Friday, March 29, 2024

Skipfish – Web Application Security Scanner for XSS, SQL Injection, Shell injection

Skipfish is an active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes.

The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.

Also, learn an Advanced Web Hacking & Penetration Testing Course – Scratch to Advance

Main Feature

  • 500+ against Internet targets, 2000+ requests per second on LAN / MAN networks, and 7000+ requests against local instances.
  • Automatic word list construction based on site content analysis.
  • Heuristic recognition of obscure path and query-based parameter handling schemes.
  • Snort-style content signatures will highlight server errors, information leaks, or potentially dangerous web applications.
  • Bundled security checks are designed to handle tricky scenarios: Stored XSS (path, parameters, headers), blind SQL or XML injection, or blind shell injection.

Also Read  :  Commix – Automated All-in-One OS Command Injection and Exploitation Tool

To Run this Web application security scanner

Step1: To get all the parameters of type skipfish -h

 root@kali:~# skipfish -h
Skipfish | Web application security scanner

Step 2: To scan the target and write the output in the directory.

root@kali:~# skipfish -d -o 202 http://192.168.169.130/
Skipfish | Web application security scanner

It will go on scanning through every request, external/Internal links, and statistics.

Skipfish | Web application security scanner
Skipfish | Web application security scanner

Once the scan is completed it will create a professional web application security assessment.

Skipfish | Web application security scanner

Output consists of various sections such as document type and Issue type overview.

Skipfish | Web application security scanner

For scanning Wildcard domains

root@kali:~# skipfish -D .192.168.169.130 -o output-dir1 http://192.168.169.130/

You need to customize your HTTP requests when scanning big sites.

-H   To insert any additional, non-standard headers.
-F To define a custom mapping between a host and an IP.
-d Limits crawl depth to a specified number of subdirectories.
-c Limits the number of children per directory.
-x Limits the total number of descendants per crawl tree branch.
-r Limits the total number of requests to send in a scan.

skip fish also provides the summary overviews of document types and issue types found, and an interactive sitemap, with nodes discovered through brute force, denoted in a distinctive
way.

Need to specify -e to avoid binary responses for reporting.

  • Author: Google Inc, Michal Zalewski, Niels Heinen, Sebastian Roschke
  • License: Apache-2.0

Also Read

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles