Skipfish Security Scanner for Web Apps

Mar 24, 2010

Mathias Huber

Google's online security teams has come out with a free security scanner for web apps, named Skipfish.

The command line tool acts as Web crawler and prepares an interactive sitemap for the targeted site. The Web app is then subjected to a number of nondisruptive security probes, such as for cross-site scripting (XSS), cross-site request forgery (XSRF) and server-side SQL injection. The software can probe websites developed under multiple technologies and frameworks.

Skipfish produces HTML reports that read like sitemaps.

Skipfish is written in C and, according to its developers, shows great performance: Internet requests can produce over 500 responses per second, LAN/MAN requests over 2,000 responses and local requests over 7,000 responses per second. The developers implemented a custom HTTP stack for Skipfish.

The Skipfish developers indicate that their tool digs up many relevant security vulnerabilities, but not all. As with many security scanners, permission to test the website is the prerequisite, unless you own it outright.

Skipfish is open source software under Apache 2.0 licensing. The Google Code site has its own Skipfish page, with downloads of a source tarball and online documentation.

Related content

CubieTruck

The CubieTruck small-board PC is a measuring instrument that copes well with Gigabit networks and offers a surprisingly affordable and efficient solution.

more »
Stopping Drive-By Attacks

You won't find a perfect solution to the growing problem of drive-by attacks, but many tools are available to help you keep malicious code off your network.

more »
Command Line: SANE

Running your scanner from the command line offers greater control of tasks. We show you how to get started.

more »
Moth: Virtual Testbed for Web Application Security

The Bonsai Information Security firm has released Moth, a VMware image with a set of vulnerable web applications and scripts. It serves for testing and developing security scanners and can be instructional in all matters application security.

more »
ESAPI 1.4: Security Methods for the Web

The Enterprise Security API (ESAPI), a set of documentation focusing on application software security, has released a new version 1.4. Javadocs were updated and old interfaces were replaced.

more »

comments powered by Disqus

Issue 172/2015

Buy this issue as a PDF

Digital Issue: Price $9.99

(incl. VAT)

News

Cisco Releases Annual Security Report

Spammers go low-volume, and 90% of IE browsers are unpatched.
Zero Day Exploits Target Flash

Adobe scrambles to release patches for vulnerable Flash Player.
Intel Unveils Compute Stick

Four-inch-long computer on a stick lets you boot a full Linux system from any HDMI display device.
Obama Proposes Personal Data Notification Law

New statute would require companies to report break-ins to consumers.
TGXf Project Warns of File Transfer through Screen Pixels

Weird data transfer technique avoids all standard security measures.
Industry Giants Announce a Fix for the Password Mess

FIDO alliance declares the beginning of the end for old-style login authentication.
Poll: Vote for the Best Open Source Software for Photographers

The Linux New Media Awards have honored the most significant products, projects, people, and organizations for open source/Linux every year since 2000.
Debian Gets Forked

Legendary Uber-distro splits over the systemd controversy.
Linux Mint Project Releases Mint 17.1

New LTS version offers many refinements for the Cinnamon and Mate desktops and significant improvement under the hood.
CeBIT Open Source Forum Call for Papers

CeBIT Open Source , Forum

One of CeBIT’s most successful forums returns in 2015.

Skipfish Security Scanner for Web Apps

Related content

Issue 172/2015

Buy this issue as a PDF

News

Tag Cloud