Google Online Security Blog: Meet skipfish, our automated web security scanner

Meet skipfish, our automated web security scanner

19 mars 2010

Posted by Michal ZalewskiratproxyBrowser Security Handbookimprove the security of third-party browsersskipfish

High speed: written in pure C, with highly optimized HTTP handling and a minimal CPU footprint, the tool easily achieves 2000 requests per second with responsive targets.

Ease of use: the tool features heuristics to support a variety of quirky web frameworks and mixed-technology sites, with automatic learning capabilities, on-the-fly wordlist creation, and form autocompletion.

Cutting-edge security logic: we incorporated high quality, low false positive, differential security checks capable of spotting a range of subtle flaws, including blind injection vectors.

ratproxyskipfishthis pageavailable here

11 commentaires :

Anonyme a dit…: This is cool and all but Google, you really need to figure out how to protect against social engineering attacks.; 20 mars 2010 à 12:01
Mark R a dit…: Keep them coming. Great to see some new tools for us to use.; 20 mars 2010 à 14:01
Unknown a dit…: Your "Browser Security Handbook" is NOT a "handbook", or any kind of book at all. It is a wiki! There is a pretty damned big difference.

I understand the utility of a wiki, but don't call things what they are not.; 21 mars 2010 à 20:55
Justin Freid a dit…: The tool runs beautifully.
Thanks.; 22 mars 2010 à 02:37
Anonyme a dit…: why there's no code in svn?; 22 mars 2010 à 18:40
Anonyme a dit…: any plans to support NSS besides/instead of OpenSSL?

any plans to support windows? i've tried hard to compile it with msvc, mingw and cygwin. all failed. cygwin at least compiles, but fails to link. msvc support would be very nice.; 22 mars 2010 à 18:54
Anonyme a dit…: um never mind the question about windows support, i got it compile under cygwin, i just had to use the cygwin builds of libidn, openssl and zlib.; 22 mars 2010 à 20:17
Anonyme a dit…: hi, i've setted up a page for my windows builds of skipfish:

http://nss.daydreamer.nu/?q=node/16

enjoy!; 22 mars 2010 à 21:40
Unknown a dit…: Nice work again Google. Very cool.

@Lonny Man, you've really got to learn to chill out. Google have written a handbook in Wiki form, but it's still a handbook. ;); 23 mars 2010 à 21:36
itsbobby a dit…: Running the tool now, my local server doesn't seem to be able to respond to 2000 requests a second though! More like 4!; 10 août 2010 à 05:23
Unknown a dit…: Hi,

Can someone here please tell me how to run skipfish on windows vista.

I have been told to do a research on this tool. But I dont understand what am supposed to do. People say we can do it with cgywin for windows user. But I have no idea wat to do with cgywin. Can someone please tell me how to get it run?

Please dont say open cgywin and type ./skipfish - H..... something like this.

Thanks.; 25 avril 2011 à 06:32

Enregistrer un commentaire

Security Blog

Meet skipfish, our automated web security scanner

11 commentaires :

Libellés

Archive

Feed