It's easy to use, he claims.
And, he says, it incorporates advanced security logic, which helps reduce the likelihood of generating false positives. The techniques used in skipfish are similar to those used in another security tool that Google released in 2008 called ratproxy.
"As with ratproxy, we feel that skipfish will be a valuable contribution to the information security community, making security assessments significantly more accessible and easier to execute," he says.
However, in the skipfish documentation, Zalewski notes that the software is not a silver bullet for security problems and may not be right for certain purposes. "For example, it does not satisfy most of the requirements outlined in WASC Web Application Security Scanner Evaluation Criteria," he writes. "And unlike most other projects of this type, it does not come with an extensive database of known vulnerabilities for banner-type checks."
The link for this article located at Information Week is no longer available.