From aldeid
Jump to: navigation, search



SkipFish has been developed by Michal Zalewski (Google engineer). This tool automatizes vulnerability assessment on web applications. It is capable of processing between 500 requests per second for a remote scan and 7,000 requests per second for a local one. The tool is compatible with Linux, FreeBSD 7.0+, MacOS X, and Windows (Cygwin) environments



# apt-get install libidn11-dev


# mkdir -p /usr/local/skipfish/
# cd /usr/local/skipfish/
# wget
# tar xvf skipfish-1.10b.tgz
# cd skipfish/
# make

To check that it has been successfully installed, type:

# ./skipfish -h


Basic usage

# ./skipfish -W dictionaries/complete.wl -o report


Authentication and access options

 -A user:pass   - use specified HTTP authentication credentials
 -F host:IP     - pretend that 'host' resolves to 'IP'
 -C name=val    - append a custom cookie to all requests
 -H name=val    - append a custom HTTP header to all requests
 -b (i|f)       - use headers consistent with MSIE / Firefox
 -N             - do not accept any new cookies

Crawl scope options

 -d max_depth   - maximum crawl tree depth (16)
 -c max_child   - maximum children to index per node (1024)
 -r r_limit     - max total number of requests to send (100000000)
 -p crawl%      - node and link crawl probability (100%)
 -q hex         - repeat probabilistic scan with given seed
 -I string      - only follow URLs matching 'string'
 -X string      - exclude URLs matching 'string'
 -S string      - exclude pages containing 'string'
 -D domain      - crawl cross-site links to another domain
 -B domain      - trust, but do not crawl, another domain
 -O             - do not submit any forms
 -P             - do not parse HTML, etc, to find new links

Reporting options

 -o dir         - write output to specified directory (required)
 -J             - be less noisy about MIME / charset mismatches
 -M             - log warnings about mixed content
 -E             - log all HTTP/1.0 / HTTP/1.1 caching intent mismatches
 -U             - log all external URLs and e-mails seen
 -Q             - completely suppress duplicate nodes in reports

Dictionary management options

 -W wordlist    - load an alternative wordlist (skipfish.wl)
 -L             - do not auto-learn new keywords for the site
 -V             - do not update wordlist based on scan results
 -Y             - do not fuzz extensions in directory brute-force
 -R age         - purge words hit more than 'age' scans ago
 -T name=val    - add new form auto-fill rule
 -G max_guess   - maximum number of keyword guesses to keep (256)

Performance settings

 -g max_conn    - max simultaneous TCP connections, global (50)
 -m host_conn   - max simultaneous connections, per target IP (10)
 -f max_fail    - max number of consecutive HTTP errors (100)
 -t req_tmout   - total request response timeout (20 s)
 -w rw_tmout    - individual network I/O timeout (10 s)
 -i idle_tmout  - timeout on idle HTTP connections (10 s)
 -s s_limit     - response size limit (200000 B)