Nikto is a straightforward tool for checking web server security. It identifies vulnerabilities caused by server misconfigurations, default or insecure files, and outdated server software. Nikto is based on LibWhisker2, making it compatible with various operating systems, SSL, host authentication methods (Like NTLM/Basic), proxies, and various IDS evasion techniques. It can also enumerate subdomains, perform application security checks (like XSS and SQL injection), and attempt to guess authorization credentials using dictionary attacks.
Hello everyone. Today, I'll show you how to use Nikto to discover potential security issues on websites. Let's dive in!
.png)
For this purpose, you must have 3 things to be ready:
- First, you'll need Kali Linux installed and running on a virtual machine. This virtual environment isolates your scanning activities and safeguards your main computer. Make sure the virtual machine's network adapter is configured in a special mode called "Host-only" to allow communication between Kali and your target website.
.png)
- Next, you'll need a website to scan. In this tutorial, we'll use a website called Metasploitable2, which is deliberately designed to be vulnerable for educational purposes. This provides a safe space to practice without harming a real website. Make sure the virtual machine's network adapter is configured in a special mode called "Host-only" to allow communication between Kali and your target website.
.png)
- Next, we need a Steady Internet Connection. A stable internet connection is essential for the scanning process to communicate with the target website. First, ensure you have a reliable internet connection. This is crucial for the scanning process to interact with the target website. Access your Kali VM, navigate to settings, then to Network adapter, and confirm that the second adapter is connected to the NAT network.
.png)
Once three prerequisites are in place, you're prepared to scan for vulnerabilities on target websites. To begin, we'll exploit a website running on Metasploitable2.
.png)
Before proceeding with the scanning process, it's crucial to identify the target's address. Open a terminal window in Kali Linux and execute the "netdiscover" command.
This command acts like a digital radar, searching your network for devices. It will list the discovered devices along with their IP addresses.
.png)
We already know previously that Metasploitable2 has a web page running on Port 80. Launch a browser, and you can access its web interface by typing the IP address into your web browser's address bar.
.png)
Let’s first scan this webpage and list out the web vulnerabilities.
You can locate Nikto in the "Web Applications" menu in Kali Linux, typically under "Web Vulnerability Scanners," or you can run the `nikto` command directly from the console.
.png)
Executing `nikto` will display all available options with detailed features. For more detailed information, you can also use the “man” command.
Now, let's scan our target, which is Metasploitable2. Open a new terminal and type “nikto hyphen h” followed by the host IP address or URL. Then, specify the port using “-p 80”.
Nikto scans for vulnerabilities automatically and displays the results in the terminal.
I've created a table based on this information for easy
understanding. Unlike tools like Skipfish or Wapiti that generate graphical
representations automatically, I used an AI tool to create this table to help
me comprehend the data better.
|
Vulnerability |
Description |
Severity |
Exploitation Difficulty |
Potential Impact |
Recommendations |
|
Missing X-Frame-Options |
Website is vulnerable to clickjacking attacks. An attacker can embed
the website in their own frame, tricking users into interacting with the
attacker's content. |
Medium |
Low |
User data theft, unauthorized actions |
Implement X-Frame-Options header to restrict where the website can be
embedded. |
|
Missing X-Content-Type-Options |
Browser might render content differently than intended. Attackers
could potentially use this to bypass security measures. |
Low |
Low |
Content rendering issues, potential security bypasses |
Implement X-Content-Type-Options header to specify how the browser
should render the content. |
|
Apache mod_negotiation |
Allows brute-forcing filenames due to MultiViews option. Attackers
can try different filename combinations to find hidden files. |
Medium |
Medium |
Unauthorized access to hidden files, potential information disclosure |
Disable MultiViews option in Apache configuration or restrict access
to sensitive directories. |
|
Outdated Apache Server |
The Apache version (2.2.8) is outdated and no longer receives
security updates. Upgrade to a current version (at least 2.4.54). |
High |
Low |
Server compromise, various security vulnerabilities |
Upgrade Apache to the latest version. Refer to the official Apache
documentation for instructions. |
|
TRACE method enabled |
Website might be vulnerable to Cross-Site Tracing (XST) attacks that
can steal user data or inject malicious scripts. |
Medium |
Medium |
User data theft, session hijacking, injection of malicious scripts |
Disable TRACE method in server configuration or implement appropriate
security measures to mitigate XST vulnerabilities. |
|
phpinfo.php disclosure |
phpinfo.php script reveals potentially sensitive information about
the server configuration. Remove it from the web accessible location. |
Medium |
Low |
Information disclosure about server configuration |
Remove phpinfo.php script from the web accessible location. |
|
Directory Indexing Enabled |
Directory listing exposes unnecessary information about the server
and its contents. Disable directory indexing for non-essential directories. |
Low |
Low |
Information disclosure about server structure and files |
Disable directory indexing for non-essential directories in Apache
configuration. |
|
phpMyAdmin exposure |
phpMyAdmin, a tool for managing MySQL databases, is publicly
accessible. This could allow unauthorized access to databases. |
High |
High |
Unauthorized access to databases, potential data theft or
manipulation |
Secure phpMyAdmin by restricting access with IP whitelisting or
password protection. Consider using a separate server for phpMyAdmin. |
|
Inode Leakage |
Server might leak information about files through ETags. |
Medium |
Low |
Information disclosure about files on the server |
Update Apache to a version that addresses the ETag vulnerability
(CVE-2003-1418) or disable ETags in server configuration. |
|
Potentially sensitive info via specific queries |
Specific HTTP requests with certain queries might reveal sensitive
information about the server. |
Medium |
Medium |
Information disclosure about server configuration or data |
Review code and queries to identify and prevent leakage of sensitive
information. Update or patch applications if necessary. |
|
#wp-config.php found |
A file potentially containing WordPress database credentials was
found. This file should be secured and not publicly accessible. |
High |
Low |
Unauthorized access to WordPress databases, potential data theft or
manipulation |
Secure the wp-config.php file by moving it outside the web root
directory. Change file permissions to restrict access. |
Now that you're comfortable with practicing in a safe environment, let's use Nikto to test a live website on the internet.
For this exercise, we'll scan a website named
"testphp.vulnweb.com." Please note that this website is intentionally
vulnerable for educational purposes.
The process is very similar to what we previously did. This
time, instead of using the host ID for Metasploitable2, we'll use a URL link.
In the terminal type, the following command:
- nikto -h, where -h is used to specify the hostname or IP address of the target website. In my case it is “testphp.vulnweb.com”.
- Port 80 is commonly used for HTTP traffic and is the default port for web servers.
- Now, use the “-T” command line switch followed by specific test numbers corresponding to the desired test types.
- We'll specifically select and execute tests related to Information Disclosure, Injection (XSS/Script/HTML), Remote File Retrieval (server-wide), Command Execution, and Software Identification against our target server.
- Next, include “-t” followed by a value to set the timeout in seconds for each test request. Additionally, use “-D \V" to specify the display output verbosity level.
- After that, specify “-o” followed by the desired file name, and then use “-F” to specify the format for the scan report. For example, you can use “-F htm” to generate the scan report in HTML format.
There are other advanced options such as -mutate, for
guessing subdomains, files, directories, or usernames, -evasion, to
bypass the IDS filter, and -Single, for conducting a single test mode to
focus on specific assessments. These options allow for a more comprehensive
assessment of your target.
Once you've configured your scan parameters, hit enter to start the scan. This will provide valuable information that can help identify vulnerabilities and guide efforts to secure your website.
After the scan completes, Nikto will generate an HTML file
named webtest in your Kali directory. Open this file to review any valuable
findings.
.png)
If you have any questions or concerns related to this process, feel free to leave a comment for further discussion.
