From Aldeid
Contents |
SkipFish
Description
SkipFish has been developed by Michal Zalewski (Google engineer). This tool automatizes vulnerability assessment on web applications. It is capable of processing between 500 requests per second for a remote scan and 7,000 requests per second for a local one. The tool is compatible with Linux, FreeBSD 7.0+, MacOS X, and Windows (Cygwin) environments
Installation
Prerequisites
# apt-get install libidn11-dev
Skipfish
# mkdir -p /usr/local/skipfish/ # cd /usr/local/skipfish/ # wget http://skipfish.googlecode.com/files/skipfish-1.10b.tgz # tar xvf skipfish-1.10b.tgz # cd skipfish/ # make
To check that it has been successfully installed, type:
# ./skipfish -h
Usage
Basic usage
# ./skipfish -W dictionaries/complete.wl -o report http://www.domain.com/index.php
Options
Authentication and access options
-A user:pass - use specified HTTP authentication credentials -F host:IP - pretend that 'host' resolves to 'IP' -C name=val - append a custom cookie to all requests -H name=val - append a custom HTTP header to all requests -b (i|f) - use headers consistent with MSIE / Firefox -N - do not accept any new cookies
Crawl scope options
-d max_depth - maximum crawl tree depth (16) -c max_child - maximum children to index per node (1024) -r r_limit - max total number of requests to send (100000000) -p crawl% - node and link crawl probability (100%) -q hex - repeat probabilistic scan with given seed -I string - only follow URLs matching 'string' -X string - exclude URLs matching 'string' -S string - exclude pages containing 'string' -D domain - crawl cross-site links to another domain -B domain - trust, but do not crawl, another domain -O - do not submit any forms -P - do not parse HTML, etc, to find new links
Reporting options
-o dir - write output to specified directory (required) -J - be less noisy about MIME / charset mismatches -M - log warnings about mixed content -E - log all HTTP/1.0 / HTTP/1.1 caching intent mismatches -U - log all external URLs and e-mails seen -Q - completely suppress duplicate nodes in reports
Dictionary management options
-W wordlist - load an alternative wordlist (skipfish.wl) -L - do not auto-learn new keywords for the site -V - do not update wordlist based on scan results -Y - do not fuzz extensions in directory brute-force -R age - purge words hit more than 'age' scans ago -T name=val - add new form auto-fill rule -G max_guess - maximum number of keyword guesses to keep (256)
Performance settings
-g max_conn - max simultaneous TCP connections, global (50) -m host_conn - max simultaneous connections, per target IP (10) -f max_fail - max number of consecutive HTTP errors (100) -t req_tmout - total request response timeout (20 s) -w rw_tmout - individual network I/O timeout (10 s) -i idle_tmout - timeout on idle HTTP connections (10 s) -s s_limit - response size limit (200000 B)
Report
