WEBVTT 00:00:01.040 --> 00:00:01.950 Time for the demo. 00:00:02.540 --> 00:00:06.050 We begin with a quick review of the Nikto command line options, 00:00:07.040 --> 00:00:10.450 which is then followed by a simple scan of an application server. 00:00:11.340 --> 00:00:12.210 And after that, 00:00:12.400 --> 00:00:16.050 I will perform a scan against multiple hosts and follow that 00:00:16.050 --> 00:00:18.350 up with a review of available plugins. 00:00:19.000 --> 00:00:21.910 The demo then wraps up with a quick example of how you 00:00:21.910 --> 00:00:24.290 can configure and use a Nikto plugin. 00:00:26.440 --> 00:00:28.670 For all of the demonstrations in this course, 00:00:28.810 --> 00:00:31.180 I've got two different systems that I'm using. 00:00:31.190 --> 00:00:35.130 One is a virtualized instance of the Vulnerable Web Apps, 00:00:35.310 --> 00:00:38.800 which includes bWAPP, OWASP Hackacademic, 00:00:38.810 --> 00:00:41.530 OWASP Juice Shop, and others. 00:00:41.620 --> 00:00:43.340 If you want to get a copy of this yourself, 00:00:43.340 --> 00:00:47.530 you can download it from vulnerablewebapps.org so that you 00:00:47.530 --> 00:00:50.170 can follow along with these demonstrations. 00:00:51.240 --> 00:00:54.330 So let's hop into the terminal of Kali. 00:00:54.460 --> 00:00:59.740 I've already typed in nikto. And what this has done is provided a short list of 00:00:59.740 --> 00:01:03.420 the different options that you can use when running Nikto. 00:01:03.530 --> 00:01:08.880 For a more detailed list of options, you can use nikto ‑Help, 00:01:09.010 --> 00:01:12.620 and then you have a lot of additional information that you did not have 00:01:12.620 --> 00:01:14.970 available just by typing the command with no parameters. 00:01:15.740 --> 00:01:19.250 So let's go ahead and run a default scan, 00:01:19.640 --> 00:01:21.650 which with Nikto is very straightforward. 00:01:22.540 --> 00:01:26.150 So we've got nikto ‑host, which is our target, 00:01:26.540 --> 00:01:32.280 and then 192.168.30.135, which is the Vulnerable Web Apps 00:01:32.280 --> 00:01:33.870 server. So go ahead and press Enter. 00:01:34.340 --> 00:01:38.260 And depending on the size of the application that you're scanning, 00:01:38.270 --> 00:01:41.740 sometimes these scans can take quite a while. If you 00:01:41.740 --> 00:01:43.390 want to, you can press spacebar, 00:01:43.500 --> 00:01:46.800 and that'll give you a status as your scan is running to give 00:01:46.800 --> 00:01:48.620 you an idea of how much time you have left. 00:01:48.710 --> 00:01:50.250 Okay, the scan has ended. 00:01:50.840 --> 00:01:55.590 It took exactly 57 seconds, and it identified the server version. 00:01:56.140 --> 00:01:59.650 It took a view at the anti‑clicking X‑Frame‑Options 00:01:59.650 --> 00:02:01.680 header and found that it was not present. 00:02:01.690 --> 00:02:06.120 It looked at the CGI directories. It tried to find some CGI directories. 00:02:06.120 --> 00:02:09.600 It was unable to. And it does note that the Apache 00:02:09.600 --> 00:02:11.840 version here seems to be outdated. 00:02:11.850 --> 00:02:13.870 If you're doing a security assessment on this, 00:02:13.870 --> 00:02:16.570 that might be something you'd want to look into after this scan, 00:02:16.800 --> 00:02:21.590 and it also tells you your HTTP methods, such as GET, POST, OPTIONS, and HEAD, 00:02:21.600 --> 00:02:24.250 and it notes that the Apache default file was found. 00:02:24.480 --> 00:02:29.590 So let's go ahead and take a moment to scan one of the intentionally 00:02:29.590 --> 00:02:32.250 vulnerable web apps, this one right here, bWAPP. 00:02:32.940 --> 00:02:39.260 So what I can do is copy this, go back into our terminal, and we'll clear 00:02:39.260 --> 00:02:47.820 this screen and do you nikto ‑host, and we'll use the http://, IP address, 00:02:47.820 --> 00:02:52.110 //bWAPP so that we can scan that application. 00:02:52.360 --> 00:02:53.450 Let's give that a try. 00:02:53.840 --> 00:02:56.320 We've already got some additional information here, 00:02:56.330 --> 00:02:59.530 such as bWAPP/documents: Directory indexing found. 00:02:59.530 --> 00:03:01.030 So that's something that's interesting. 00:03:01.030 --> 00:03:03.290 You'd want to check that out during an assessment. 00:03:03.360 --> 00:03:07.560 You've got a folder called passwords that allows for directory indexing. 00:03:08.180 --> 00:03:14.020 Nikto was able to find the phpinfo.php file, and the scan took 58 seconds. 00:03:14.030 --> 00:03:15.750 And at this point in time, 00:03:15.750 --> 00:03:19.490 I would go over all of the results and then try some of this stuff out. 00:03:19.490 --> 00:03:23.450 So, in this case, maybe take a look at this directory here, 00:03:24.480 --> 00:03:31.080 copy that, and we can paste it, and it looks like we have the 00:03:31.080 --> 00:03:34.360 directory indexing like Nikto had told us. So now we could go into 00:03:34.360 --> 00:03:37.050 some of these files and see what all is available. 00:03:37.440 --> 00:03:42.590 If you create a text file and you enter the host information followed by Enter, 00:03:42.650 --> 00:03:48.100 then you can have Nikto use that instead of providing a URL or an IP 00:03:48.100 --> 00:03:51.920 address when you do nikto ‑h. So let's take a look at the Nikto 00:03:51.920 --> 00:03:56.070 targets file, and what I've got here is three IP address of a host 00:03:56.640 --> 00:03:58.350 with a colon and then the port. 00:03:58.390 --> 00:03:59.980 So if this was on a different port, 00:03:59.980 --> 00:04:03.140 I could've chosen to use 4040 or 8080 or whatever the 00:04:03.140 --> 00:04:04.560 port is that I want it to scan. 00:04:05.440 --> 00:04:10.500 And then also, I've got the URL http://, and I've got the 00:04:10.510 --> 00:04:16.779 xvwa.local/xvwa so that we'll scan that application as well. 00:04:18.440 --> 00:04:24.520 And the command is as simple as just going nikto ‑host and then niktotargets. 00:04:25.440 --> 00:04:26.420 And we'll let that run. 00:04:26.630 --> 00:04:31.050 This is on the first target, which is the 192.168.30.135. 00:04:33.940 --> 00:04:36.870 And now we've started on this second host, and there we go. 00:04:36.870 --> 00:04:41.140 We have now scanned multiple hosts based on the information that was in the 00:04:41.140 --> 00:04:45.360 text file that I've created for Nikto targets. And this could easily have been 00:04:45.360 --> 00:04:49.440 a list of hundreds or even thousands of targets. 00:04:49.510 --> 00:04:51.980 Keep in mind some of these has to take a long time, 00:04:51.980 --> 00:04:52.590 these scans, 00:04:52.700 --> 00:04:55.440 so make sure that you take that into consideration 00:04:55.440 --> 00:04:56.850 when you're creating these lists. 00:04:57.140 --> 00:05:00.160 One of the nice features about Nikto is the capability to 00:05:00.160 --> 00:05:03.650 leverage plugins, so let's go ahead and try to list the 00:05:03.650 --> 00:05:04.620 plugins that are out there, 00:05:04.620 --> 00:05:13.150 which is simply nickto ‑list‑plugins. And you'll have the plugin name, 00:05:13.580 --> 00:05:15.660 a short description, and then the author. 00:05:15.810 --> 00:05:21.320 So let's take a look at some of these. Here we have one plugin, robots. 00:05:21.560 --> 00:05:24.750 It checks whether there's anything within the robots text file and then 00:05:24.750 --> 00:05:28.450 analyzes it for other paths to pass into other scripts. 00:05:29.340 --> 00:05:34.630 If you use the option nocheck, the flag to disable checking entries and robots 00:05:34.630 --> 00:05:39.190 file will be used. And then that way you're not actually going to these files 00:05:39.190 --> 00:05:40.950 and directories, and it's a bit more passive. 00:05:41.370 --> 00:05:44.040 It will just check to see if the robots.txt exists. 00:05:44.290 --> 00:05:45.850 So let's go ahead and try these out. 00:05:46.940 --> 00:05:51.300 We'll begin by clearing the screen, and we'll try nocheck first, so nikto 00:05:51.440 --> 00:05:56.520 ‑Plugins. We have robots and then our option of nocheck. 00:05:56.570 --> 00:05:58.180 And then we have to specify our host. 00:05:59.390 --> 00:06:00.350 And we'll give this a try. 00:06:01.840 --> 00:06:03.830 And yes, there is a robots.txt file. 00:06:03.830 --> 00:06:05.190 It contains five entries, 00:06:05.190 --> 00:06:08.260 which should be manually viewed. Now if we weren't attempting 00:06:08.260 --> 00:06:13.600 to be quite that passive, then what we could do is eliminate 00:06:13.600 --> 00:06:16.970 this option here and run it again. 00:06:18.400 --> 00:06:22.670 And this time you have the entries listed and some additional information, 00:06:22.670 --> 00:06:25.610 such as the fact that admin and robots.txt return a 00:06:25.610 --> 00:06:29.050 non‑forbidden or redirect HTTP code of 200. 00:06:29.240 --> 00:06:30.330 Let's clear the screen. 00:06:31.940 --> 00:06:35.930 So let's take a look at how we can save the positive findings that we've 00:06:35.940 --> 00:06:41.340 identified in a scan and then replay those with replay.po. So let's 00:06:41.340 --> 00:06:48.710 start a normal scan. And in this case, we're going to ‑Save and then use 00:06:48.710 --> 00:06:50.850 a period to tell it to auto name. 00:06:52.740 --> 00:06:57.000 We'll let this scan run. All right, and now the scan is completed, so let's 00:06:57.000 --> 00:07:02.600 take a look at the files here, 192.168.30.135 folder. 00:07:02.790 --> 00:07:05.390 So we'll take a look at that, and we will list. 00:07:05.540 --> 00:07:07.420 And here are all of these findings. These are the 00:07:07.420 --> 00:07:08.890 positive findings that we've had. 00:07:08.890 --> 00:07:13.690 So if we take a quick look at what one of these looks like, in this case, 00:07:13.690 --> 00:07:18.800 the file that ends with 003584, and this contains all of the information 00:07:18.810 --> 00:07:21.940 that Nikto will need when using the replay script. 00:07:22.160 --> 00:07:23.660 So let's go ahead and clear this out. 00:07:23.970 --> 00:07:30.650 Replaying this will be as simple as using replay.pl and then pasting the file 00:07:30.650 --> 00:07:36.130 name in here and pressing Enter. Now there is a lot of information here. So 00:07:36.130 --> 00:07:43.250 we've got the request to the 192.168.30.135 on port 80 for the icons and then 00:07:43.250 --> 00:07:51.440 README. We've got a test ID. We've got the OSVDB ID, so that's short for Open 00:07:51.440 --> 00:07:53.110 Sourced Vulnerability Database. 00:07:53.740 --> 00:07:55.050 And then we've got the message. 00:07:55.060 --> 00:08:00.050 So in this case, an Apache default file was found. And then its sent that 00:08:00.050 --> 00:08:04.190 request and then indexed the response, and this is the file that we got so 00:08:04.190 --> 00:08:06.120 that we know that this file still exists.