I am a 4th year computer science student. I need to prepare for a seminar on "skipfish",. I don't know much details about the topic. So please help me.It is really very urgent. Hope you guyz will help me soon. Please help me, i need the details urgently. I do have little bit detail about the topic that i serched from google. But it is not enough :
SKIPFISH
Skipfish is an active web application security reconnaissance instrument. It prepares an interactive sitemap for the aimed site by doing a recursive crawl and vocabulary-based probes. The ensuing map is then annotated with the output from a set of active (however hopefully non-disruptive) security checks. The decisive report makes by the instrument is meant to serve as a foundation for pro web application security assessments.
A set of commercial and open source instruments with analogous efficiency is easily available (e.g., Nikto, Websecurify, Netsparker, w3af, Arachni); stick to the one that suits you perfect. That said, skipfish attempt to address several of the usual troubles connected with web security scanners. Particular benefits incorporate:
High performance: Five Hundred+ demands per second against quick to respond World Wide Web aims, 2000+ demands per second on LAN / MAN networks, and 7000+ demands against local examples have been observed, with a highly modest CPU, network, and memory footprint. That could be associate with:
Multiplexing single-thread, 100Percent asynchronous network I/O and information processing model that eliminates memory management, planning, and IPC inefficiencies present in some multi-threaded consumers.
Enhanced HTTP/1.1 features for example range demands, content contraction, and hold-alive links, on top of forced answer size bounding, to hold network-level overhead in check.
Intelligent answer caching and enhanced server demeanor heuristics are applied to decrease needless traffic.
Performance-oriented, natural C realization, incorporating a custom HTTP stack.
Ease of use: skipfish is quite adaptive and unfailing. The scanner features:
Heuristic recognition of vague way- and question-based parameter handling schemes.
Elegant handling of multi-framework sites where definite paths obey a totally diverse semantics, or maybe are subject to diverse filtering rules.
Automated wordlist construction founded on site content assessment.
Probabilistic scanning features to permit periodic, time-bound assessments of arbitrarily complex sites.
Well-made security checks: the instrument is meant to supply perfect and significant results:
Handcrafted vocabularies proffer perfect coverage and permit scrupulous bucks keyword. bucks extension checking in a realistic time period.
3-step differential probes are preferred to signature checks for identifying vulnerabilities.
Ratproxy-style logic is applied to spot subtle security troubles: cross-site demand forgery, cross-site script incorporation, mixed content, issues MIME- and charset mismatches, erroneous caching directives, and so on.
Bundled security checks are made to handle tough scenarios: held XSS (way, parameters, headers), blind SQL or maybe XML injection, or maybe blind shell injection.
Report post-processing radically lessens the noise invoked by any rest fake positives or maybe server gimmicks by recognizing recurring patterns.
That said, skipfish isn’t a silver bullet, and may be inappropriate for definite reasons. For instance, it doesn’t satisfy most of the demands outlined in WASC Web Application Security Scanner Estimate Standard (several of them on objective, some out from need); and not like most different plans of that type, it doesn’t come with a widespread DB of recognized vulnerabilities for banner-type checks.
