Welcome to part seven of this module.
Now it's time to go over Skip fish.
It is located in applications web application analysis
skip fish can also open it in the terminal window by typing.
Skip fish tack H and that'll give us a read out of all of the help options as you can see there are
many ways to customize how this tool functions but strictly speaking this program runs in a very direct
and simple way you supply it a target and start the lengthy process of scanning it.
So to save time I'm going to lunch skip fish right away and explain well it does its thing once you
get a feel for Skip fish and what it does.
You can add some of these additional options to the command line and we'll be talking about those towards
the end of the video so to run skip fish in the simplest and most default possible way we type skip
fish tack lowercase o for the output directory we then specify the directory which in this case is going
to be the desktop.
And this is where the results of our scan are going to be stored and then we supply it with the target.
And this would be the Web site that you're scanning which of course in this case is the Met exploited
by a machine and we press enter
this screen appears every time we initially run skip fish we can press any key to continue or just wait
60 seconds and then a press enter.
So right away when we press Enter skip fish is going to create a results folder on the desktop.
You'll notice that once again our target is the mayor's political to virtual machine running on the
network but you could replace the 10 0 0 dot 8 with any Web site you are L that you wish.
But remember always to never run this tool against any target that you do not either personally own
or have written permission to test.
Otherwise you could be breaking the law with the process under way oh elaborate a bit on what is going
on here.
Skip fish is an active Web application security reconnaissance tool.
It was designed and built by get ready for it.
Google itself it comes prepackaged with Kali 2.0 and it's been around since the early days of backtrack
five.
This is one of those ancient tools that has been kept alive by user enthusiasm it prepares an interactive
site map for the target site by carrying out a recursive crawl and dictionary based probes.
The resulting map is then annotated with the output by carrying out a recursive crawl and dictionary
based probes.
The resulting map is then annotated with the output from a number of active but hopefully non disruptive
security checks.
The final report generated by the tool is meant to serve as a foundation for professional web application
security assessments.
Although it is just as often of use to hackers wishing to find vulnerabilities in a target site that
can be leveraged and exploited as I'm speaking skip Phish is performing a wide range of these tests
against our simulated target.
These are noisy and noticeable.
The scans can take anywhere from a few hours to a few days to complete depending on the complexity of
the target.
Unfortunately one drawback of this tool is you won't know going in just how long any such scan might
actually take.
And this can be a real problem for penetration testers who have to adhere to a tight schedule.
The tool boasts high performance values but it tends to be a bit of a hog when it comes to resources
and crawling over an entire site can slow things down measurably.
I mentioned that this tool uses word lists these come pre packed with the tool and I'll speak more about
them when the process is complete for now.
Just keep in mind that you can use the ones that come with the tool or you can supply your own.
However skip fish is a little weird in the fact that it likes to make changes to these lists as it goes.
So make sure you have a backup of whatever list you do decide to use.
If this is a consideration for you.
Alrighty so by now you're probably wondering why should we even bother with this particular tool.
A number of commercial and open source tools with the exact same functionality are readily available
such as Nick to Nexus and so on.
Compared to them.
Skip fish seems like a bit of a blunt blunt instrument for the most part.
It is.
I don't really recommend skip fish over the other major tools.
However it's been kept around for a long time because it does have a few selling points.
Skip fish addresses some common problems that tend to be associated with web security scanners.
For one thing it does offer high performance.
500 plus requests per scan against responsive Internet targets 2000 plus requests per second on local
area networks and seven thousand plus against local instances have actually been observed while leaving
a modest network and memory footprint.
This can be attributed to multiplex single thread fully a synchronous network IO and data processing
model that eliminates memory management scheduling the IP inefficiencies present in multi thread clients.
Remember this was developed by Google engineers.
It also offers advanced each TTP one point one features such as range requests content compression and
people live connections as well as forced response size limiting to keep network level overhaul in check
small response caching and Advanced Server behavior her sticks are used to minimize unnecessary traffic
it is written in pure C and includes a custom each TTP stack if all of that sounded a bit like I'm trying
to sell you a used car I do apologize but that is kind of what this tool is.
It's old but the engine still runs well and so that's why it's kept around in terms of ease of use.
Skip fish is highly adaptive.
The scanner itself features heuristic recognition of obscure path and query based parameter handling
schemes gracefully handling of multi framework sites where certain requests obey completely different
semantics or are subject to different filtering rules.
It also engages an automatic word list construction based on site content analysis.
That is what I meant when I said it likes to edit your word lists probabilistic scanning features.
Also allow periodic time bound assessments of arbitrarily complex sites.
Finally it well-designed security checks as the tool is meant to provide accurate and meaningful results.
Google developed it to improve the safety of Web sites and made it as simple as possible to use.
Though of course its black hat usage is considerable.
With all that being said Skip fish is not a silver bullet and it may be unsuitable for certain processes.
For instance it does not satisfy most of the requirements outlined in the web application security scanner
evaluation criteria.
And unlike most other programs of this type it does not come with an extensive database of known vulnerabilities
for banner type checks.
Also be aware that this tool is used by security professionals and is somewhat experimental in nature.
It may provide false positives or miss obvious security problems even when it is operating perfectly.
Do not take its output at face value.
And last but not least the scanner is simply not designed for dealing with rogue or misbehaving each
TTP servers.
So if you try it against them you've been warned to end the scan early.
Just press control see one way or another.
Once the process is complete or interrupted.
Skip fish will generate a report by creating a file in the path we specified when we ran the program.
So in this case it's going to be located on the desktop
so if we open up the results we can see that the file is actually pretty complex.
But to view them in the simplest terms we just double click on the index each PML file.
This will open our default web browser and present us with a report of course because our target was
a met a spoiler war machine.
There are going to be a lot of flaws and vulnerabilities.
For more information on a particular problem just click on it to expand we could open this in another
tab which I will do
and we can see all of the potential problems of which there are many
going back to the scan results
interesting files incorrect or missing character sets
X SS vector her in document body most of these to do with motility which is built to be exploitable
but you get the idea.
Now of course against a real machine hopefully you're not going to see anything like this many results
but the ones you do see should be very enlightening.
You can then look online and read about the particular vulnerability if the information that the report
itself presents you is inadequate by itself.
All right.
So at this point you have enough information to run skip fish against a target and hopefully you have
a good grasp of what this tool actually does.
If you don't feel like this would be a useful addition to your tool kit or you prefer other applications
you could end the video right here.
For those of you who wish more information I shall now be elaborating on some of Skip Fisher's more
detailed run options.
This section of the module will be somewhat short on demonstration as I'll be going over these one by
one.
As I said You do have enough information that you could now start playing with this on your own.
So continue if you wish and if not thank you for your attention to begin.
If you don't want to store the learned keywords anywhere which is to say you don't want skip fish to
mess around with editing your word lists you can run skip fish with the tack w tack option it would
look like this.
Pardon my typing.
Be aware also that you can run skip fish with multiple starting you are L's all of them will be crawled.
It is even possible to read your URLs from a file using the following syntax
skip fish tap WD hack
at and then you give it the path whatever the path happens to be two and then your list which might
be your RL list.
Text for example the tool will display some helpful stats will the scan is in progress.
You can also switch to a list of a real time each TTP requests by pressing the return key
so in the examples you've seen.
Skip fish scans the entire Web site or Web sites including services on other ports.
If they're linked to from the main page it then writes a report to the output directory that you specified
the index start each time l file that we launched to view the report is static.
But keep in mind the actual results are stored as a hierarchy of J S O N files suitable for machine
processing or different presentation front ends if need be.
In addition a list of all the discovered new URLs will be saved in a single file which is called Pivot
stock text a simple companion script.
S F S can diff can be used to compute a Delta for two scans executed against the same target with the
same flags.
The newer report will be non destructively annotated by adding red background to all new or changed
nodes and blue background to all new or changed issues found some sites may require authentication.
In most cases you'll be wanting to use the form authentication method which is capable of detecting
broken sessions in order to re authenticate once re authenticated certain you are ls on the site may
log out your session.
You can combat that in two ways.
The first is by using the TAC an option.
So that would look like Skip fish.
Oh
desktop results.
Tech.
And.
And then of course you'd supply your target
that causes the scanner to reject attempts to set or delete cookies.
You can also use the x parameter
which would look like X lock outs
which prevents matching your L's from being fetched
the tack X option is also useful for speeding up your scans by excluding items documents and manual
directories and other standard mundane locations like them.
In general you can use tack X and tack I to limit the scope of a scan.
Any way you'd like.
Even restricting it to only a specific protocol or port for example skip fish tack.
I player target
tech I restricts it to only spider you are ls matching substring and the colon.
One two three four is limiting the tool to scan only ports.
One two three four or whatever port you specify another related function is TAC K which allows you to
specify parameter names not to fuzz.
This would be useful for applications that put session ideas in the U or L's themselves and still another
useful scoping option is TAC D which allows you to specify additional hosts or domains to consider in
scope for the test by default.
All hosts appear in the command line you URLs are added to the list but you can use tack D to broaden
these rules for example.
Skip fish tap D and we'll say test dot dot com.
Pardon me rooftop desktop
and then we would supply our target which
we go and it would look like that or you could add a domain wildcard match which would look like this
example dot com and then just whatever your output directory is.
I don't want to retype it and supply your target
in some cases.
You do not want to actually crawl a third party domain but you trust the owner of that domain enough
not to worry about cross domain content inclusion from that particular location.
For example Google Analytics that would be a very popular one.
So to suppress those warnings you can use the TAC B option which would look like this fish tank would
be Google Analytics dot com and then tech B again.
Google Apple stock com and any other parameters that you like of course by default.
Skip fish sends minimalistic H TTP headers to reduce the amount of data exchanged over the wire.
Some sites examine user agent strings or header ordering to reject unsupported clients though in such
a case you can use the TAC lowercase b such as tack lower case b f f o x or tack lower case b phone
to mimic one of those two popular browsers or iPhone.
So in this case FFO X would be Firefox.
In other words for example when it comes to customizing your h TTP requests you can also add the TAC
each option to insert any additional non-standard headers or the TAC F to define a custom mapping between
a host and an IP the alter feature is particularly useful for any not yet launched or legacy services.
Some sites may be too big to scan in a reasonable timeframe particularly if you are under strict time
constraints by which you may conduct your penetration test.
If the site features well-defined tar pits for example 100 thousand nearly identical user profiles like
as part of a social network for instance these specific locations may be excluded with the TAC X and
tech s switches.
In other cases you may need to report other settings tack lower case d limits the crawl depth to a specific
number of sub directories TAC lowercase c limits the number of children per directory and tack lower
case x limits the total number of descendants per crawl tree branch.
Finally tack lower case r limits the total number of requests to send in a scan an interesting option
is available for repeating assessments tack P.
By specifying a percentage between 1 to 100 percent it is possible to tell the crawler to follow fewer
than 100 percent of all the links and try fewer than 100 percent of all the directory entries.
This naturally limits the completeness of a scan but unlike most other settings it does so in a balanced
non deterministic manner.
It is extremely useful when you are setting up time bound but periodic assessments of your infrastructure.
Another related option is TAC Q which sets the initial random seed for the crawler to a specific value.
This can be used to exactly reproduce a previous scan to compare results.
Randomness is relied upon most heavily in the TAC P mode but also for making a couple of others scan
management decisions elsewhere some particularly complex or broken services may involve a very high
number of identical or nearly identical pages.
Although these occurrences are by default grade out in the report they still use some screen estate
and take a while to process on a javascript level in such extreme cases you may use the TAC queue option
to suppress reporting of duplicate nodes altogether before the report is written.
This may give you a less comprehensive understanding of how the site is organized but has no impact
on the test coverage itself.
Some sites that handle sensitive user data care about SSL and about getting it right.
Skip fish may optionally assist you in figuring out problematic mixed content or password submission
scenarios.
Use the TAC M option to enable this.
The scanner will complain about situations such as each TTP scripts being loaded on each TTP pages but
we'll disregard non risk scenarios such as images likewise certain pedantic sites may care about cases
where caching is restricted on each TTP one point one level but no explicit.
Each TTP one point zero caching directive is given on specifying tak e in the command line which causes
skip fish to log all such cases carefully in some occasions you may want to limit the requests per second.
To limit the load on the target's server or to possibly bypass denial of service protection the TAC
lowercase L.
Pardon me lowercase L flag can be used to set this limit and the value given is the maximum amount of
requests per second that you want skip fish to perform scans typically should not take weeks.
In many cases you probably want to limit the scan duration so that it fits within a certain time window.
This can be done with the TAC K flag which allows the amount of hours minutes and seconds to be specified
in hours minutes seconds format.
Like that use of this flag can affect the scan coverage.
If the scan timeout occurs before testing all pages.
Lastly in some assessments that involve self-contained sites without extensive user content the auditor
may care about any external emails or each TTP link seem even if they have no immediate security impact.
Use the TAC uppercase U option to have these logged
dictionary management is a special topic.
For more information on this.
Check out the dictionaries text.
Located in the documents file some of the relevant options for dictionaries include Tak s and Tak w
which we covered earlier and Tak L to suppress auto learning.
That would be if you don't want the dictionaries to be edited as you're going with keywords that Skip
fish finds on the Web site Tak g to limit the keyword guest jar size tack or to drop old dictionary
entries and tack y to inhibit expensive keyword extension fuzzing skip fish also features a form auto
completion mechanic in order to minimize scan coverage the values should be non malicious as they are
not meant to implement security checks but rather to get past input validation logic.
You can also define additional rules or override existing ones with the TAC t option.
For example Tak t log n equals one two three TAC t password equals test three two one.
Although note that tax C and TAC a or a much better method of logging in and this is getting really
long so I'm going to delete some of these.
There's also a handful of performance related options use TAC lowercase G to set the maximum number
of connections to maintain globally to all targets.
It is generally sensible to keep this under 50 or so to avoid overwhelming the TPP IP stack on your
system or on the nearby net firewall devices.
And there's also tack m to set the per IP limit experiment a bit 2 to 4 is usually good for local host
4 to 8 for local networks and maybe 10 to 20 for external targets 30 plus for really lagged or non keep
alive hosts.
You can also
you can also use the TAC lowercase W to set the IO timeout.
For example skip fish will wait only so long for an individual reader right and tack t to set the total
request timeout.
That's lower case t to account for really slow or really fast sites finally tack lowercase f controls
the maximum number of consecutive H TTP errors.
You were willing to see before boarding the scan and tack lowercase s sets the maximum length of a response
to fetch and pass longer responses will be truncated when scanning large multimedia heavy sites.
You may also wish to specify tack lowercase e.
This prevents binary documents from being kept in memory for reporting purposes and frees up a lot of
RAM.
Further rate limiting is available through third party user mode tools such as trickle or kernel level
traffic shaping and last but not least real time scanning statistics can be suppressed with TAC lowercase.
You all right that pretty much does it for Skip fish.
I hope you found this tutorial helpful and that you find skip fish to be a useful tool in your tool
box.
Thank you.