Edit

nikto

Nikto is an open-source web server scanner that detects vulnerabilities and misconfigurations. It sends HTTP requests and provides a detailed report.

Nikto is a free and open-source web server scanner that is widely used for detecting vulnerabilities and security issues in web applications. It is designed to perform comprehensive scans of web servers and identify potential security risks that could be exploited by attackers.

Nikto was developed in Perl and is distributed under the GPL license. It is capable of scanning web servers running on various operating systems, including Windows, Linux, and macOS. It is also compatible with a wide range of web servers, including Apache, IIS, and Nginx.

The tool is primarily used by security professionals, web developers, and system administrators to assess the security posture of web servers and web applications. Nikto uses a database of known vulnerabilities and attacks to detect potential security issues and provide a detailed report of its findings.

Some of the key features of Nikto include the ability to scan multiple web servers simultaneously, support for SSL encryption, integration with other security tools such as Nmap, and the ability to customize scans based on specific requirements. It also provides a command-line interface that can be used to perform automated scans.

Nikto scans web servers by sending HTTP requests to the server and analyzing the responses. It performs a range of tests to detect vulnerabilities such as outdated software, insecure configurations, default credentials, and other potential security issues. The tool also checks for common misconfigurations such as directory listings, insecure headers, and information leakage.

The output of Nikto is presented in a comprehensive report that includes a summary of the findings, detailed information about each vulnerability, and recommendations for remediation. The report also includes a severity rating for each vulnerability, which can be used to prioritize remediation efforts.

While Nikto is a powerful security tool, it is not without its limitations. It can produce a high number of false positives, which can make it difficult to distinguish between real vulnerabilities and false alarms. Additionally, the tool can be resource-intensive, and its scans can sometimes take a long time to complete.

Overall, Nikto is an essential tool for anyone involved in web application security. It is easy to use, highly customizable, and provides valuable insights into the security posture of web servers and web applications. By using Nikto to scan for vulnerabilities, security professionals can proactively identify and remediate security issues before they can be exploited by attackers.

Nikto Usage Example

- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.0.102
+ Target Hostname:    192.168.0.102
+ Target Port:        80
+ Start Time:         2018-03-23 10:49:04 (GMT0)
---------------------------------------------------------------------------
+ Server: Apache/2.2.22 (Ubuntu)
+ Server leaks inodes via ETags, header found with file /, inode: 287, size: 11832, mtime: Fri Feb  2 15:27:56 2018
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ "robots.txt" contains 1 entry which should be manually viewed.
+ Uncommon header 'tcn' found, with contents: list
+ Apache mod_negotiation is enabled with MultiViews, which allows attackers to easily brute force file names. See http://www.wisec.it/sectou.php?id=4698ebdc59d15. The following alternatives for 'index' were found: index.html
+ Apache/2.2.22 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS
+ 371 requests: 0 error(s) and 9 item(s) reported on remote host
+ End Time:           2018-03-23 10:50:44 (GMT0) (100 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
:~#
:~# firefox report.html

Packages and Binaries:

nikto

Nikto is a pluggable web server and CGI scanner written in Perl, using rfp’s LibWhisker to perform fast security or informational checks.

Features:

  • Easily updatable CSV-format checks database

  • Output reports in plain text or HTML

  • Available HTTP versions automatic switching

  • Generic as well as specific server software checks

  • SSL support (through libnet-ssleay-perl)

  • Proxy support (with authentication)

  • Cookies support

Installed size: 2.22 MB How to install: sudo apt install nikto

Dependencies:

  • libnet-ssleay-perl

  • perl

nikto

Scan web server for known vulnerabilities

replay

Updated on: 2023-Mar-08

PreviousdirbNextlegion

Last updated

Was this helpful?