Google releases Skipfish, an open-source web security scanner
It's Michel Zalewski's (known to his friends and those, like me, who fear him as "lcamtuf") code.It's a command-line Unix tool. It builds with almost no exotic deps other than GNU IDN.It's a pure-async wordlist-driven crawler/fuzzer. It is screaming fast on the network I'm testing it on. Because it's async, it's not bottlenecked on demand-threading for each request.It generates pretty HTML reports. Well, pretty for a C program.It's Apache licensed. There are things in here I'd probably steal, like the URL parser; it's much tighter than mine.How useful is this going to be for YC-style apps? Meh? You should definitely run it on your QA instance. Make sure you give it a login cookie to run with. It will find things. But where it looks like Skipfish is really going to do some damage is on the enterprisey J2EE- and .NET-stack apps.