Skipfish (https://code.google.com/archive/p/skipfish/) was created by Google and released to the public in 2010; it is described by its creators as an active web application security reconnaissance tool, is included by default in Kali Linux, and it does more than pure reconnaissance. It is a complete vulnerability scanner. Some of its highlights are:
- High speed: It can reach more than 400 requests per second and claims to be able to reach more than 2000 in high speed LAN
- Its command-line options are straightforward and easy to use
- It can detect a wide range of issues, from directory listing and other information disclosure vulnerabilities to different types of SQL and XML injection
In this recipe, we will look at a simple example of how to use Skipfish and check its results.
