Thursday, April 17, 2025
HomeWeb ApplicationsSkipfish - Web Application Security Scanner for XSS, SQL Injection, Shell injection

Skipfish – Web Application Security Scanner for XSS, SQL Injection, Shell injection

Published on

SIEM as a Service

Follow Us on Google News

Skipfish is an active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes.

The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.

Also, learn an Advanced Web Hacking & Penetration Testing Course – Scratch to Advance

- Advertisement - Google News

Main Feature

  • 500+ against Internet targets, 2000+ requests per second on LAN / MAN networks, and 7000+ requests against local instances.
  • Automatic word list construction based on site content analysis.
  • Heuristic recognition of obscure path and query-based parameter handling schemes.
  • Snort-style content signatures will highlight server errors, information leaks, or potentially dangerous web applications.
  • Bundled security checks are designed to handle tricky scenarios: Stored XSS (path, parameters, headers), blind SQL or XML injection, or blind shell injection.

Also Read  :  Commix – Automated All-in-One OS Command Injection and Exploitation Tool

To Run this Web application security scanner

Step1: To get all the parameters of type skipfish -h

 root@kali:~# skipfish -h
Skipfish | Web application security scanner

Step 2: To scan the target and write the output in the directory.

root@kali:~# skipfish -d -o 202 http://192.168.169.130/
Skipfish | Web application security scanner

It will go on scanning through every request, external/Internal links, and statistics.

Skipfish | Web application security scanner
Skipfish | Web application security scanner

Once the scan is completed it will create a professional web application security assessment.

Skipfish | Web application security scanner

Output consists of various sections such as document type and Issue type overview.

Skipfish | Web application security scanner

For scanning Wildcard domains

root@kali:~# skipfish -D .192.168.169.130 -o output-dir1 http://192.168.169.130/

You need to customize your HTTP requests when scanning big sites.

-H   To insert any additional, non-standard headers.
-F To define a custom mapping between a host and an IP.
-d Limits crawl depth to a specified number of subdirectories.
-c Limits the number of children per directory.
-x Limits the total number of descendants per crawl tree branch.
-r Limits the total number of requests to send in a scan.

skip fish also provides the summary overviews of document types and issue types found, and an interactive sitemap, with nodes discovered through brute force, denoted in a distinctive
way.

Need to specify -e to avoid binary responses for reporting.

  • Author: Google Inc, Michal Zalewski, Niels Heinen, Sebastian Roschke
  • License: Apache-2.0

Also Read

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Ransomware Attacks Surge 126%, Targeting Consumer Goods and Services Sector

The cybersecurity landscape witnessed a dramatic escalation in ransomware attacks, marking a concerning trend...

CrazyHunter Hacker Group Exploits Open-Source GitHub Tools to Target Organizations

A relatively new ransomware outfit known as CrazyHunter has emerged as a significant threat,...

Threat Actors Leverage Cascading Shadows Attack Chain to Evade Detection and Hinder Analysis

A sophisticated multi-layered phishing campaign was uncovered, employing a complex attack chain known as...

Microsoft Vulnerabilities Reach Record High with Over 1,300 Reported in 2024

The 12th Edition of the Microsoft Vulnerabilities Report has revealed a significant surge in...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Gesture Jacking – New Attack That Deceives Website Visitors

The Web Platform is incredibly powerful, but regrettably, malicious websites will do all in...

Web Server Penetration Testing Checklist – 2024

Web server pentesting is performed under three significant categories: identity, analysis, and reporting vulnerabilities such as...

Most Popular Websites Still Allow Users To Have Weak Passwords

The latest analysis shows that tens of millions of people are creating weak passwords...