Nikto is a popular open source web vulnerability scanner and is preinstalled in Kali Linux. This command-line tool is capable of identifying security flaws on a target website and providing detailed referencing for each issue found. Nikto is not a stealth-oriented tool and can be a bit noisy while performing its scan.
Some of its features are as follows:
- Checking for any outdated components on a web server
- Capable of identifying installed applications via headers and files on a target
- SSL support
- Performs subdomain guessing
- Apache username enumeration
To get started with Nikto, we will perform a web vulnerability scan on our Metasploitable VM. If you recall, in the previous chapter, we performed a port scan on Metasploitable and saw that port 80 was open. By default, web servers open port 80 to allow inbound and outbound communication between a client and the web server.
Open a new Terminal window using the nikto -h <target> syntax, where -h specifies a host (hostname or IP address). We use the nikto -h 10.10.10.100 command:
If you provide a hostname, Nikto will be able to perform an IP lookup via the Domain Name System (DNS). During the initial phase, Nikto attempts to perform an operating system and service version fingerprinting; our target is using Ubuntu as its operating system and Apache 2.2.8 as the web server application.
Each point on the output is an indication of an issue Nikto has detected, whether a configuration is missing, access to a sensitive directory or file was found, or even an application version is outdated. For each security issue found, an Open Source Vulnerability Database (OSVDB) reference ID is associated with the issue. The OSVBD is an independent and open source database that contains information about web application security vulnerabilities. Once Nikto is able to identify a security flaw on a target, it provides an associated OSVDB reference ID. Once the OSVDB ID has been obtained, you can head over to http://cve.mitre.org/data/refs/refmap/source-OSVDB.html to reference the OSVDB IDs with CVE entries.
Now you have the essential skills to use Nikto, let's take a look at using WPScan in the next section.