Skipfish is one of the Web application security Reconnaissance tools that comes pre-installed in popular security-focused operating systems like Kali Linux and Parrot Security OS. Skipfish is used to prepare an interactive sitemap for the target using recursive crawl and dictionary-based probes. The resulting map provides output after being scanned by security checks.
Hello everyone. In this lab, I will equip you with the knowledge to use Skipfish and identify potential security holes in websites.
So let’s get started.
.png)
For this purpose, you must have 3 things to be ready:
- First, you'll need Kali Linux installed and running on a virtual machine. This virtual environment isolates your scanning activities and safeguards your main computer. Make sure the virtual machine's network adapter is configured in a special mode called "Host-only" to allow communication between Kali and your target website.
.png)
- Next, you'll need a website to scan. In this tutorial, we'll use a website called Metasploitable2, which is deliberately designed to be vulnerable for educational purposes. This provides a safe space to practice without harming a real website. Make sure the virtual machine's network adapter is configured in a special mode called "Host-only" to allow communication between Kali and your target website.
.png)
- Next, we need a Steady Internet Connection. A stable internet connection is essential for the scanning process to communicate with the target website. First, ensure you have a reliable internet connection. This is crucial for the scanning process to interact with the target website. Access your Kali VM, navigate to settings, then to Network adapter, and confirm that the second adapter is connected to the NAT network.
.png)
Once three prerequisites are in place, you're prepared to scan for vulnerabilities on target websites. To begin, we'll exploit a website running on Metasploitable2.
.png)
Before proceeding with the scanning process, it's crucial to identify the target's address. Open a terminal window in Kali Linux and execute the "netdiscover" command.
This command acts like a digital radar, searching your network for devices. It will list the discovered devices along with their IP addresses.
.png)
We already know previously that Metasploitable2 has a web page running on Port 80. Launch a browser, and you can access its web interface by typing the IP address into your web browser's address bar.
.png)
Let’s first scan this webpage and list out the web vulnerabilities.
Skipfish can be found within the "Web
Applications" menu in Kali Linux, usually under "Web Vulnerability
Scanners."
.png)
When you launch Skipfish, it displays a command window with instructions for using its various functionalities.
To run Skipfish against the target website, open a new terminal and enter Skipfish, select your output directory using -o followed by the location, and then set the target website.
If you want to use your preferred wordlist then select your wordlist using the -W option followed by the location of the wordlist.
Skipfish has its own built-in arsenal of tools for finding vulnerabilities. However, you can also use your own custom wordlist if you have specific areas you want to investigate. Custom wordlists can be created to target particular weaknesses or exploit specific vulnerabilities. There are many resources online that can guide you through creating your own wordlists.
If everything is set up correctly, Skipfish will display a
message indicating the scan will begin shortly, usually around 60 seconds, or
when you press any key.
.png)
You can press the Spacebar key to see detailed information about the scan as it progresses, or you can simply wait for it to start automatically.
.png)
Scans can take varying amounts of time to complete, ranging from a quick 30 seconds to a few hours depending on the size and complexity of the target website. If you need to stop the scan early for any reason, you can press Ctrl+C.
.png)
Once the scan is finished or if you end it early, Skipfish will generate a collection of files in the folder you specified earlier.
.png)
Open the file named "index.html" in a web browser. This file displays the scan results in a user-friendly format.
.png)
You can explore the report using the dropdown menus to navigate through the different vulnerabilities discovered by Skipfish.
Let’s do another website but this time a live one from the Internet. This time we will scan a deliberately vulnerable website called, testphp.vulnweb.com.
Be aware that this website is intentionally vulnerable for
educational purposes. This website is specifically designed to be scanned for
educational purposes.
The process is almost identical to what we did before. Just replace the Metasploitable2 address in your Skipfish command with the URL.
.png)
This time, we'll observe how long the scan takes. Scans can vary depending on the website's size and complexity, so it's difficult to predict an exact time. Be patient and let Skipfish do its job.
.png)
As before, navigate to the output folder you specified in the command and open the "index.html" file in your web browser.
.png)
This will display the scan results for http://testphp.vulnweb.com/, highlighting any potential vulnerabilities Skipfish discovered. Regarding the scan duration, it took 41 minutes and 57 seconds to complete on my PC.
