Jikto turns any PC into my little drone. Your PC will start attacking Web sites on my behalf, and you're going to give me all the results.
Jikto is a Web application vulnerability scanner. It can silently crawl and audit public Web sites, and then send the results to a third party, Hoffman said. Jikto can be embedded into an attacker's Web site or injected into trusted sites by exploiting a common Web security hole known as a cross-site scripting flaw
Because it is created in JavaScript, a scripting language commonly used on the Web, Jikto will run in most Web browsers without any warning. Internet users who hit a Web site with Jikto embedded likely won't even know what's happening. The tool will run as long as the browser is open and disappear without any obvious trace, or residual damage