web application – nikto

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6400 potentially dangerous files/CGIs, checks for outdated versions of over 1200 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index files, HTTP server options, and will attempt to identify installed web servers and software. Scan items and plugins are frequently updated and can be automatically updated.

Backtrack 5 r1

/pentest/web/nikto

root@bt:/pentest/web/nikto#./nikto.pl
– Nikto v2.1.5
—————————————————————————
+ ERROR: No host specified

-config+            Use this config file
-Display+           Turn on/off display outputs
-dbcheck            check database and other key files for syntax errors
-Format+            save file (-o) format
-Help               Extended help information
-host+              target host
-id+                Host authentication to use, format is id:pass or id:pass:realm
-list-plugins       List all available plugins
-output+            Write output to this file
-nocache            Disables the URI cache
-nossl              Disables using SSL
-no404              Disables 404 checks
-Plugins+           List of plugins to run (default: ALL)
-port+              Port to use (default 80)
-root+              Prepend root value to all requests, format is /directory
-Single             Single request mode
-ssl                Force ssl mode on port
-Tuning+            Scan tuning
-timeout+           Timeout for requests (default 10 seconds)
-update             Update databases and plugins from CIRT.net
-Version            Print plugin and database versions
-vhost+             Virtual host (for Host header)
+ requires a value

Note: This is the short help output. Use -H for full help text.

root@bt:/pentest/web/nikto#./nikto.pl -h http://ip-address -p 80
—————————————————————————
+ Target IP:          (ip address)
+ Target Hostname:    (ip address)
+ Target Port:        80
+ Start Time:         2010-06-24 10:28:43
—————————————————————————
+ Server: Microsoft-IIS/5.1
+ Allowed HTTP Methods: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
+ OSVDB-5646: HTTP method (‘Allow’ Header): ‘DELETE’ may allow clients to remove files on the web server.
+ OSVDB-397: HTTP method (‘Allow’ Header): ‘PUT’ method could allow clients to save files on the web server.
+ OSVDB-5647: HTTP method (‘Allow’ Header): ‘MOVE’ may allow clients to change file locations on the web server.
+ HTTP method (‘Allow’ Header): ‘PROPFIND’ may indicate DAV/WebDAV is installed. This may be used to get directory listings if indexing is allow but a default page exists.
+ HTTP method (‘Allow’ Header): ‘PROPPATCH’ indicates WebDAV is installed.
+ OSVDB-425: HTTP method (‘Allow’ Header): ‘SEARCH’ indicates DAV/WebDAV is installed, and may be used to get directory listings if Index Server is running.
+ Public HTTP Methods: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE, MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
+ OSVDB-5646: HTTP method (‘Public’ Header): ‘DELETE’ may allow clients to remove files on the web server.
+ OSVDB-397: HTTP method (‘Public’ Header): ‘PUT’ method could allow clients to save files on the web server.
+ OSVDB-5647: HTTP method (‘Public’ Header): ‘MOVE’ may allow clients to change file locations on the web server.
+ HTTP method (‘Public’ Header): ‘PROPFIND’ may indicate DAV/WebDAV is installed. This may be used to get directory listings if indexing is allow but a default page exists.
+ HTTP method (‘Public’ Header): ‘PROPPATCH’ indicates WebDAV is installed.
+ OSVDB-425: HTTP method (‘Public’ Header): ‘SEARCH’ indicates DAV/WebDAV is installed, and may be used to get directory listings if Index Server is running.
+ OSVDB-13431: PROPFIND HTTP verb may show the server’s internal IP address: http://(ip address)
+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ OSVDB-877: HTTP TRACK method is active, suggesting the host is vulnerable to XST
+ Retrieved X-Powered-By header: ASP.NET
+ Microsoft-IIS/5.1 appears to be outdated (4.0 for NT 4, 5.0 for Win2k, current is at least 7.0)
+ OSVDB-3092: /test/: This might be interesting…
+ Default account found for ‘”(ip address)”‘ at / (/localstart.asp) (ID ‘Administrator’, PW ”). Generic account discovered
+ OSVDB-3092: /iishelp/iis/misc/default.asp: Default IIS page found.
+ ERROR: No authentication header defined
+ 3818 items checked: 22 item(s) reported on remote host
+ End Time:           2010-06-24 10:29:23 (9 seconds)
—————————————————————————
+ 1 host(s) tested

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s