Risk
3/19/2010
05:23 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Google Releases Free Web Security Scanner

The open-source skipfish software can be used as preparation for a professional Web application security evaluation.

Google on Friday released an automated Web security scanning program called skipfish to help reduce online security vulnerabilities.

Though skipfish performs the same functions as other open-source scanning tools like Nikto and Nessus, Google engineer Michal Zalewski argues that skipfish has a several advantages.

It operates at high speed, thanks to optimized HTTP handling and a low CPU footprint, and can easily reach 2000 requests per second, he explains in a blog post.

It's easy to use, he claims.

And, he says, it incorporates advanced security logic, which helps reduce the likelihood of generating false positives. The techniques used in skipfish are similar to those used in another security tool that Google released in 2008 called ratproxy.

"As with ratproxy, we feel that skipfish will be a valuable contribution to the information security community, making security assessments significantly more accessible and easier to execute," he says.

However, in the skipfish documentation, Zalewski notes that the software is not a silver bullet for security problems and may not be right for certain purposes. "For example, it does not satisfy most of the requirements outlined in WASC Web Application Security Scanner Evaluation Criteria," he writes. "And unlike most other projects of this type, it does not come with an extensive database of known vulnerabilities for banner-type checks."

The need for security scanning tools is clear. In its Q3-Q4 2009 Trends Report, security vendor Cenzic found that 90% of Web applications have vulnerabilities.

As it happens, Cenzic offers a commercial vulnerability scanning service, starting at $399 a year, which includes nine Web attacks.

That's in addition to the attacks coming from cybercriminals, which are initially free but can incur significant costs after the fact.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-4403
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.ph...

CVE-2012-2930
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers...

CVE-2012-2932
Published: 2015-04-24
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the (1) selitems[] parameter in a copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/...

CVE-2012-5451
Published: 2015-04-24
Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 2.1.0.3974 allow remote attackers to cause a denial of service (tvMobiliService service crash) via a long string in a (1) GET or (2) HEAD request to TCP port 30888.

CVE-2015-0297
Published: 2015-04-24
Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methos via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.