Nikto – Web Server Vulnerability Scanner for Security Enthusiast

0

What is Nikto?

Nikto is an Open Source software written in Perl language that is used to scan a web-server for vulnerability that can be exploited and can compromise the server. It will filter 6700 possibly risky documents/programs, check for outdated version details of 1250 server, and can detect problems with specific version details of over 270 severs. It can also fingerprint the server using favicon.ico files present in the server. It is not designed to be a particularly stealth tool rather than it is designed to be fast and time-efficient to achieve the task in very little time. Because of this, a web admin can easily detect that its server is being scanned by looking into the log files. It can also show some items that do not have security problems and we should gather the info, how to take full use of it and to secure the web-server more properly.

Important Features of Nikto:

● SSL Support (Unix with OpenSSL or maybe Windows with ActiveState’s Perl/NetSSL).
● Scanning features of Nikto are updated automatically.
● Full HTTP proxy support.
● Checks for outdated server components.
● Save reports in plain text, XML, HTML, NBE or CSV Formats.
● Template engine to easily customize reports.
● Scan multiple ports on a server, or multiple servers via input file (including Nmap output).
● LibWhisker’s IDS encoding techniques.
● Easily updated via a command-line function.
● Identifies installed software via headers, favicons, and files.
● Host authentication with Basic and NTLM.
● Subdomain guessing.
● Apache and cgiwrap username enumeration.
● Mutation techniques to “fish” for content on web servers.
● Scan tuning to include or exclude entire classes of vulnerability checks.
● Guess credentials for authorization realms (including many default id/passcode combos).
● Authorization guessing handles any directory, not just the root directory.
● Enhanced false positive reduction via multiple methods: headers, page content, and content hashing.
● Reports “unusual” headers captured.
● Interactive status, pause, and changes to verbosity settings.
● Save full request/response for positive tests.
● Replay saved positive requests.
● Maximum execution time per target.
● Auto-pause at a specified time.
● Checks for common “parking” sites.

Requirements:

Any system which supports a basic Perl installation should allow Nikto to run.

● Windows (using ActiveState Perl and Strawberry Perl). Some POSIX features, such as interactive commands may not work under Windows.
● Mac OSX.
● Various Linux and Unix installations (including RedHat, Solaris, Debian, Ubuntu, BackTrack, etc.).

Installation:

git clone https://github.com/sullo/nikto
# Main script is in program/
cd nikto/program
# Run using the shebang interpreter
./nikto.pl -h http://www.example.com
# Run using perl (if you forget to chmod)
perl nikto.pl -h http://www.example.com

Run as a Docker container:

git clone https://github.com/sullo/nikto.git
cd nikto
docker build -t sullo/nikto
# Call it without arguments to display the full help
docker run --rm sullo/nikto
# Basic usage
docker run --rm sullo/nikto -h http://www.example.com
# To save the report in a specific format, mount /tmp as a volume:
docker run --rm -v $(pwd):/tmp sullo/nikto -h http://www.example.com -o /tmp/out.json

Basic usage:

root@kali:~# nikto -Help

Options:
       -ask+               Whether to ask about submitting updates
                               yes   Ask about each (default)
                               no    Don't ask, don't send
                               auto  Don't ask, just send
       -Cgidirs+           Scan these CGI dirs: "none", "all", or values like "/cgi/ /cgi-a/"
       -config+            Use this config file
       -Display+           Turn on/off display outputs:
                               1     Show redirects
                               2     Show cookies received
                               3     Show all 200/OK responses
                               4     Show URLs which require authentication
                               D     Debug output
                               E     Display all HTTP errors
                               P     Print progress to STDOUT
                               S     Scrub output of IPs and hostnames
                               V     Verbose output
       -dbcheck           Check database and other key files for syntax errors
       -evasion+          Encoding technique:
                               1     Random URI encoding (non-UTF8)
                               2     Directory self-reference (/./)
                               3     Premature URL ending
                               4     Prepend long random string
                               5     Fake parameter
                               6     TAB as request spacer
                               7     Change the case of the URL
                               8     Use Windows directory separator (\)
                               A     Use a carriage return (0x0d) as a request spacer
                               B     Use binary value 0x0b as a request spacer
        -Format+           Save file (-o) format:
                               csv   Comma-separated-value
                               htm   HTML Format
                               msf+  Log to Metasploit
                               nbe   Nessus NBE format
                               txt   Plain text
                               xml   XML Format
                               (if not specified the format will be taken from the file extension passed to -output)
       -Help              Extended help information
       -host+             Target host
       -IgnoreCode        Ignore Codes--treat as negative responses
       -id+               Host authentication to use, format is id:pass or id:pass:realm
       -key+              Client certificate key file
       -list-plugins      List all available plugins, perform no testing
       -maxtime+          Maximum testing time per host
       -mutate+           Guess additional file names:
                               1     Test all files with all root directories
                               2     Guess for password file names
                               3     Enumerate user names via Apache (/~user type requests)
                               4     Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type requests)
                               5     Attempt to brute force sub-domain names, assume that the host name is the parent domain
                               6     Attempt to guess directory names from the supplied dictionary file
       -mutate-options    Provide information for mutates
       -nointeractive     Disables interactive features
       -nolookup          Disables DNS lookups
       -nossl             Disables the use of SSL
       -no404             Disables nikto attempting to guess a 404 page
       -output+           Write output to this file ('.' for auto-name)
       -Pause+            Pause between tests (seconds, integer or float)
       -Plugins+          List of plugins to run (default: ALL)
       -port+             Port to use (default 80)
       -RSAcert+          Client certificate file
       -root+             Prepend root value to all requests, format is /directory
       -Save              Save positive responses to this directory ('.' for auto-name)
       -ssl               Force ssl mode on port
       -Tuning+           Scan tuning:
                               1     Interesting File / Seen in logs
                               2     Misconfiguration / Default File
                               3     Information Disclosure
                               4     Injection (XSS/Script/HTML)
                               5     Remote File Retrieval - Inside Web Root
                               6     Denial of Service
                               7     Remote File Retrieval - Server Wide
                               8     Command Execution / Remote Shell
                               9     SQL Injection
                               0     File Upload
                               a     Authentication Bypass
                               b     Software Identification
                               c     Remote Source Inclusion
                               x     Reverse Tuning Options (i.e., include all except specified)
       -timeout+          Timeout for requests (default 10 seconds)
       -Userdbs           Load only user databases, not the standard databases
                               all   Disable standard dbs and load only user dbs
                               tests Disable only db_tests and load udb_tests
       -until             Run until the specified time or duration
       -update            Update databases and plugins from CIRT.net
       -useproxy          Use the proxy defined in nikto.conf
       -Version           Print plugin and database versions
       -vhost+            Virtual host (for Host header)
                          + requires a value

Conclusion:

Nikto is a simple tool for discovering potential issues and vulnerabilities in the web servers and that has the ability to run on the lowest specification computer system. The main advantage is that it will be updated regularly, which means that reliable results on the latest vulnerabilities are provided. This is especially handy if you’re doing application testing from a remote platform over a command-line protocol like SSH. It is quite easy to export targets to a file, feed that file to Nikto, then output results in a format that can be consumed by other tools. This tool is made for security researchers, and they can explore it.

Happy Hunting!

Previous articleHybrid Analysis – Free Automated Malware Analysis Sandbox
Next articleImportant Skills Required for Soc analyst from beginners to advanced level
Priyadharshini Balaji
A passionate security researcher in Malware and Penetration Testing.

LEAVE A REPLY

Please enter your comment!
Please enter your name here