Google unveils skipfish Web Application Security Scanner
Post date: Aug 27, 2012 4:49:50 AM
Originally posted March 22, 2010
Google unleashes skipfish, a web application security scanner akin to Nessus
"The safety of the Internet is of paramount importance to Google, and helping web developers build secure, reliable web applications is an important part of the equation."
I really am amazed how hard Google works to make the Internet better for everyone, one day, one service, one app at a time.
Here’s a snippet from their detailed documentation page outlining a rough list of the security checks offered by the tool:
High risk flaws (potentially leading to system compromise):
Server-side SQL injection (including blind vectors, numerical parameters).
Explicit SQL-like syntax in GET or POST parameters.
Server-side shell command injection (including blind vectors).
Server-side XML / XPath injection (including blind vectors).
Format string vulnerabilities.
Integer overflow vulnerabilities.
Medium risk flaws (potentially leading to data compromise):
Stored and reflected XSS vectors in document body (minimal JS XSS support present).
Stored and reflected XSS vectors via HTTP redirects.
Stored and reflected XSS vectors via HTTP header splitting.
Directory traversal (including constrained vectors).
Assorted file POIs (server-side sources, configs, etc).
Attacker-supplied script and CSS inclusion vectors (stored and reflected).
External untrusted script and CSS inclusion vectors.
Mixed content problems on script and CSS resources (optional).
Incorrect or missing MIME types on renderables.
Generic MIME types on renderables.
Incorrect or missing charsets on renderables.
Conflicting MIME / charset info on renderables.
Bad caching directives on cookie setting responses.
Low risk issues (limited impact or low specificity):
Directory listing bypass vectors.
Redirection to attacker-supplied URLs (stored and reflected).
Attacker-supplied embedded content (stored and reflected).
External untrusted embedded content.
Mixed content on non-scriptable subresources (optional).
HTTP credentials in URLs.
Expired or not-yet-valid SSL certificates.
HTML forms with no XSRF protection.
Self-signed SSL certificates.
SSL certificate host name mismatches.
Bad caching directives on less sensitive content.
Internal warnings:
Failed resource fetch attempts.
Exceeded crawl limits.
Failed 404 behavior checks.
IPS filtering detected.
Unexpected response variations.
Seemingly misclassified crawl nodes.
Non-specific informational entries:
General SSL certificate information.
Significantly changing HTTP cookies.
Changing Server, Via, or X-... headers.
New 404 signatures.
Resources that cannot be accessed.
Resources requiring HTTP authentication.
Broken links.
Server errors.
All external links not classified otherwise (optional).
All external e-mails (optional).
All external URL redirectors (optional).
Links to unknown protocols.
Form fields that could not be autocompleted.
All HTML forms detected.
Password entry forms (for external brute-force).
Numerical file names (for external brute-force).
User-supplied links otherwise rendered on a page.
Incorrect or missing MIME type on less significant content.
Generic MIME type on less significant content.
Incorrect or missing charset on less significant content.
Conflicting MIME / charset information on less significant content.
OGNL-like parameter passing conventions.
For more information check out the Google code page for skipfish and Google’s Online Security Blog. When I have the chance to try it out I’ll be sure to update this post with my thoughts.