Posted by Michal Zalewski
The safety of the Internet is of paramount importance to Google, and helping web developers build secure, reliable web applications is an important part of the equation. To advance this goal, we have released projects such as
ratproxy, a passive security assessment tool; and
Browser Security Handbook, a comprehensive guide for web developers. We also worked with the community to
improve the security of third-party browsers.
Today, we are happy to announce the availability of
skipfish - our free, open source, fully automated, active web application security reconnaissance tool. We think this project is interesting for a few reasons:
- High speed: written in pure C, with highly optimized HTTP handling and a minimal CPU footprint, the tool easily achieves 2000 requests per second with responsive targets.
- Ease of use: the tool features heuristics to support a variety of quirky web frameworks and mixed-technology sites, with automatic learning capabilities, on-the-fly wordlist creation, and form autocompletion.
- Cutting-edge security logic: we incorporated high quality, low false positive, differential security checks capable of spotting a range of subtle flaws, including blind injection vectors.
As with
ratproxy, we feel that
skipfish will be a valuable contribution to the information security community, making security assessments significantly more accessible and easier to execute.
To download the scanner, please visit
this page; detailed project documentation is
available here.
