.

Skipfish, Google Enters the Web Scanner Fray

<<

Jhaddix

User avatar

Sr. Member
Sr. Member

Posts: 317

Joined: Wed Oct 29, 2008 10:25 pm

Post Fri Mar 19, 2010 5:58 pm

Skipfish, Google Enters the Web Scanner Fray

Just wrote a quick review and jotted down some insights to Google's new web application security scanner. Skipfish. Read the whole thing at the link or just check out the "skinny"  ;)

   The Skinny:

   We like it. As Google says, its not an end-all-be-all for web application scanners, but it definitely has some great logic, features, and is blazing fast. Also if you have seen the dev track the developer Michal Zalewski has been quick to update for problems (1.01b fixes some crashing problems) and has some great upcoming features planned (pause/resume, VIEWSTATE testing, etc.) Although no scanner will ever replace a smart web app assessment engineer, Skipfish shows some great potential in the security space and… its free. It wont replace any of our manual processes but we will definitely use it when applicable. Thanks Google.

http://www.redspin.com/blog/2010/03/19/skipfish-google-enters-the-web-scanner-fray/
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Fri Mar 19, 2010 7:08 pm

Re: Skipfish, Google Enters the Web Scanner Fray

Jason, you post tools faster than I can test them :)  Thanks again for feeding my sec tool library.
~~~~~~~~~~~~~~
Ketchup
<<

Jhaddix

User avatar

Sr. Member
Sr. Member

Posts: 317

Joined: Wed Oct 29, 2008 10:25 pm

Post Fri Mar 19, 2010 8:25 pm

Re: Skipfish, Google Enters the Web Scanner Fray

No problem Ketchup! Part of my job is "competitive analysis" and "research" so im always testing and reviewing new tech. A web scanner from Google was big news so we took the morning in the lab to test =) I love pentesting and writing about pentesting. Luckily its my job and my passion.


That plus i drink a lot of coffee and live on the twitter stream ;)
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Fri Mar 19, 2010 9:54 pm

Re: Skipfish, Google Enters the Web Scanner Fray

Thanks again Jason.  It's part of my job too, but I don't get any time allocated to get it done :) 

For those testing the skipfish, you also need libssl-dev to compile. 

I am playing around with it now (because I am a dork and that's what I do on Friday night). It seems pretty fast, even over a VPN to my lab.  It's very light on resources too.  On my netbook, it uses about 10-15% CPU and very little RAM.  I haven't compared accuracy to other tools, like Nikto, yet but it has promise.  The only annoying thing it does on my system is change the font color to something unreadable.

Thanks again for sharing.
~~~~~~~~~~~~~~
Ketchup
<<

UNIX

User avatar

Hero Member
Hero Member

Posts: 1244

Joined: Mon Apr 28, 2008 9:20 am

Post Sat Mar 20, 2010 8:10 am

Re: Skipfish, Google Enters the Web Scanner Fray

Thanks for the write-up Jason, seems promising. Will try it out as soon as possible.
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1662

Joined: Mon Jan 29, 2007 2:59 pm

Post Sun Mar 21, 2010 7:28 am

Re: Skipfish, Google Enters the Web Scanner Fray

As always, JHaddix comes in with another great tool.  I'll have to make time for it, so I can see how this'll fit into my arsenal.  Thanks, Jason!
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

n1p

Jr. Member
Jr. Member

Posts: 89

Joined: Tue Mar 16, 2010 5:31 pm

Post Fri Mar 26, 2010 7:06 am

Re: Skipfish, Google Enters the Web Scanner Fray

All,

I created a small video demonstration of setup and simple usage http://www.isolatedthreat.com/?page_id=192. This the first one of many I will hopefully get to do in areas such as exploit dev, malware reversing and security.

Return to Tools

Who is online

Users browsing this forum: No registered users and 0 guests

cron
.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software