skipfish

Scan a website with default settings

$ skipfish -o [output_dir] [https://example.com]

$ skipfish -o [output_dir] -A [user]:[password] [https://example.com]

$ skipfish -o [output_dir] -W [wordlist.txt] [https://example.com]

$ skipfish -o [output_dir] -d [5] [https://example.com]

$ skipfish -o [output_dir] -X [/logout] [https://example.com]

$ skipfish -o [output_dir] -l [10] [https://example.com]

$ skipfish -o [output_dir] -C "[session=abc123]" [https://example.com]

skipfish [options] -W wordlist -o outputdir url [url_...]

skipfish is a high-performance web application security scanner that creates an interactive sitemap through recursive crawling and dictionary-based probing. It performs active security checks and generates an HTML report highlighting potential vulnerabilities.
The scanner detects issues including XSS, SQL injection, shell injection, directory traversal, and various server misconfigurations. It uses adaptive techniques to minimize false positives and handles modern web applications with AJAX and complex state management.
Output is an interactive HTML report with a sitemap showing discovered paths, parameters, and identified security issues. Each finding includes severity rating, description, and evidence. The report serves as a foundation for manual security assessment.

-o DIR

Output directory for report (required, must not exist)

Wordlist file for dictionary-based probing

Load additional scope rules

HTTP authentication credentials

Add custom cookie to all requests

Add custom HTTP header

Browser headers (MSIE, Firefox, iPhone)

Maximum crawl depth (default: 16)

Maximum children per node (default: 512)

Maximum total requests

Maximum requests per second

Only crawl URLs containing string

Exclude URLs containing string

Add domain to scan scope

Skip fuzzing specified parameter

Do not accept new cookies

Log mixed content (HTTP in HTTPS)

Log cache mismatches

Log external URLs found

Suppress duplicate nodes in report

Quiet mode; suppress console output

Verbose mode

Skipfish is resource-intensive on both the scanner and target server. Always obtain explicit authorization before scanning. The aggressive crawling can trigger DoS protections or generate large amounts of log data. Some dynamic applications may not be fully covered. Excluded patterns (-X) should include logout URLs to prevent session termination.

Skipfish was developed by Michal Zalewski (lcamtuf) at Google and released in 2010. Zalewski is renowned for security research including the AFL fuzzer. Skipfish was designed for speed and accuracy, using optimized HTTP handling and intelligent crawling algorithms. While development has slowed, it remains a useful tool for web application reconnaissance and automated security testing.

nikto(1), wpscan(1), sqlmap(1), burpsuite(1)