There was a stretch a few years back when I needed to get a rough security picture of a fairly large internal application, fast, without spending days on manual crawling first. Skipfish was built exactly for that situation — it’s written in C, ridiculously fast compared to most scanners of its era, and produces an interactive HTML sitemap of the entire application alongside its findings. Even though development has slowed compared to newer tools, it’s still a genuinely useful, lightweight option worth knowing.
What Is Skipfish?
Skipfish is an active web application security reconnaissance tool originally developed by Google. It crawls a target application and performs a series of security-focused probes, generating an interactive sitemap annotated with security findings — ranging from informational notes to high-risk issues like SQL injection or XSS.
Its defining characteristic is speed: written in C rather than a scripting language, and built around a highly efficient, recursive crawl-and-probe architecture, it can process very large sites quickly relative to script-based scanners of comparable scope.
How Skipfish Works Internally
Skipfish’s architecture is built around a recursive crawler paired with a dictionary-based probing engine:
- Crawling — Skipfish recursively crawls the target, following links and submitting forms, building a full site structure map as it goes.
- Dictionary-based brute forcing — for every directory discovered, Skipfish also tries entries from a wordlist to discover hidden files, backup files, and directories not linked anywhere in the visible application (
/backup/,/admin/,/.git/, etc.). - Differential response analysis — Skipfish sends a range of crafted requests (with and without payloads) and statistically compares responses to reduce false positives — rather than just pattern-matching a single response, it looks at how the application’s behavior changes.
- Security checks per discovered resource — every URL Skipfish finds gets tested for a defined checklist of issues: injection flaws, directory listing exposure, insecure cookie flags, mixed content, outdated software signatures, and more.
- Report generation — output is a self-contained, interactive HTML report with an expandable sitemap tree, color-coded by severity, that you can browse offline.
Installation
On Debian/Ubuntu:
sudo apt install skipfish -y
From source:
git clone https://github.com/spinkham/skipfish.git
cd skipfish
make
Verify:
skipfish -h
Basic Syntax
skipfish -o <output_directory> [options] <target-url>
Command Examples
1. Basic scan (against a lab target):
skipfish -o /home/user/skipfish_results http://testlab.local/
Sample console output during the scan:
Scan statistics
---------------
Scan time : 0:03:12.428
HTTP requests : 42918 (223.5/s)
Compression : 78.2% of transfers saved (183 MB saved)
HTTP faults : 0 net errors, 0 proto errors, 0 retried, 0 drops
TCP handshakes : 412 total (104.1 req/conn)
TCP faults : 0 failures, 0 timeouts, 3 purged
External links : 218 skipped
Reqs pending : 0
2. Using a specific dictionary wordlist:
skipfish -o results/ -S /usr/share/skipfish/dictionaries/complete.wl http://testlab.local/
3. Authenticated scan with a session cookie:
skipfish -o results/ -C "PHPSESSID=abc123" http://testlab.local/
4. Limiting crawl depth and request rate (politer scanning):
skipfish -o results/ -d 3 -m 5 http://testlab.local/
5. Excluding specific paths (e.g., a logout link that would kill the session):
skipfish -o results/ -X "/logout" http://testlab.local/
Key Options
| Flag | Purpose |
|---|---|
-o | Output directory for the HTML report (required) |
-S | Path to dictionary wordlist file |
-C | Custom cookie header for authenticated scans |
-d | Maximum crawl depth |
-m | Max requests per second (rate limiting) |
-X | Exclude a specific path from crawling |
-A | HTTP auth credentials (user:pass) |
-b | Browser/UA fingerprint to mimic (i for IE, f for Firefox, etc.) |
Real-World Use Cases
- Fast baseline reconnaissance: When you need broad coverage of a large application quickly, Skipfish’s speed advantage over script-based scanners is real.
- Hidden content discovery: Its dictionary-based brute forcing regularly surfaces forgotten backup files, exposed
.gitdirectories, and admin panels not linked from the visible site. - Internal network assessments: Useful for quickly mapping and probing large numbers of internal web applications during an internal penetration test.
- Legacy/CI integration: Organizations with existing Skipfish-based pipelines (built years ago) still use it as part of a broader automated testing suite alongside newer tools.
Workflow: Integration With Other Tools
- WhatWeb first, to understand the tech stack before committing to a full crawl.
- Skipfish for a fast, broad sitemap and initial vulnerability sweep.
- Manual review of the HTML sitemap — its interactive report is genuinely useful for spotting interesting, unlinked endpoints a human should look at directly in Burp Suite.
- Deep-dive tools (SQLMap, Commix, Wapiti) applied specifically to any parameters/endpoints Skipfish’s report flags as high or medium severity.
Performance Optimization
- Skipfish is already fast by design, but on rate-limited or fragile targets, use
-mto cap requests per second and avoid overwhelming the server or triggering WAF blocks. - Use a smaller, targeted dictionary (
-S) instead of the full “complete.wl” list when you only care about a specific category of hidden files. - Set
-dto a reasonable depth for very large sites to avoid excessive scan time on low-value, deeply nested pages.
Troubleshooting & Common Mistakes
- Scan takes far longer than expected: default dictionaries can be huge; switch to a smaller, curated wordlist for faster turnaround on time-boxed engagements.
- Session gets logged out mid-scan: exclude logout endpoints with
-X, and double check the cookie passed via-Cis still valid throughout the scan (some apps rotate session tokens). - High false-positive counts: like any automated scanner, Skipfish’s differential analysis reduces but doesn’t eliminate false positives — always manually verify medium/high findings before reporting them.
- Project appears stale/less maintained than newer scanners: this is a fair concern — Skipfish still works well for what it does, but pair it with actively maintained tools (Wapiti, Burp Suite) for comprehensive modern coverage rather than relying on it alone.
Best Practices
- Always rate-limit scans (
-m) against production or shared staging environments to avoid unintentional denial-of-service effects. - Review the generated HTML report methodically — the sitemap view often reveals application structure insights beyond just the flagged vulnerabilities.
- Combine Skipfish’s speed with a slower, more thorough scanner (Wapiti or Burp’s active scanner) for engagements where completeness matters more than turnaround time.
FAQ
Is Skipfish still actively maintained? Development has slowed significantly compared to newer tools, but it remains functional and is still packaged in major distributions. For cutting-edge vulnerability signatures, pair it with more actively maintained scanners.
How does Skipfish compare to Wapiti? Skipfish is generally faster (compiled C vs. Python) and includes strong hidden-content discovery via dictionary brute-forcing; Wapiti has more actively updated vulnerability-detection modules. Many testers use both for complementary coverage.
Can Skipfish handle JavaScript-heavy single-page applications? Like most non-browser-based crawlers, it primarily follows static HTML links and forms, so heavily JS-rendered SPAs may not be fully covered without supplementary manual crawling or URL seeding.
Lab Example
docker run --rm -it -p 80:80 vulnerables/web-dvwa
mkdir ~/skipfish_dvwa
skipfish -o ~/skipfish_dvwa -C "PHPSESSID=<session>;security=low" http://localhost/
Once the scan completes, open ~/skipfish_dvwa/index.html in a browser to explore the interactive sitemap and review flagged issues directly against DVWA’s known vulnerable pages.
Summary
Skipfish’s core strength is raw speed and efficient hidden-content discovery, wrapped in a genuinely useful interactive report format. While it’s not as actively developed as some newer alternatives, it remains a solid choice for a fast first-pass reconnaissance scan, especially on large applications where turnaround time matters — best used alongside more actively maintained tools for full, modern coverage.
References
- GitHub repository: https://github.com/spinkham/skipfish
- Original Google project documentation (archived): https://code.google.com/archive/p/skipfish/
- Man page:
man skipfish(after installation)