Picture by: Nerdboy550
Skipfish is an active web application security reconnaissance tool. It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.
However, the Skipfish scanner is not meant to be a replacement for commercial scanners, it appears. Google says in the documentation that the scanner doesn’t meet many of the evaluation criteria set out by the Web Application Security Consortium for such scanners, and also “extensive database of known vulnerabilities for banner-type checks.”
