Tuesday, April 29, 2025
HomeWeb ApplicationsSkipfish - Web Application Security Scanner for XSS, SQL Injection, Shell injection

Skipfish – Web Application Security Scanner for XSS, SQL Injection, Shell injection

Published on

SIEM as a Service

Follow Us on Google News

Skipfish is an active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes.

The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.

Also, learn an Advanced Web Hacking & Penetration Testing Course – Scratch to Advance

- Advertisement - Google News

Main Feature

  • 500+ against Internet targets, 2000+ requests per second on LAN / MAN networks, and 7000+ requests against local instances.
  • Automatic word list construction based on site content analysis.
  • Heuristic recognition of obscure path and query-based parameter handling schemes.
  • Snort-style content signatures will highlight server errors, information leaks, or potentially dangerous web applications.
  • Bundled security checks are designed to handle tricky scenarios: Stored XSS (path, parameters, headers), blind SQL or XML injection, or blind shell injection.

Also Read  :  Commix – Automated All-in-One OS Command Injection and Exploitation Tool

To Run this Web application security scanner

Step1: To get all the parameters of type skipfish -h

 root@kali:~# skipfish -h
Skipfish | Web application security scanner

Step 2: To scan the target and write the output in the directory.

root@kali:~# skipfish -d -o 202 http://192.168.169.130/
Skipfish | Web application security scanner

It will go on scanning through every request, external/Internal links, and statistics.

Skipfish | Web application security scanner
Skipfish | Web application security scanner

Once the scan is completed it will create a professional web application security assessment.

Skipfish | Web application security scanner

Output consists of various sections such as document type and Issue type overview.

Skipfish | Web application security scanner

For scanning Wildcard domains

root@kali:~# skipfish -D .192.168.169.130 -o output-dir1 http://192.168.169.130/

You need to customize your HTTP requests when scanning big sites.

-H   To insert any additional, non-standard headers.
-F To define a custom mapping between a host and an IP.
-d Limits crawl depth to a specified number of subdirectories.
-c Limits the number of children per directory.
-x Limits the total number of descendants per crawl tree branch.
-r Limits the total number of requests to send in a scan.

skip fish also provides the summary overviews of document types and issue types found, and an interactive sitemap, with nodes discovered through brute force, denoted in a distinctive
way.

Need to specify -e to avoid binary responses for reporting.

  • Author: Google Inc, Michal Zalewski, Niels Heinen, Sebastian Roschke
  • License: Apache-2.0

Also Read

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

RansomHub Ransomware Deploys Malware to Breach Corporate Networks

The eSentire’s Threat Response Unit (TRU) in early March 2025, a sophisticated cyberattack leveraging...

19 APT Hackers Target Asia-based Company Servers Using Exploited Vulnerabilities and Spear Phishing Email

The NSFOCUS Fuying Laboratory’s global threat hunting system identified 19 sophisticated Advanced Persistent Threat...

FBI Reports ₹1.38 Lakh Crore Loss in 2024, a 33% Surge from 2023

The FBI’s Internet Crime Complaint Center (IC3) has reported a record-breaking loss of $16.6...

Fog Ransomware Reveals Active Directory Exploitation Tools and Scripts

Cybersecurity researchers from The DFIR Report’s Threat Intel Group uncovered an open directory hosted...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Gesture Jacking – New Attack That Deceives Website Visitors

The Web Platform is incredibly powerful, but regrettably, malicious websites will do all in...

Web Server Penetration Testing Checklist – 2024

Web server pentesting is performed under three significant categories: identity, analysis, and reporting vulnerabilities such as...

Most Popular Websites Still Allow Users To Have Weak Passwords

The latest analysis shows that tens of millions of people are creating weak passwords...