Risk
3/19/2010
05:23 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Releases Free Web Security Scanner

The open-source skipfish software can be used as preparation for a professional Web application security evaluation.

Google on Friday released an automated Web security scanning program called skipfish to help reduce online security vulnerabilities.

Though skipfish performs the same functions as other open-source scanning tools like Nikto and Nessus, Google engineer Michal Zalewski argues that skipfish has a several advantages.

It operates at high speed, thanks to optimized HTTP handling and a low CPU footprint, and can easily reach 2000 requests per second, he explains in a blog post.

It's easy to use, he claims.

And, he says, it incorporates advanced security logic, which helps reduce the likelihood of generating false positives. The techniques used in skipfish are similar to those used in another security tool that Google released in 2008 called ratproxy.

"As with ratproxy, we feel that skipfish will be a valuable contribution to the information security community, making security assessments significantly more accessible and easier to execute," he says.

However, in the skipfish documentation, Zalewski notes that the software is not a silver bullet for security problems and may not be right for certain purposes. "For example, it does not satisfy most of the requirements outlined in WASC Web Application Security Scanner Evaluation Criteria," he writes. "And unlike most other projects of this type, it does not come with an extensive database of known vulnerabilities for banner-type checks."

The need for security scanning tools is clear. In its Q3-Q4 2009 Trends Report, security vendor Cenzic found that 90% of Web applications have vulnerabilities.

As it happens, Cenzic offers a commercial vulnerability scanning service, starting at $399 a year, which includes nine Web attacks.

That's in addition to the attacks coming from cybercriminals, which are initially free but can incur significant costs after the fact.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8148
Published: 2015-01-26
The default D-Bus access control rule in Midgard2 10.05.7.1 allows local users to send arbitrary method calls or signals to any process on the system bus and possibly execute arbitrary code with root privileges.

CVE-2014-8157
Published: 2015-01-26
Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.

CVE-2014-8158
Published: 2015-01-26
Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.

CVE-2014-9571
Published: 2015-01-26
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.

CVE-2014-9572
Published: 2015-01-26
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.