【kali】33 WEB渗透——扫描工具Skipfish

Skipfish

一、Skipfish 简介

Skipfish是一款主动的Web应用程序安全侦察工具。它通过执行递归爬取和基于字典的探测来为目标站点准备交互式站点地图。最终的地图然后用来自许多活动（但希望是不中断的）安全检查的输出来注释。该工具生成的最终报告旨在作为专业Web应用程序安全评估的基础。

主要特征：

• 高速：纯C代码，高度优化的HTTP处理，最小的CPU占用空间 - 轻松实现响应目标的每秒2000个请求。
• 易于使用：启发式支持各种古怪的Web框架和混合技术站点，具有自动学习功能，动态词汇表创建和表单自动完成功能。
• 尖端的安全逻辑：高质量，低误报率，差分安全检查，能够发现一系列细微的缺陷，包括盲注入矢量。

二、 Skipfish 基本操作

1. 扫目标、扫文件

skipfish -o test http://1.1.1.1
skipfish -o test @url.txt		#指定目标IP列表文件

# 扫描url中必须包含字符串：/dvwa/ 才会扫
skipfish -o test1 -I /dvwa/ http://192.168.98.169/dvwa/
# 空格查看详细信息

2. 使用字典

使用字典可发现隐藏目录

skipfish -o test -S complet.wl -W abc.wl http://1.1.1.1 # 字典
 # wl  wordlist自身集成的字典
 # 查看wl
 dpkg -L skipfish
 dpkg -L skipfish | grep wl
 skipfish -o test2 -I /dvwa/ -S /usr/share/skipfish/dictionaries/minimal.wl  http://192.168.98.169/dvwa/

3. 一些开关

• -I 大写i 只检查包含´string´的 URL
• -X 不检查包含´string´的URL #例如：logout
• -K 不对指定参数进行 Fuzz 测试
• -D 跨站点爬另外一个域
• -l 每秒最大请求数
• -m 每IP最大并发连接数
• --config 指定配置文件

扫描结束太快，触发了目标站点的连接数限制，降低-m -l数值即可

4. 身份认证

Authentication and access options:

  -A user:pass      - use specified HTTP authentication credentials
  -F host=IP        - pretend that 'host' resolves to 'IP'
  -C name=val       - append a custom **cookie** to all requests

skipfish -C "PHPSESSID=a5b1d5b679e934f24bf6ae172dfbf8e0" -C "security=low" -X logout.php -I /dvwa/ -o test1 http://172.16.10.133/dvwa/

  -H name=val       - append a custom **HTTP header** to all requests
  -b (i|f|p)        - use headers consistent with MSIE / Firefox / iPhone
  -N                - do not accept any new cookies
  --auth-form url   - form authentication URL
  --auth-user user  - form authentication user
  --auth-pass pass  - form authentication password
  --auth-verify-url -  URL for in-session detection

Crawl scope options:

  -d max_depth     - maximum crawl tree depth (16)
  -c max_child     - maximum children to index per node (512)
  -x max_desc      - maximum descendants to index per branch (8192)
  -r r_limit       - max total number of requests to send (100000000)
  -p crawl%        - node and link crawl probability (100%)
  -q hex           - repeat probabilistic scan with given seed
  -I string        - only follow URLs matching 'string'
  -X string        - exclude URLs matching 'string'
  -K string        - do not fuzz parameters named 'string'
  -D domain        - crawl cross-site links to another domain
  -B domain        - trust, but do not crawl, another domain
  -Z               - do not descend into 5xx locations
  -O               - do not submit any forms
  -P               - do not parse HTML, etc, to find new links

Reporting options:

  -o dir          - write output to specified directory (required)
  -M              - log warnings about mixed content / non-SSL passwords
  -E              - log all HTTP/1.0 / HTTP/1.1 caching intent mismatches
  -U              - log all external URLs and e-mails seen
  -Q              - completely suppress duplicate nodes in reports
  -u              - be quiet, disable realtime progress stats
  -v              - enable runtime logging (to stderr)

Dictionary management options:

  -W wordlist     - use a specified read-write wordlist (required)
  -S wordlist     - load a supplemental read-only wordlist
  -L              - do not auto-learn new keywords for the site
  -Y              - do not fuzz extensions in directory brute-force
  -R age          - purge words hit more than 'age' scans ago
  -T name=val     - add new form auto-fill rule
  -G max_guess    - maximum number of keyword guesses to keep (256)

  -z sigfile      - load signatures from this file

Performance settings:

  -g max_conn     - max simultaneous TCP connections, global (40)
  -m host_conn    - max simultaneous connections, per target IP (10)
  -f max_fail     - max number of consecutive HTTP errors (100)
  -t req_tmout    - total request response timeout (20 s)
  -w rw_tmout     - individual network I/O timeout (10 s)
  -i idle_tmout   - timeout on idle HTTP connections (10 s)
  -s s_limit      - response size limit (400000 B)
  -e              - do not keep binary responses for reporting

Other settings:

  -l max_req      - max requests per second (0.000000)
  -k duration     - stop scanning after the given duration h:m:s
  --config file   - load the specified configuration file

5. 提交用户名密码表单

使用 man 手册

man skipfish

skipfish -o test1 --auth-form http://172.16.10.133/dvwa/login.php --auth-form-target http://172.16.10.133/dvwa/login.php --auth-user-field username --auth-user admin --auth-pass-field password --auth-pass password --auth-verify-url http://172.16.10.133/dvwa/index.php -I /dvwa/ -X logout.php http://172.16.10.133/dvwa/