Michal Zalewski has announced a new Google’s tool for automated web security scanning.

Skipfish is a free open-source program which has some advantages comparing to other existing vulnerability scanning tools:

• High speed: written in pure C, with highly optimized HTTP handling and a minimal CPU footprint, the tool easily achieves 2000 requests per second with responsive targets.
• Ease of use: the tool features heuristics to support a variety of quirky web frameworks and mixed-technology sites, with automatic learning capabilities, on-the-fly wordlist creation, and form autocompletion.
• Cutting-edge security logic: Google incorporated high quality, low false positive, differential security checks capable of spotting a range of subtle flaws, including blind injection vectors.

At the same time, skipfish may not be the right tool for certain purposes. For example, it does not satisfy most of the requirements outlined in WASC Web Application Security Scanner Evaluation Criteria. And unlike most other projects of this type, it does not come with an extensive database of known vulnerabilities for banner-type checks.

Tags: google, security audit, skipfish, vulnerability scanner