In this next demonstration we're going to start with
replaying a saved Nikto request,
which is then followed by a configuration of Nikto in order
to use a proxy such as Burp Suite Pro.
We then move on to configuring Nikto to use authentication in
the form of setting up a PHP session cookie.
You'll learn about the different output formats and then receive a
quick demonstration of how you can modify the HTML output templates in
order to customize future reports that you get out of Nikto when
selecting the HTML output setting.
So now you've had a chance to see how you can replay the
positive findings that you have from a Nikto scan.
Now what if you wanted to actually put those into,
or run those through a proxy like Burp Suite Pro?
Well you can absolutely do that.
Let's go ahead and get that configured here. Minimize the terminal,
minimize the web browser, and we'll start up the Community Edition of Burp Suite.
We'll use a temporary project, we'll use the Burp defaults,
and take a look at the Proxy tab.
We'll turn intercept off, choose Options,
and we already have the proxy listener at 127.0.0.1 on port 8080.
So now we need to run a scan through Nikto and point it at this proxy listener.
So let's go ahead and minimize this, go back to the terminal,
and run a scan through the proxy.
We'll run this nikto ‑host and then the URL, or xvwa.
And we'll instruct Nikto to useproxy at localhost on port 8080.
We'll give this a try.
Target IP is proxied, target hostname xvwa.local on port 80.
And while this is running we'll hop over to Burp Suite to see the results.
So if we look at the HTTP History you can see all of the
requests and responses being proxied through Burp.
This is very handy if you wanted to take one of these,
for instance,
and then send that to your repeater or any of the other
tools that your proxy has available.
Also, you have your target site map now.
So that can help you if you have actual correct error codes and you
can take a look at some of the 200 status codes,
etc.
So setting up a proxy is as simple as that with Nikto.
All right, so now this scan is completed.
If you know that you're always going to use the same proxy settings and
configuration you can edit one of the config files.
We'll take a look at nano /etc/nikto.conf,
which is your default configuration file.
As you can see at the top here,
the authors of the Nikto application do strongly suggest that you copy
this file once you've made changes to it so that that way the file
won't be overridden when you do a git pull.
So let's scroll down a bit.
And there we have the proxy settings.
So we'll go ahead and enable these And we're not using a username
or password for the proxy, it's just Burp Suite.
Save this out and exit, and let's run another scan. This time I'm simply going
to select useproxy, press Enter, and target IP is proxied again and target
hostname xvwa. You can verify that this information is being proxied by going
to Proxy and HTTP History and there it is.
So let's jump back into our terminal, and we will cancel this scan,
Ctrl+C, and clear the screen. Nikto has the capability to set cookies
so that if you have something like a PHP session cookie you can use
that for your authentication needs.
So let's go ahead and take a look at how to configure that.
We'll begin by going to a browser that is currently pointed at Burp Suite.
So I've already changed the proxy settings in here.
And then I would perform a login of bee and bug. And I'll hop
over here to Burp Suite and scroll to the top.
There we have our login where we used the login bee and password bug.
Then we've got our response here.
We've got a PHP session ID.
So let's go ahead and look around.
Maybe go to this one here.
Click Hack. We'll take a look at that request.
The session ID remains the same, and that cookie is being passed
each time. So we'll copy this and then go to Kali, and we're going
to modify the /etc/nikto.conf file again.
Let's scroll down to STATIC‑COOKIE. And we will paste that
cookie in there and then add the proper quotes.
There is an example above this.
There we go.
We'll write this out and exit.
Now we're going to run a scan and use the proxy so that we
can see how Nikto is using the cookie.
So here we have a scan, nikto ‑host, the URL, or the portal.php
page, we're instructing it to use the proxy that we've got set
up and ‑nossl. Give this a try.
There we go.
We can take a look at one of these.
Look at the response and request.
We'll look at the parameters. And you can see that the PHP session ID
cookie is being passed with each of these requests.
All right,
so moving on, let's take a look at some of the different
output formats that Nikto permits.
Take a look at nikto ‑Help. Scroll up here.
And if you use the ‑Format option you could save output as
CSV, JSON, HTM, NBE, SQL, TXT, and XML.
Okay,
so we're going to run a basic scan using Nikto at the host 192.168.30.135 on
default port 80, using the ‑Format option, and htm is the format that we
want, and the output file to be named nikto.html.
So let's give this a try.
There we go.
Let's take a look at the file that was generated.
We've got nikto.html so we'll use Firefox to view this file.
And here is a very nice report.
It gives you information about your server, it has all of your findings,
it has links to your server, and a summary of the host.
What if you wanted to change the colors or change the title of this output?
Well you can absolutely do that.
Let's go ahead and close this out. Go back into the
terminal and we will clear the screen.
We'll take a look at one of the template files that we have in
the nikto/templates directory. So we will edit the htm_start.tmpl
file. And you can modify the title or you can change the styles.
If we wanted larger font,
for instance, you could change that here. You can change
the colors and pretty much make the report something that's
very specific for your needs.
Now, please do keep in mind that you are not permitted to modify or
remove the copyright statements within these templates.
You could technically place them into a different template that's being used,
but they absolutely must remain within the reports that are being generated.
So let's close this out. Exit.
We can run another scan to see the modifications.
So let's take a look at it. And the font's a bit
larger now. It's still the same report.
Let's scroll down and look at the results of the report.