WEBVTT

00:00:01.040 --> 00:00:04.750
Hi, and welcome to Technical Weakness Identification with Nikto.

00:00:05.240 --> 00:00:06.040
My name is Lee,

00:00:06.050 --> 00:00:10.590
and in this course I provide explanations and hands‑on demonstrations of how

00:00:10.600 --> 00:00:15.150
you can use Nikto towards the identification of vulnerabilities associated

00:00:15.250 --> 00:00:17.720
with application servers and web application.

00:00:19.540 --> 00:00:23.390
Nikto is a free and open source web server and application

00:00:23.390 --> 00:00:26.790
assessment tool created by Chris Sullo and David Lodge.

00:00:27.200 --> 00:00:31.550
Nikto was written in Perl and was originally released in late 2001.

00:00:31.940 --> 00:00:35.240
The primary function of Nikto is to identify security

00:00:35.240 --> 00:00:37.540
weaknesses such as default files,

00:00:37.620 --> 00:00:41.250
misconfigurations, or published security vulnerabilities.

00:00:41.940 --> 00:00:45.180
I would like to thank Chris and David for creating and maintaining this

00:00:45.180 --> 00:00:50.870
excellent tool. Nikto has been released under the GNU General Public License

00:00:50.870 --> 00:00:55.420
and is copyrighted by CIRT. Nikto leverages LibWhisker,

00:00:55.430 --> 00:00:57.430
which is copyrighted by Jeff Forristal.

00:00:57.530 --> 00:01:00.720
The primary function of Nikto involves scanning web servers

00:01:00.720 --> 00:01:03.050
in order to identify vulnerabilities.

00:01:03.690 --> 00:01:08.410
It can identify outdated components and allows you to replay findings

00:01:08.420 --> 00:01:12.050
so that you can validate them manually after a test has been completed

00:01:12.060 --> 00:01:13.910
or mitigations have been implemented.

00:01:14.050 --> 00:01:18.410
Nikto can also be used to identify server and software misconfigurations,

00:01:18.840 --> 00:01:23.450
as well as to locate default, insecure, or even dangerous files and scripts.

00:01:23.940 --> 00:01:24.840
In addition,

00:01:24.850 --> 00:01:27.770
it also offers full proxy support so that you can use it

00:01:27.770 --> 00:01:30.250
with powerful tools such as Burp Suite Pro.

00:01:30.840 --> 00:01:34.840
So let's take a look at the kill chain. Nikto helps an attacker understand

00:01:34.840 --> 00:01:39.460
the target and to identify misconfigurations and vulnerabilities during

00:01:39.470 --> 00:01:41.650
the reconnaissance phase of the kill chain.

00:01:42.370 --> 00:01:45.250
This information then enhances the other stages.

00:01:45.740 --> 00:01:46.380
For instance,

00:01:46.840 --> 00:01:50.260
if you find a vulnerability during a Nikto scan, what you have

00:01:50.260 --> 00:01:54.400
learned can then be used during the exploitation phase to

00:01:54.400 --> 00:01:56.150
understand how to compromise the target.

00:01:56.640 --> 00:02:01.180
So the MITRE PRE‑ATT&CK framework provides you with a long list of tactics

00:02:01.180 --> 00:02:06.080
and techniques that real‑life adversaries may use. The primary function of

00:02:06.080 --> 00:02:10.770
Nikto falls directly within PRE‑ATT&CK's technical weakness identification

00:02:10.770 --> 00:02:17.400
tactic and directly leverages two techniques, which are T1293, analyze

00:02:17.400 --> 00:02:19.050
application security posture,

00:02:19.540 --> 00:02:22.680
which is focused on probing the victim's network in order to

00:02:22.680 --> 00:02:29.290
find application configuration weaknesses, and T1288, analyze

00:02:29.290 --> 00:02:31.750
architecture and configuration posture,

00:02:32.340 --> 00:02:36.420
which covers the analysis of the results that scanning tools provide

00:02:36.750 --> 00:02:41.270
after identifying misconfigurations or other security issues that

00:02:41.270 --> 00:02:43.750
might impact networks and infrastructure.

00:02:44.070 --> 00:02:45.760
And as with any hacking tool,

00:02:46.340 --> 00:02:50.250
you must ensure that you have proper authorization before starting any

00:02:50.250 --> 00:02:53.450
scans or performing other actions against a target.

00:02:53.940 --> 00:02:57.900
Do not use Nikto against targets that you do not own or that you

00:02:57.900 --> 00:03:01.310
have not received explicit permission to test from someone that

00:03:01.320 --> 00:03:03.350
actually has the authority to do so.

00:03:04.140 --> 00:03:06.050
When you launch a default Nikto scan,

00:03:06.440 --> 00:03:09.750
it sends thousands and thousands of requests to the target.

00:03:10.280 --> 00:03:13.730
It then indexes the responses so that it can analyze

00:03:13.730 --> 00:03:17.690
them to identify misconfigurations, outdated components,

00:03:18.030 --> 00:03:21.750
outdated and vulnerable software versions and server versions,

00:03:22.380 --> 00:03:24.250
and dangerous files and scripts.

00:03:24.840 --> 00:03:28.350
This information can then be used towards any other stages of attack.