireless and peer-to-peer authentication.
Geeks Petition for Free Lenovo BIOS

FOSS community acts to protect freedom of choice for laptop devices.

Skipfish Security Scanner for Web Apps

Related content

Issue 166/2014

Tag Cloud

News