Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We recently set up Nessus, but the annual cost is not cheap. Recently Google published SkipFish which appears to compete in the area of webapps.

As best I can tell, Nessus operates via a large database of known exploits. And, as best as I can tell, Skipfish automatically generates vulnerability tests. Has anyone done a comparison of the effectiveness of these two approaches yet?

share|improve this question

Have you considered OpenVAS? It forked from Nessus when they closed source. Nessus and OpenVAS as opposed to SkipFish are less Web application focused and intended to cover a variety of daemons.

What are the requirements you're trying to meet?

share|improve this answer
openvas is a hard way to go, its lacking in docs and userbase – Tom H Feb 1 '12 at 4:19

Skipfish and Nessus have different objectives (although they share some checks).

  • skipfish is web vulnerability scanner: its mission is to find web apps vulnerabilities. On the lines of w3af and webscarab (but different).
  • Nessus is a vulnerability port scanner: its mission is to find vulnerabilities on open ports on a system. Besides, Nessus can also do compliance audits.

That said, Nessus also does some basic web vulnerability scanning that improves when used alongside nikto.

I don't know how you could compare them, knowing that they would output different kind of information.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.