Using Skipfish for web application recon

Skipfish is an extremely fast web application reconnaissance tool. It is all written in C, so it's extremely fast and highly optimized. Because of this, it can perform many tests against hosts to generate impressive reports.

In my lab, I scanned my target host, and it took about 7 hours or so. But the information that came from the report was impressive. Make sure you take into account the time frame. Hardware also plays a key role in this. I was running my scan from a Raspberry Pi. For my test, I ran the following command via the CLI:

root@pi-kali:~# skipfish -o 202 http://192.168.33.31/dvwa

The number of requests per second that are being done will dictate how long the test will take. If that number ...

Get Penetration Testing Bootcamp now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.