This time, lets try to familiarize ourselves with Nikto Web Server Scanner. Nikto is an open source web server scanner “which performs comprehensive tests against web servers for multiple items, including over 6400 potentially dangerous files or CGIs, checks for outdated versions of over 1200 servers, and version specific problems on over 270 servers.
The good thing about Nikto is that it easy to use and and performs scanning faster. Nikto is coded in Perl and written by Chris Sullo and David Lodge. Although not all checks are really a big security problem but most are like XSS (Cross Site Scripting) Vulnerabilities, phpmyadmin logins, etc. Nikto alerts and gives you security tips in order to prevent your website from various attacks.
Nikto can be updated manually but the problem is the developer frequently updates this tool and it supports full HTTP proxy support and LibWhisker’s IDS encoding techniques although this is not really built as a stealthy tool because it is kinda obvious in log files but most website administrators (they just code websites, they don’t care about security) today don’t know how to read logs.
And so let’s begin playing with Nikto.pl:
1. Find a target! (I’m using my own web server, you should try your own website too.)
2. Locate nikto.pl by typing in the command line: locate nikto.pl
3. Move to the directory where Nikto is located. For example: cd /pentest/web/nikto/
4. Familiarize with the commands by executing the tool with the help command: perl nikto.pl -Help or ./perl -Help
5. If you just want to test your own server type: perl nikto.pl -host 127.0.0.1 or ./nikto.pl -host 127.0.0.1
6. For optimized and specific results, refer to the help commands.
After that, you should be able to see the results and flaws in your system. I guess were done. 🙂
Have fun pentesting geeks!