20. Vulnerability Scanning and Assessment
20.5 Nikto: Web Server Scanning
In short: Nikto checks web servers for dangerous files, outdated server software, default pages and missing security headers.
Nikto checks web servers for dangerous files, outdated server software, default pages and missing security headers. It is noisy (not stealthy) but quick – perfect for a first look at the Apache and Nginx servers you built in Chapters 7–9.
nikto -h http://192.168.56.20 # scan the web server on Metasploitable 2
nikto -h http://192.168.56.20/dvwa/ # scan one application path
nikto -h 192.168.56.20 -p 80,8180 # several ports (8180 = Tomcat on Metasploitable 2)
nikto -h http://192.168.56.20 -o nikto_msf2.html -Format htm # save an HTML report
Typical findings and what they mean:
| Nikto says | Meaning | Fix (from what you learned earlier) |
|---|---|---|
Server version disclosed (Apache/2.2.8) |
Attacker learns the exact version | ServerTokens Prod, ServerSignature Off (Apache); server_tokens off; (Nginx) |
| Directory indexing found | Files in a folder are listed publicly | Options -Indexes (Apache); autoindex off; (Nginx) |
phpinfo.php found |
Full PHP configuration exposed | Delete test files from the web root |
| X-Frame-Options / Content-Security-Policy header missing | Clickjacking and XSS protection absent | Add security headers in the server config |
| HTTP TRACE method enabled | Old cross-site tracing risk | TraceEnable off (Apache) |
Ravindra Bagale's Tip
Nikto gives many "OSVDB" and "may be" findings – not all of them are real. Confirm each finding yourself in the browser or with curl -I. And importantly: if you left phpinfo.php for testing in the Chapter 16 reels project, remove it now!
Ravindra Bagale's Tip – मराठी
Nikto खूप "OSVDB" आणि "may be" findings देतो – सगळे खरे नसतात. प्रत्येक finding browser मध्ये किंवा curl -I ने स्वतः confirm करा. आणि महत्त्वाचं: Chapter 16 च्या reels project मध्ये phpinfo.php test साठी ठेवला असेल तर आता काढून टाका!
Ravindra Bagale's Tip – हिंदी
Nikto बहुत से "OSVDB" और "may be" findings देता है – सब सच्चे नहीं होते. हर finding को browser में या curl -I से ख़ुद confirm करो. और ज़रूरी बात: Chapter 16 के reels project में phpinfo.php test के लिए रखा था तो अभी हटा दो!
Lab
Run Nikto against http://192.168.56.20 and save the HTML report. Pick three findings and confirm each manually with curl -I or the browser. Then run Nikto against your own Apache server from Chapter 8, fix two findings in the config, restart with sudo service httpd restart, and scan again to confirm they are gone.