[Name] - Skipfish Modernized

[Version] - 3.1.0

[Homepage] - https://gitlab.com/fusiontechstrategies/skipfish-modernized

[Download] - https://gitlab.com/fusiontechstrategies/skipfish-modernized/-/releases/v3.1.0

[Author] - The original Skipfish scanner was created by Michal Zalewski, Niels Heinen, and Sebastian Roschke. This community modernization is maintained by Jeff Friedler, Fusion Technology Strategies.

[Licence] - Apache License 2.0 for the scanner and modernization changes. The source archive also identifies the retained licenses for inherited third-party files. The standalone Debian packaging is GPL-2+.

[Description] - Skipfish Modernized is a separately named modernization of the original Skipfish web application security scanner. It retains the fast native crawler while adding guided and rate-limited operation, live findings, HTML, JSON Lines and SARIF output, stable finding fingerprints, suppression auditing, baseline comparison, passive community rule packs, bounded local OpenAPI seeding, modern TLS and IDN handling, and current web-security checks. Potentially disruptive legacy probes are disabled by default, and the guided workflow requires explicit authorization confirmation.

The executable, helper commands, manual pages, runtime data, and package are named skipfish-modernized, so the tool can be installed alongside Kali's existing skipfish package without replacing it. This separate-tool route follows the maintainer direction recorded on the closed Skipfish merge request:
https://gitlab.com/kalilinux/packages/skipfish/-/merge_requests/3

[Dependencies] - Runtime dependencies produced by the current Kali package build are python3:any, libc6, libidn2-0, libpcre2-8-0, libssl3t64, and zlib1g. Source builds require build-essential, pkgconf, libssl-dev, libidn2-dev, libpcre2-dev, zlib1g-dev, and python3.

[Similar tools] - Kali's historical skipfish package is the closest relative. Nikto, Wapiti, and OWASP ZAP cover some overlapping web assessment use cases. Skipfish Modernized is intentionally a separate package rather than an in-place replacement. Its distinguishing features include a fast C crawler, bounded guided profiles, immediate machine-readable findings, stable scan comparison, and coexistence with the legacy scanner.

[Activity] - The original Skipfish codebase dates to 2009 through 2012. The community modernization began in 2026 and is actively maintained. Version 3.1.0 has a reproducible release archive, continuous GCC and Clang testing, sanitizer and fuzz coverage, static analysis, and a fully validated standalone Kali package candidate.

[How to install] - Build version 3.1.0 from its stable release archive rather than from the repository head:

sudo apt update
sudo apt install build-essential pkgconf libssl-dev libidn2-dev libpcre2-dev zlib1g-dev python3
curl -LO https://gitlab.com/-/project/85852111/uploads/ffd1e592cf0934d61ad400c4df7d4da9/skipfish-modernized-3.1.0.tar.gz
printf '%s %s\n' '806820fdadcc698861ef77e695ea03bc1ed7e4387c6346bb9c5af727fff90dd6' 'skipfish-modernized-3.1.0.tar.gz' | sha256sum -c -
tar -xzf skipfish-modernized-3.1.0.tar.gz
cd skipfish-modernized-3.1.0
make
make test

[How to use] - Running ./skipfish-modernized starts the guided workflow. A bounded command-line scan can be started with:

./skipfish-modernized -o report-safe -l 10 -r 15000 -O -S dictionaries/medium.wl https://authorized-target.example/

-l limits requests per second, -r caps the total request count, and -O prevents form submission. The tool should only be used against systems the operator owns or is explicitly authorized to assess.

[Packaged] - A standalone Debian/Kali package candidate named skipfish-modernized is prepared but is not yet present in Debian or Kali. It builds cleanly on Kali Rolling, passes current Lintian and build-log hardening checks, passes installed-package and legacy-coexistence autopkgtests, shares zero files with Kali's skipfish 2.10b package, and produces byte-identical binary packages in independent build paths. The public community upstream remains source-only in accordance with the earlier Kali review guidance. The packaging commit and full qualification evidence can be provided in the form Kali's maintainers prefer.