Skipfish is an active web application security reconnaissance tool from Google.

It prepares an interactive sitemap for the targeted site by carrying out a recursive crawl and dictionary-based probes. The resulting map is then annotated with the output from a number of active (but hopefully non-disruptive) security checks. The final report generated by the tool is meant to serve as a foundation for professional web application security assessments.

 

Advantages

• Free and open source.
• High speed: pure C code, highly optimized HTTP handling, minimal CPU footprint – easily achieving 2000 requests per second with responsive targets.
• Ease of use: heuristics to support a variety of quirky web frameworks and mixed-technology sites, with automatic learning capabilities, on-the-fly wordlist creation, and form auto completion.
• Automatic wordlist construction based on site content analysis.
• Probabilistic scanning features to allow periodic, time-bound assessments of arbitrarily complex sites.
• Cutting-edge security logic: high quality, low false positive, differential security checks, capable of spotting a range of subtle flaws, including blind injection vectors.

Tests Implemented

A rough list of the security checks offered by the tool is outlined below.

• Server-side SQL injection (including blind vectors, numerical parameters).
• Explicit SQL-like syntax in GET or POST parameters.
• Server-side shell command injection (including blind vectors).
• Server-side XML / XPath injection (including blind vectors).
• Format string vulnerabilities.
• Integer overflow vulnerabilities.
• Stored and reflected XSS vectors in document body (minimal JS XSS support present).
• Stored and reflected XSS vectors via HTTP redirects.
• Stored and reflected XSS vectors via HTTP header splitting.
• Directory traversal (including constrained vectors).
• HTTP credentials in URLs.
• Self-signed SSL certificates.
• Internal warnings like failed resource fetch attempts,  exceeded crawl limits, Failed 404 behaviour checks etc.
• And many more..

Download skipfish

The following list of products and tools provide web application security scanner functionality.

Commercial Tools

• Acunetix WVS by Acunetix
• AppScan by IBM
• Burp Suite Professional by PortSwigger
• Hailstorm by Cenzic
• MileScan Web Security Auditor by MileSCAN Technologies
• N-Stalker by N-Stalker
• Nessus by Tenable Network Security
• NetSparker by Mavituna Security
• NeXpose by Rapid7
• NTOSpider by NTObjectives
• Retina Web Security Scanner by eEye Digital Security
• WebApp360 by nCircle
• WebInspect by HP
• WebKing by Parasoft

Software-as-a-Service Providers

• AppScan OnDemand by IBM
• ClickToSecure by Cenzic
• QualysGuard Web Application Scanning by Qualys
• Sentinel by WhiteHat
• Veracode Web Application Security by Veracode
• WebInspect by HP
• WebScanService by Elanize KG

Free / Open Source Tools

• Grabber by Romain Gaucher
• Grendel-Scan by David Byrne and Eric Duprey
• Paros by Chinotec
• Powerfuzzer by Marcin Kozlowski
• SecurityQA Toolbar by iSEC Partners
• W3AF by Andres Riancho
• Wapiti by Nicolas Surribas

Related posts

• Google wave for dummies
• Using Gmail advanced search
• Content-Aware Fill in Adobe Creative Suite 5
• Android running on Windows Mobile
• Google Phone – Nexus One

Portable Document Format (PDF) is a file format created by Adobe Systems in 1993 for document exchange. PDF is used for representing two-dimensional documents in a manner independent of the application software, hardware, and operating system.

PDF is a commonly accepted document format and so we might need to create PDF documents dynamically. We can create PDF documents with PHP. Lots of PDF generation PHP libraries are available. TCPDF and EZPDF are the two good opensource libraries which allow us to create PDF documents dynamically.

1) EZPDF

EZPDF is a fast and easy to use library developed by R&OS Ltd.

1.1) Creating a PDF document using EZPDF

We need 2 php files “class.ezpdf”, “class.pdf” and a font(in .afm) format. You can get these files from http://www.ros.co.nz/pdf/

1.2) Steps

1) Download the files from http://www.ros.co.nz/pdf/ and extract to our web application’s directory.

2) Include “class.ezpdf.php” in to our page.

3) Create an object of Cezpdf by $pdf =& new Cezpdf();

4) Set the required font.

5) Print our content of the document using the eZpdf functions.

6) Output/Save the PDF file.

Sample program

<?php
selectFont('/assets/libraries/pdf/fonts/Helvetica.afm');
$pdf->ezText('Hello!..This is a sameple PDF file',50);
$pdf->ezStream();
?>

We can format/design the document using the Ezpdf class’s methods. You can set margin, font, font size, colour, position etc using functions. We add images,links, draw shapes like line, curve, polygon etc to the document and we can set the border style also. Another good feature of this class is the support for creating tables, we can set the orientation, width, colour, row gap, column gap etc. We can encrypt the document and write to the disk if we want.

Ezpdf is a very simple to use PHP library for creating PDF files dynamically. Since it is opensource, you can extend the baseclass to change/add methods.

1.3) Features

• Lightweight
• Easy and simple
• Fast
• Opensource
• Automatic page break
• Support for adding/setting tables, images, links, shapes, fize, colour etc.

1.4) Limitations

• Doesnot supports UTF-8 Unicode and Right-To-Left languages.
• No methods to publish (x)HTML code

2) TcPDF

TCPDF is a popular Free and open source software PHP class for generating PDF documents. TCPDF is currently the only PHP-based library that includes complete support for UTF-8 Unicode and Right-To-Left languages

TCPDF supports all ISO page formats and custom page formats, custom margins and units of measure, UTF-8 Unicode, RTL languages, HTML, barcodes, TrueTypeUnicode, TrueType, OpenType, Type1, and CID-0 fonts, images, graphic functions, clipping, bookmarks, JavaScript, forms, page compression, digital signatures, and encryption.

2.1) Steps for creating a PDF files using TCPDF

1. Include the configaration file and the class file to the page.
2. Set the font, margin etc
3. Print the content to the pdf file
4. Output the pdf file.

Sample program

<?php
        setPrintHeader(false);
	$pdf->setPrintFooter(false);
	// set default monospaced font
	$pdf->SetDefaultMonospacedFont(PDF_FONT_MONOSPACED);
	//set margins
	$pdf->SetMargins(15, 15, 15);
	//set auto page breaks
	$pdf->SetAutoPageBreak(TRUE, PDF_MARGIN_BOTTOM);
	//set some language-dependent strings
	$pdf->setLanguageArray($l);
	// set font
	$pdf->SetFont('times', 'BI', 16);
	// add a page
	$pdf->AddPage();
	$htmlcontent .='Hello!..This is a sameple PDF file';
	$pdf->writeHTML($htmlcontent, true, 0, true, 0);
	$pdf->Output('myPdfExample.pdf', 'I');
	exit;
?>;

2.2) Features

• supports all ISO page formats;
• supports UTF-8 Unicode and Right-To-Left languages;
• supports TrueTypeUnicode, OpenTypeUnicode, TrueType, OpenType, Type1 and CID-0 fonts;
• supports document encryption;
• includes methods to publish (x)HTML code;
• includes graphic (geometric) and transformation methods;
• includes Javascript and forms support;
• includes a method to print various barcode formats: CODE 39, ANSI MH10.8M-1983, USD-3, 3 of 9, CODE 93, USS-93, Standard 2 of 5, Interleaved 2 of 5, CODE 128 A/B/C, 2 and 5 Digits UPC-Based Extention, EAN 8, EAN 13, UPC-A, UPC-E, MSI, POSTNET, PLANET, RMS4CC (Royal Mail 4-state Customer Code), CBC (Customer Bar Code), KIX (Klant index – Customer index), Intelligent Mail Barcode, Onecode, USPS-B-3200, CODABAR, CODE 11, PHARMACODE, PHARMACODE TWO-TRACKS;
• includes methods to set Bookmarks and print a Table of Content;
• includes a method to move pages;
• includes methods for automatic page header and footer management;
• supports automatic page break;
• supports automatic page numbering and page groups;
• supports JPEG and PNG images natively, all images supported by GD
• supports stroke and clipping mode for text;
• supports clipping masks;
• supports Grayscale, RGB, CMYK, Spot Colors and Transparencies;
• supports several annotations, including links, text and file attachments;
• supports transactions to UNDO commands;
• supports digital signatures

Tips & Tricks

I used following 2 tricks in my project, hope it will help you.

1. In EZPDF you can set the colour of the text, shapes, lines etc., the colour needs to be specified in RGB triplet, each in the range 0 to 1. Most of the tools(eg:- Colour picker, Adobe Photoshop) shows the colour in the range of 0-255 or in Hexadecimal format. If you want the colour values in the range of 0-1, divide the colour values by 255. For example Blue is rgb(0, 155, 255). You can convert it in to 0-1 range by dividing each values by 255. So the blue is rgb(0, 0.61, 1) in 0-1 range.

1. Specifying background colur for the document: When you add a new page, draw a rectangle in the size of that document and write all the content above that rectangle, so it will be like background colour for that page.

Conclusion

Both EZPDF and TCPDF are easy and powerful libraries, TCPDF has more features than EZPDF and it is still maintained by the developers where as EZPDF last updated on 17 June 2006. I used both EZPDF and TCPDF; for creating simple documents, I suggest EZPDF and if you want many features like UTF-8 / RTL support, HTML support etc. go for TCPDF.

You can find more details from the following sites.

• TCPDF: http://www.tecnick.com/public/code/cp_dpage.php?aiocp_dp=tcpdf
• EZPDF: http://www.ros.co.nz/pdf/
• Dynamically Generating PDF Files with PHP and Haru: http://devzone.zend.com/article/4044
• http://en.wikipedia.org/wiki/Portable_Document_Format

Related posts

• Content-Aware Fill in Adobe Creative Suite 5
• Skipfish – web application security scanner
• NetBeans IDE 6.8 Beta