Nikto
https://cirt.net/nikto2
Fire Up Kali & Open Nikto
Let's fire up Kali and get started with nikto. Once we have Kali up and running, go to Kali Linux -> Vulnerability Analysis -> Misc Scanners -> nikto, like in the screenshot below.

Image via wonderhowto.com
Although there are many options in using nikto, we will limit ourselves here to the basic syntax, such as this:
- nikto -h <IP or hostname>
Step 2Scan the Web Server
Let's start with a safe web server on our own network. In this case, I have started the http service on another machine on my network. There is not a website hosted by this machine, just the web server. Let's scan it for vulnerabilities by typing:
- nikto -h 192.168.1.104
Nikto responds with a lot of information, as you can see below.

First, it tells us the server is Apache 2.2.14, probably on Ubuntu. It nailed this info and gives up more information on other potential vulnerabilities on this web server.
Note near the bottom that it identifies some vulnerabilities with the OSVDB prefix. This is the Open Source Vulnerability Database. This is a database maintained of known vulnerabilities at www.osvdb.org, in addition to other databases I covered, such as SecurityFocus and Microsoft's Technet.
Step 3Scan the Site
Let's try another site. In an earlier tutorial, we had hacked a web server named webscantest.com. Let's see what nikto can tell us about this site.
- nikto -h webscantest.com

Once again, it identifies the server (Apache) and then proceeds to identify numerous potential vulnerabilities pre-fixed with OSVDB. We can take a look at that website at www.osvdb.org to learn more about these vulnerabilities.

Now, let's use this site to find information on one of the vulnerabilities identified by nikto as OSVDB-877. We can put that reference number into the search function and it retrieves the following page.

Note, in lower half of this page there are cross-references to the various information sources about this vulnerability, as well as references to tools and filters such as Nikto, Nessus, and Snort.

Scan WonderHowTo
Let's scan a few more sites and see what it can tell us about these sites. Let's see what we can find out about our own website, www.wonderhowto.com.
- nikto -h wonderhowto.com

As you can see, it tells us that WonderHowTo is using Microsoft's IIS 8.5 as a web server and then lists numerous potential vulnerabilities.
However, any attempt to exploit the vulnerabilities listed will reveal that they're all false-positives, as WonderHowTo simply returns a harmless 404 page. This is because WonderHowTo is not built on php or asp as the noted exploits expect.
False positives like this can appear because the scan does not actually execute each of the possible vulnerabilities, but rather scans to see if the server responds without error to known exploitable URLs.
Scan Facebook
Finally, lets point nikto at www.facebook.com.
- nikto -h facebook.com

As you can see, Facebook is tightly secured with few vulnerabilities. As you can imagine, if Facebook weren't secure, every script-kiddie on the planet would be hacking it to see who his true love is chatting with online.
Nikto的更多相关文章
- 用Nikto探测一个网站所用到的技术
Nikto是一款开源的(GPL)网页服务器扫描器,它可以对网页服务器进行全面的多种扫描,包含超过3300种有潜在危险的文件/CGIs:超过 625种服务器版本:超过230种特定服务器问题,包括多种有潜 ...
- Nikto是一款Web安全扫描工具,可以扫描指定主机的web类型,主机名,特定目录,cookie,特定CGI漏洞,XSS漏洞,SQL注入漏洞等,非常强大滴说。。。
Nikto是一款Web安全扫描工具,可以扫描指定主机的web类型,主机名,特定目录,cookie,特定CGI漏洞,XSS漏洞,SQL注入漏洞等,非常强大滴说... root@xi4ojin:~# cd ...
- 小白日记28:kali渗透测试之Web渗透-扫描工具-Nikto
扫描工具-Nikto #WEB渗透 靶机:metasploitable 靶场:DVWA[默认账号/密码:admin/password] #新手先将DVWA的安全性,调到最低,可容易发现漏洞 侦察[减少 ...
- New ipad安装Perl支持安装nikto
Title:New ipad安装Perl支持安装nikto --2012-11-15 09:47 New Ipad 越了后. ssh new ipad 进入目录 cd /tmp 下载Key文件 wge ...
- Nikto and whatweb
root@kali:~# nikto -host www.baidu.com- Nikto v2.1.6------------------------------------------------ ...
- Nikto主动扫描神器!!!
Perl语言开发的开源web安全扫描器 Nikto只支持主动扫描:可扫描web服务器类型是不是最新版本(分析先版本与新版相比有哪些漏洞) 针对:1.软件版本.2.搜索存在安全隐患的文件.3.服务器配置 ...
- Nikto学习点
一.使用Nikto扫描https站点 nikto.pl -output myhost.html -g -ssl -Format HTM -host www.test.com -port 443 二.使 ...
- Kali学习笔记24:Nikto、Skipfish
文章的格式也许不是很好看,也没有什么合理的顺序 完全是想到什么写一些什么,但各个方面都涵盖到了 能耐下心看的朋友欢迎一起学习,大牛和杠精们请绕道 实验环境: Kali机器IP:192.168.163. ...
- web扫描工具-Nikto介绍与使用
Nikto Perl语言开发的开源Web安全扫描器 web扫描模式:截断代理主动扫描 可以扫描的方面:软件版本搜索存在安全隐患的文件服务器配置漏洞WEB Application层面的安全隐患避免404 ...
随机推荐
- PHP语句函数
运算符 +.-.*./.++.--.+=.-=.% 字符串拼接用. js里面用+拼接 逻辑运算符 and && . or || . ! 错误运算符 @(可以抑制错误) ...
- c#关于字符串格式化
1. 如何使用文化来格式化日期 如: /// <summary> /// 根据语言获取文化名称 /// </summary> /// <returns></r ...
- linux基本格式和常用目录命令一
1: cd 绝对路径 2: cd 相对路径 名字开头 ./开头 ../开头 3: cd ~: 去到当前用户所在目录; 4: pwd获取当前的路径的绝对路径; 5: ls 与ls -l 6: cat 操 ...
- Sitecore CMS中更改项目的模板
如何在Sitecore CMS中创建项目后更改项目的模板. 在创建项目时选择了错误的模板,或者创建了新模板并将现有项目更新为新模板时,这非常有用. 警告! 更改模板时要小心.如果原始模板具有不在新 ...
- Sitecore xDB基础知识 - 识别用户,联系人,访客,客户
体验数据库(xDB)是Sitecore平台的关键元素,特别是当您希望将解决方案提升到简单的内容管理要求之外时.它用于跟踪您的用户(即联系人,访客,客户)与您网站的互动方式.营销人员可以使用此数据来了解 ...
- linux基础操作
1.pwd 2.clear 3.who 4.cal 5.uname 6.wc 7.man在线帮助命令 8.--help.info.whatis 9.使用su命令以root身份进入linux 10.Sh ...
- JTable的模型
2018-11-04 23:15:21开始写 模型类 import javax.swing.table.DefaultTableModel;//导入包 public class LocalTableM ...
- Linux QtCreator 编译报错:No rule to make target '.../***' needed by '***.o'.stop
Linux QtCreator 编译报错:No rule to make target 'mainwindow.cpp' needed by 'mainwindow.o'.stop [1]解决方案 ...
- FilenameFilter
Introduction: java.io.FileNameFilter is a interface which is for filtering by filename, if filename ...
- c# 设置控件的前景颜色和背景颜色
AutoSize:设置为false取消自动计算尺寸功能,控件的大小则按照设定的Size来呈现,设置为true自动计算大小 TextAlign:设置对齐方式 // // 摘要: // 用默认的所有者运行 ...