Effective Vulnerability Reconnaissance for Content Management System Using Skip-Fish

Content Management Systems (CMS) is the platform for creating sites and information handling in an organized way. As CMS contains the Files and Folders there might be many vulnerabilities hidden and must be identified at the earliest. To make the platform secure, the Penetration Testing exercise needs to be conducted before the site goes live. In the penetration testing exercise, the Reconnaissance stage is where testers could use various security scanners to trace the file structure for vulnerabilities. Vulnerabilities such as site misconfiguration, sensitive information disclosure, hard-coded values in files, banner disclosure, etc. are a few of the vulnerabilities that are likely to get promoted to the production environment in case the penetration testing is not conducted. Likewise, vulnerabilities related to infrastructure such as technology obsolescence, and component misconfiguration could lead to a weak entry point for the exploitation of the system. One of the well-known scanners is "Skip-Fish" which helps in scanning, crawling, and providing a comprehensive identification of vulnerabilities possibly exploitable. We will discuss about Skip-Fish scanner and understand its usage during the reconnaissance phase. The outcome of the scanner would provide the strategy for the other phases in the penetration testing activity. For performing penetration testing over a Content Management System (CMS) system, the Skip-Fish tool can be of significant help.