Welcome to the video using nikto to find web based vulnerabilities in this video we will use a tool
built it actually called nikto to start testing web sites for vulnerabilities.
To our nikto scans to search for only certain risks in order to not overwhelm our target with requests
and we'll put our ethical hacking head on and see how a vulnerability discovered by nikto could be used
and abused in the real world.
As we get closer to the end of this course.
It's been fun to start taking what we've learned about network scanning and begin shifting the focus
more to how an attacker can use this scan data to probe systems for vulnerabilities.
And in this video I want to take things one step further and show you how a vulnerability can actually
be leveraged to gain a foothold on a system.
First though let's take a look at a tool that's built right into Cauley called nikto.
If you want to get some basic information about nikto simply type it into the command line with no arguments.
Now my personal preference whenever I'm running a tool is to make sure it's completely up to date.
I've run into many situations where I was banging my head against a wall because I couldn't get a tool
to work only to find out that I was running into a bug that was fixed in the current version in the
case of nikto that can be done by running nikto space tech update and hitting enter.
Interestingly nikto tells us right here that we should be using the version of the tool from get Let's
hop on google real quick and I'm going to search for update nikto Kalli and right here from the nikto
tool home page.
It says the version we should be using is from get up a little further down in these instructions.
It gives us the commands we need.
So I'm going to copy those and paste them into a terminal and I'm going to modify my command just a
little bit so that nikto gets downloaded to a folder called slash Opt. slash nikto to
inside that folder.
I don't see a nikto script that I can run.
So let's go into the program folder and boom there's nikto doppio And just for future reference that
nikto Web site we were just on says that if we want to check for updates to the tool in the future we
can just do a get space pull from a directory within the repo so see here that I could do a poll from
our current directory or even one folder back.
OK so we've got the latest nikto and we see that by running the command itself we get a brief summary
of commands and what they do.
But we can also do a nikto tech capital H to get really detailed help.
We might want to do a pipe more here so we can view the output one screen at a time.
All right so what the heck let's just give this a quick shot and do the most basic scan possible.
I'm going to type nikto space Takht H.
Plus my default gateway which will be the target of this scam.
So as you can see nothing too mind blowing here.
But we do get some basic information about the technology running on the server.
In this case like HEG EPD and a few more bits of information about how the server is configured.
But what we don't really see here is much detail as far as the kinds of tests nikto actually performed.
If we go back to the nikto tech capital H pipe more one more time we can see that the TAC display flag
gives us more options.
So as a quick example if we wanted to go really nuts with this detailed logging we could add the Takk
display capital V flag to the end of the scan command that's going to be a little hard to sift through.
So we might want to pick a slightly less chatty display output or we can log the output to a file which
we'll talk about in just a moment
OK going back into the Help menu again.
There's another option that will help refine your scan and that is the tuning option.
If we wanted to for example just do injection tests on our target we could add TAC capital-T space for
nine.
The four is for injection tests such as cross-site scripting and the Nine is for sequel injection.
Just keep in mind that if you invoke this tack t flag then only the types of tests you specify after
the TAC t will be executed as I mentioned earlier if you're going to gather this much data about your
scan you probably want to save it to a file in case you need it later.
So let's go back to the help menu one more time and look at an option called Ptak output the help output
doesn't go into too much detail but nikto does support a variety of output formats including CXXVI HVM
Mal ex-MIL NBC and even exporting into the metal plate framework.
So if I want to take that last scan I did and save the are put to him now I can add a tack.
Oh.
And then an H T.M. file name.
Now once this scan is done I'll do a quick shortcut and type Firefox space.
The name of my scan file obviously you could just open this file directly from Firefox but we're learning
as many shortcuts as we can in this course to maximize our time.
Right.
And here's a nice HDMI output of the scan and the findings now.
Notice that this h tim file has the high level findings of the scan but does not include that verbose
logging that I specified with the text display space setting.
So what I've done in the past to get around that is run the same command again and then add a space
greater sign Plus the filename.
Now this time when the scanner finishes we've got this detailed log log file that we can sift through
if necessary.
And then we've still got the HVM file with the higher level details of the scan as well.
For a lot more details on nikto and all the various command line options just do a quick Google search
for nikto help personally I found these first two sites to be very helpful.
OK let's close with something kind of fun and see how a nikto scan can actually lead you in the direction
of fully compromising a system.
What I've done is installed a machine on my network that is vulnerable by design.
And I got it from a site called Volna hub dot com Volna is a fantastic resource.
If you want to practice your network scanning and penetration testing skills in a safe and legal way
essentially what you do is you download these V.M. to your machine.
You load them up in something like VM Ware player or virtual box and then you can bang away on them
from the comfort of your own network.
While we're here on vuln hub dotcom please do allow me just a little bit of shameless self-promotion.
I've built a couple of machines and submitted them to vuln hub and they're named after a few of my favorite
all time movies.
Billy Madison which we can get to via the search box here.
We'll pit you against the evil Eric Gordon as he tries to stop Billy from graduating high school this
VM will have you cleaning a machine of some malicious operations and hopefully get a critical assignment
recovered so Billy can graduate high school the other one I built is called Tommy Boy and that will
put you in the hot seat as you attempt to recover a downed web server so that Calahan auto can get back
in business and start selling brake pads again regardless of the VMs you choose.
All of them are free so why not try.
I'm all right.
Anyway the one will focus on for this demo is called pluck.
Now I have already downloaded this into my network and I know it's IP.
So let's start with a quick scan of the device to understand what ports and services are open.
I'm going to do an end map plus tack small s and then capital U and capital T.
And this is going to scan both TCAP and UDP ports and because UDP scans can take a while for the sake
of this Demel I'm going to use the tac tac top TAC ports command to limit the scan to 100 ports and
I'll add TAC V just for the fun of it to gather some more verbose output.
So we've got some interesting ports here.
S-sh h TTP and my sequel.
So let's fire up nikto and just do a basic scan on it with the TAC h command plus the IP
this output looks much more interesting.
Take a look at this.
It appears that this site has a file traversal vulnerability which allows an attacker to view any file
on the host.
What's really nice is they even give us an example page to try.
So let's open up Firefox and then I'm going to go to the web interface of the box and from there I will
append the string we copied out of nikto look at that.
Yikes what we're seeing is the slash ETSI slash password file which is traditionally used to keep track
of every registered user on this system.
So this potentially tells us which users we might want to brute force via S-sh for example or in the
case of this box it reveals that there is a backup user here.
That is just there to make backups easier.
And looking further there is a specific file on the box that looks very interesting and thanks to this
vulnerability we can just pull that file up directly from the web browser.
All we have to do is change the URL path like so
as cool stuff right.
So where do we go from here.
Well unfortunately that would be a completely separate course altogether.
But I hope this little demonstration will whet your appetite for using your network scanning skills
to learn more about a system and then begin to see it from an attacker's perspective so that you better
understand how to attack and defend a network in our next video.
We'll look at some ways we can probe deeper into Web sites to discover hidden files and folders.