3 ms·

I'm not really understanding this tool. What does it find exactly?

• tptacek 17y ago
  You aim it at a URL. It asynchronously launches thousands of requests based on a very large wordlist. It scrapes the responses and spiders them. As it identifies actual pages, it fuzzes them with strings that tickle web app flaws. It analyzes the responses. For instance, it tries to inject "skipfish://whatever" URLs into fields, parameters, and links; then it looks to see whethe those URLs appear in "hot" places in the response, like headers or link tags. It's looking for --- primarily --- : * Cross-site scripting and content injection * Best practices problems (like failing to declare charsets properly) * Forms without XSRF tokens * SQL injection It's better than anything that I've written but I will hazard a guess that it finds things well in that order. It's bound to get better over time.