Skipfish FOR MAC

Skipfish is an open source and powerful web application security reconnaissance tool. It generates an interactive sitemap for the targeted website by carrying out dictionary-based probes and a recursive crawl. The resulting map is automatically annotated with the output from various security checks, making it ideal for web app security assessments.

Security Check Flaws:

• High risk flaws include SQL/PHP injection, shell command injection, and format string vulnerabilities.


• Medium risk flaws involve XSS vectors, directory traversal, and file inclusion issues.


• Low-risk issues consist of directory listing bypass, expired SSL certificates, and inadequate XSRF protection.

Internal Warnings:

• Failed resource fetch attempts


• Exceeded crawl limits


• Failed 404 behavior checks

Non-Specific Information Entries:

• General SSL certificate information


• Changing Server, Via, or X... headers


• Resources requiring HTTP authentication

How to Install and Run:

Unarchive, open a Terminal window, go to the Skipfish's folder and run the following commands:

• make


• sudo make install

Next, copy the desired dictionary file from dictionaries/ to skipfish.wl. Ensure to read dictionaries/README-FIRST for the right choice. This step impacts scan quality later. Finally, run: .\/skipfish -o output_dir http:\/\/www.example.com\/some\/starting\/path.txt

Publisher: Google