Time for the demo.
We begin with a quick review of the Nikto command line options,
which is then followed by a simple scan of an application server.
And after that,
I will perform a scan against multiple hosts and follow that
up with a review of available plugins.
The demo then wraps up with a quick example of how you
can configure and use a Nikto plugin.
For all of the demonstrations in this course,
I've got two different systems that I'm using.
One is a virtualized instance of the Vulnerable Web Apps,
which includes bWAPP, OWASP Hackacademic,
OWASP Juice Shop, and others.
If you want to get a copy of this yourself,
you can download it from vulnerablewebapps.org so that you
can follow along with these demonstrations.
So let's hop into the terminal of Kali.
I've already typed in nikto. And what this has done is provided a short list of
the different options that you can use when running Nikto.
For a more detailed list of options, you can use nikto ‑Help,
and then you have a lot of additional information that you did not have
available just by typing the command with no parameters.
So let's go ahead and run a default scan,
which with Nikto is very straightforward.
So we've got nikto ‑host, which is our target,
and then 192.168.30.135, which is the Vulnerable Web Apps
server. So go ahead and press Enter.
And depending on the size of the application that you're scanning,
sometimes these scans can take quite a while. If you
want to, you can press spacebar,
and that'll give you a status as your scan is running to give
you an idea of how much time you have left.
Okay, the scan has ended.
It took exactly 57 seconds, and it identified the server version.
It took a view at the anti‑clicking X‑Frame‑Options
header and found that it was not present.
It looked at the CGI directories. It tried to find some CGI directories.
It was unable to. And it does note that the Apache
version here seems to be outdated.
If you're doing a security assessment on this,
that might be something you'd want to look into after this scan,
and it also tells you your HTTP methods, such as GET, POST, OPTIONS, and HEAD,
and it notes that the Apache default file was found.
So let's go ahead and take a moment to scan one of the intentionally
vulnerable web apps, this one right here, bWAPP.
So what I can do is copy this, go back into our terminal, and we'll clear
this screen and do you nikto ‑host, and we'll use the http://, IP address,
//bWAPP so that we can scan that application.
Let's give that a try.
We've already got some additional information here,
such as bWAPP/documents: Directory indexing found.
So that's something that's interesting.
You'd want to check that out during an assessment.
You've got a folder called passwords that allows for directory indexing.
Nikto was able to find the phpinfo.php file, and the scan took 58 seconds.
And at this point in time,
I would go over all of the results and then try some of this stuff out.
So, in this case, maybe take a look at this directory here,
copy that, and we can paste it, and it looks like we have the
directory indexing like Nikto had told us. So now we could go into
some of these files and see what all is available.
If you create a text file and you enter the host information followed by Enter,
then you can have Nikto use that instead of providing a URL or an IP
address when you do nikto ‑h. So let's take a look at the Nikto
targets file, and what I've got here is three IP address of a host
with a colon and then the port.
So if this was on a different port,
I could've chosen to use 4040 or 8080 or whatever the
port is that I want it to scan.
And then also, I've got the URL http://, and I've got the
xvwa.local/xvwa so that we'll scan that application as well.
And the command is as simple as just going nikto ‑host and then niktotargets.
And we'll let that run.
This is on the first target, which is the 192.168.30.135.
And now we've started on this second host, and there we go.
We have now scanned multiple hosts based on the information that was in the
text file that I've created for Nikto targets. And this could easily have been
a list of hundreds or even thousands of targets.
Keep in mind some of these has to take a long time,
these scans,
so make sure that you take that into consideration
when you're creating these lists.
One of the nice features about Nikto is the capability to
leverage plugins, so let's go ahead and try to list the
plugins that are out there,
which is simply nickto ‑list‑plugins. And you'll have the plugin name,
a short description, and then the author.
So let's take a look at some of these. Here we have one plugin, robots.
It checks whether there's anything within the robots text file and then
analyzes it for other paths to pass into other scripts.
If you use the option nocheck, the flag to disable checking entries and robots
file will be used. And then that way you're not actually going to these files
and directories, and it's a bit more passive.
It will just check to see if the robots.txt exists.
So let's go ahead and try these out.
We'll begin by clearing the screen, and we'll try nocheck first, so nikto
‑Plugins. We have robots and then our option of nocheck.
And then we have to specify our host.
And we'll give this a try.
And yes, there is a robots.txt file.
It contains five entries,
which should be manually viewed. Now if we weren't attempting
to be quite that passive, then what we could do is eliminate
this option here and run it again.
And this time you have the entries listed and some additional information,
such as the fact that admin and robots.txt return a
non‑forbidden or redirect HTTP code of 200.
Let's clear the screen.
So let's take a look at how we can save the positive findings that we've
identified in a scan and then replay those with replay.po. So let's
start a normal scan. And in this case, we're going to ‑Save and then use
a period to tell it to auto name.
We'll let this scan run. All right, and now the scan is completed, so let's
take a look at the files here, 192.168.30.135 folder.
So we'll take a look at that, and we will list.
And here are all of these findings. These are the
positive findings that we've had.
So if we take a quick look at what one of these looks like, in this case,
the file that ends with 003584, and this contains all of the information
that Nikto will need when using the replay script.
So let's go ahead and clear this out.
Replaying this will be as simple as using replay.pl and then pasting the file
name in here and pressing Enter. Now there is a lot of information here. So
we've got the request to the 192.168.30.135 on port 80 for the icons and then
README. We've got a test ID. We've got the OSVDB ID, so that's short for Open
Sourced Vulnerability Database.
And then we've got the message.
So in this case, an Apache default file was found. And then its sent that
request and then indexed the response, and this is the file that we got so
that we know that this file still exists.