Monthly Archives: August 2013

SkipFish – a nice web application security reconnaissance tool

small_2772914796All, or almost all companies face with the problem of security of their websites. Usually after some quick research they are deciding to hire some security specialist or a security company who help them solve potential security issues. But from time to time we can find on the web market some nice tools which can help to make it easier or which can notify us about potential problems.

One of those tools can be SkipFish. Based on info from author:

Skipfish is an active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.

Key features:

  • High speed: pure C code, highly optimized HTTP handling, minimal CPU footprint – easily achieving 2000 requests per second with responsive targets.
  • Ease of use: heuristics to support a variety of quirky web frameworks and mixed-technology sites, with automatic learning capabilities, on-the-fly wordlist creation, and form autocompletion.
  • Cutting-edge security logic: high quality, low false positive, differential security checks, capable of spotting a range of subtle flaws, including blind injection vectors.

The tool is believed to support Linux, FreeBSD, MacOS X, and Windows (Cygwin) environments.

I really recommend you this tool. You can find it on

photo credit: misterbisson via photopin cc