All right, last tool before we get into persued and bug hunting, so McDo, what is it?
NICTA is a tool that performs comprehensive tests against Web servers, it searches for service configurations,
it checks for outdated versions of servers, it scans for dangerous files and programs on the Web page.
It has many useful features that we can read at this page.
This is a page on dot org website and it has anecdotal description on there.
Here we have it features so we can read through them.
It has a self-support, full HTP proxy support checks for outdated server components, which we already
mentioned.
You also have the option to save your reports in different file types.
We can go all the way down.
Identifiers installed softwares, your headers and files host authentication with basic and TLM subdomain
guessing.
So it pretty much performs website numeration and vulnerability assessment altogether.
However, the most important thing that gives us is which softwares are outdated.
OK, but we want to see the basic use of it.
And if you find it still useful, feel free to check out all of the other options that you can use with
the combination of your scans.
And for us to run the tool help menu, we can open the terminal.
And we can type NICTA.
This will open a small health menu for us, and here we can see some of the options that we can use
with this talk.
However, for our basic scan, the most important option for us and the one that we must specify is
the dish host option, as we can see, is description says the Dish host specifies target host or you
are out.
So let's scan our old WASP virtual machine.
We're going to type Knechtel Bash host and then the IP address of your machine.
In my case right now, it's one night to the 168.
That one.
That five.
If you press enter, it'll start the Knechtel scan and NICTA tool is made to perform these scans fast
so they will usually not take more than a couple of minutes at max.
So let's wait for this to finish and then we're going to read through some of the information that we
got right here.
And it's that it took around 30 seconds and this is the output that we get at the very beginning.
We got some target information as well as the server configuration.
It tells us which version is it using.
And down here, it describes each of those versions and what it managed to find.
That might be interesting for us, as we can see.
Let's go from here the to click tracking extreme options.
Heather is not present.
The access protection Heather is not defined.
And it gives us a description why this might be useful.
As it says this Heather can hint to the user agent to protect against some forms of access and access
is once again the attack.
The will cover later.
Down here, it tells us some of the versions that it is running pretty much the same output that Apple
gave us.
We got the Apache 2.0 point fourteen, and it tells us that this version appears to be outdated.
Current is at least Apache, two point four point thirty seven.
It tells us pretty much for any plug that our always, Pazz, that it appears to be outdated and what
does an outdated mean to a penetration tester?
Well, it means probably a bunch of vulnerabilities, because most of the time a certain plugin gets
updated and gets a newer version because of a previous bug or a previous vulnerability.
If we go all the way down, it tells us that the Python version that it's running appears to be outdated,
the Pearl version appears to be outdated.
Pretty much everything is outdated.
We get the allowed HDP methods, which is get ahead, post options and trace and down here, that would
be pretty much it.
It also gives us some output as to which directories might be interesting for us that Knechtel managed
to discover, for example, this my admin is a directory that we already found and it tells us that
this might be interesting for us down here.
OK, awesome.
And this would be a simple nick to scan, it gave us some information, mostly that many plug ins are
outdated.
And if you want to combine Nick Toscan with other options that thing offers us, feel free to use them.
These other options are there in order to make a scan more precise.
For example, if we run Nick Tomana once again.
We can see, let's say this option port defines which port we are scanning by default it's set to port
at, which is a default HTP port.
But remember that our end maps can give us a result that there is HTP servers running also on Port 80
81.
Well, we can scan that as well.
With Knechtel.
All we have to do is type Knechtel, Dasch host and then the IP address of our target.
And we can also add the dash port option and specify which port we want to scan.
Once you press enter, it will target that port and it will print out the information about that port
only.
And here is the result, it's much less information than with our previous can, but we do got some
things here as well.
For example, this is the same as in the previous can we got that GETI version appears to be outdated.
We also got which allowed HTP methods.
Does it have?
And we got some interesting directories, for example, slash admin, slash access slash admin dot index
page, the amount.
It tells us that it found an admin login page on this directory.
OK, awesome.
We are done with website enumeration, all we are left to do now is to set up our tool, get introduced
to its basics and we are fully ready for discovering website vulnerabilities straight after that.
Soon, the next video.