What is Nikto?
Nikto is an Open Source software written in Perl language that is used to scan a web-server for vulnerability that can be exploited and can compromise the server. It will filter 6700 possibly risky documents/programs, check for outdated version details of 1250 server, and can detect problems with specific version details of over 270 severs. It can also fingerprint the server using favicon.ico files present in the server. It is not designed to be a particularly stealth tool rather than it is designed to be fast and time-efficient to achieve the task in very little time. Because of this, a web admin can easily detect that its server is being scanned by looking into the log files. It can also show some items that do not have security problems and we should gather the info, how to take full use of it and to secure the web-server more properly.
Important Features of Nikto:
● SSL Support (Unix with OpenSSL or maybe Windows with ActiveState’s Perl/NetSSL).
● Scanning features of Nikto are updated automatically.
● Full HTTP proxy support.
● Checks for outdated server components.
● Save reports in plain text, XML, HTML, NBE or CSV Formats.
● Template engine to easily customize reports.
● Scan multiple ports on a server, or multiple servers via input file (including Nmap output).
● LibWhisker’s IDS encoding techniques.
● Easily updated via a command-line function.
● Identifies installed software via headers, favicons, and files.
● Host authentication with Basic and NTLM.
● Subdomain guessing.
● Apache and cgiwrap username enumeration.
● Mutation techniques to “fish” for content on web servers.
● Scan tuning to include or exclude entire classes of vulnerability checks.
● Guess credentials for authorization realms (including many default id/passcode combos).
● Authorization guessing handles any directory, not just the root directory.
● Enhanced false positive reduction via multiple methods: headers, page content, and content hashing.
● Reports “unusual” headers captured.
● Interactive status, pause, and changes to verbosity settings.
● Save full request/response for positive tests.
● Replay saved positive requests.
● Maximum execution time per target.
● Auto-pause at a specified time.
● Checks for common “parking” sites.
Requirements:
Any system which supports a basic Perl installation should allow Nikto to run.
● Windows (using ActiveState Perl and Strawberry Perl). Some POSIX features, such as interactive commands may not work under Windows.
● Mac OSX.
● Various Linux and Unix installations (including RedHat, Solaris, Debian, Ubuntu, BackTrack, etc.).
Installation:
git clone https://github.com/sullo/nikto
# Main script is in program/
cd nikto/program
# Run using the shebang interpreter
./nikto.pl -h http://www.example.com
# Run using perl (if you forget to chmod)
perl nikto.pl -h http://www.example.comRun as a Docker container:
git clone https://github.com/sullo/nikto.git cd nikto docker build -t sullo/nikto # Call it without arguments to display the full help docker run --rm sullo/nikto # Basic usage docker run --rm sullo/nikto -h http://www.example.com # To save the report in a specific format, mount /tmp as a volume: docker run --rm -v $(pwd):/tmp sullo/nikto -h http://www.example.com -o /tmp/out.json
Basic usage:
root@kali:~# nikto -Help
Options:
-ask+ Whether to ask about submitting updates
yes Ask about each (default)
no Don't ask, don't send
auto Don't ask, just send
-Cgidirs+ Scan these CGI dirs: "none", "all", or values like "/cgi/ /cgi-a/"
-config+ Use this config file
-Display+ Turn on/off display outputs:
1 Show redirects
2 Show cookies received
3 Show all 200/OK responses
4 Show URLs which require authentication
D Debug output
E Display all HTTP errors
P Print progress to STDOUT
S Scrub output of IPs and hostnames
V Verbose output
-dbcheck Check database and other key files for syntax errors
-evasion+ Encoding technique:
1 Random URI encoding (non-UTF8)
2 Directory self-reference (/./)
3 Premature URL ending
4 Prepend long random string
5 Fake parameter
6 TAB as request spacer
7 Change the case of the URL
8 Use Windows directory separator (\)
A Use a carriage return (0x0d) as a request spacer
B Use binary value 0x0b as a request spacer
-Format+ Save file (-o) format:
csv Comma-separated-value
htm HTML Format
msf+ Log to Metasploit
nbe Nessus NBE format
txt Plain text
xml XML Format
(if not specified the format will be taken from the file extension passed to -output)
-Help Extended help information
-host+ Target host
-IgnoreCode Ignore Codes--treat as negative responses
-id+ Host authentication to use, format is id:pass or id:pass:realm
-key+ Client certificate key file
-list-plugins List all available plugins, perform no testing
-maxtime+ Maximum testing time per host
-mutate+ Guess additional file names:
1 Test all files with all root directories
2 Guess for password file names
3 Enumerate user names via Apache (/~user type requests)
4 Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type requests)
5 Attempt to brute force sub-domain names, assume that the host name is the parent domain
6 Attempt to guess directory names from the supplied dictionary file
-mutate-options Provide information for mutates
-nointeractive Disables interactive features
-nolookup Disables DNS lookups
-nossl Disables the use of SSL
-no404 Disables nikto attempting to guess a 404 page
-output+ Write output to this file ('.' for auto-name)
-Pause+ Pause between tests (seconds, integer or float)
-Plugins+ List of plugins to run (default: ALL)
-port+ Port to use (default 80)
-RSAcert+ Client certificate file
-root+ Prepend root value to all requests, format is /directory
-Save Save positive responses to this directory ('.' for auto-name)
-ssl Force ssl mode on port
-Tuning+ Scan tuning:
1 Interesting File / Seen in logs
2 Misconfiguration / Default File
3 Information Disclosure
4 Injection (XSS/Script/HTML)
5 Remote File Retrieval - Inside Web Root
6 Denial of Service
7 Remote File Retrieval - Server Wide
8 Command Execution / Remote Shell
9 SQL Injection
0 File Upload
a Authentication Bypass
b Software Identification
c Remote Source Inclusion
x Reverse Tuning Options (i.e., include all except specified)
-timeout+ Timeout for requests (default 10 seconds)
-Userdbs Load only user databases, not the standard databases
all Disable standard dbs and load only user dbs
tests Disable only db_tests and load udb_tests
-until Run until the specified time or duration
-update Update databases and plugins from CIRT.net
-useproxy Use the proxy defined in nikto.conf
-Version Print plugin and database versions
-vhost+ Virtual host (for Host header)
+ requires a valueConclusion:
Nikto is a simple tool for discovering potential issues and vulnerabilities in the web servers and that has the ability to run on the lowest specification computer system. The main advantage is that it will be updated regularly, which means that reliable results on the latest vulnerabilities are provided. This is especially handy if you’re doing application testing from a remote platform over a command-line protocol like SSH. It is quite easy to export targets to a file, feed that file to Nikto, then output results in a format that can be consumed by other tools. This tool is made for security researchers, and they can explore it.
Happy Hunting!