146

Skipfish in Kali Linux

In Kali Linux, Skipfish is an active web application security reconnaissance tool. It uses a recursive crawl and dictionary-based probes to create an interactive sitemap for the chosen site. The resulting map is then annotated with the output of several active (but hopefully non-disruptive) security checks. The tool’s final report is intended to be used as a starting point for professional web application security evaluations.

Skipfish is a free and open-source Automated Penetration Testing (APT) tool for security researchers that can be found on GitHub. Skipfish is used for information gathering and testing the security of websites and web servers. Skipfish is one of the most user-friendly and effective penetration testing tools available. It comes with several integrated tools for penetrating testing the target system. This tool is also called an active web application security reconnaissance tool. This tool works and maps the target site’s console using recursive crawls and dictionary-based probes. This tool displays all of the active security checks in the domain. Finally, this tool creates a report that can be utilized for security assessments.

Features of Skipfish tool

The following are the features of the Skipfish tool:

1. Skipfish can track enumeration.
2. Skipfish is used to scanning websites and web apps.
3. Skipfish is an Open-source intelligence tool.
4. Skipfish contains various modules such as wananga, metagoofil, etc.
5. Skipfish may detect vulnerabilities (CMS), such as WordPress, Joomla, and others.
6. There are more than 15 modules present in Skipfish which can be used for penetration testing.
7. We used Skipfish to scan content management systems (CMS).
8. Cutting-edge security logic: low false positive, capable of detecting a wide range of subtle defects, high quality, differential security checks, including blind injection vectors.
9. Ease of Use: Heuristics to support a wide range of odd web frameworks and mixed-technology sites, including automatic learning capabilities, on-the-fly wordlist creation, and form auto-completion.
10. High speed: pure C code, highly optimized HTTP handling, minimal CPU footprint- easily achieving 2000 requests per second with responsive targets.

Skipfish Installation

The following steps are used to install Skipfish:

Step 1: In order to install the Skipfish tool, first we have to move to desktop and then type the following command:

Step 2: Then, the Skipfish is installed into our Kali Linux machine, and now, with the help of the following command, we can move it into the tool directory.

Step 3: Now, we can see, the tool’s help menu is now active. All of the flags that come with the tool can be used. We’ve downloaded the tool, and now we’ll learn how to utilize it.

How to Use Skipfish in Kali Linux

As we previously stated that we don’t need to install SkipFish because it comes pre-installed with Kali Linux (full version).

We can check its option by typing the following command into our terminal:

The following screenshot shows the output of the previous command as well as the help of the SkipFish tool.

Let’s discuss how to use SkipFish on Kali Linux with the help of

some examples:

Example 1: We can use the Skipfish tool to scan a WordPress website with the help of its IP address.

The tool’s report can be seen here. This tool can be used to create our own target. We are free to use whatever domain we choose.

Example 2: Use Skipfish tool to scan bodegeit

As we can see, the tool has provided all relevant data, including data, including scan time, HTTP requests to the host, compression size, HTTP faults, TCP handshakes, TCP faults, External links, etc. This is how we can also perform an operation on a target that we specify.

---