WEBVTT 00:00:01.000 --> 00:00:03.480 In this next demonstration we're going to start with 00:00:03.480 --> 00:00:05.900 replaying a saved Nikto request, 00:00:06.640 --> 00:00:09.660 which is then followed by a configuration of Nikto in order 00:00:09.660 --> 00:00:11.850 to use a proxy such as Burp Suite Pro. 00:00:13.240 --> 00:00:16.670 We then move on to configuring Nikto to use authentication in 00:00:16.670 --> 00:00:19.250 the form of setting up a PHP session cookie. 00:00:20.740 --> 00:00:24.570 You'll learn about the different output formats and then receive a 00:00:24.570 --> 00:00:29.140 quick demonstration of how you can modify the HTML output templates in 00:00:29.140 --> 00:00:32.590 order to customize future reports that you get out of Nikto when 00:00:32.590 --> 00:00:34.750 selecting the HTML output setting. 00:00:36.740 --> 00:00:40.600 So now you've had a chance to see how you can replay the 00:00:40.610 --> 00:00:42.850 positive findings that you have from a Nikto scan. 00:00:42.850 --> 00:00:45.190 Now what if you wanted to actually put those into, 00:00:45.200 --> 00:00:47.520 or run those through a proxy like Burp Suite Pro? 00:00:47.570 --> 00:00:48.710 Well you can absolutely do that. 00:00:48.710 --> 00:00:51.990 Let's go ahead and get that configured here. Minimize the terminal, 00:00:52.050 --> 00:00:56.750 minimize the web browser, and we'll start up the Community Edition of Burp Suite. 00:00:57.740 --> 00:01:01.050 We'll use a temporary project, we'll use the Burp defaults, 00:01:01.350 --> 00:01:03.450 and take a look at the Proxy tab. 00:01:03.940 --> 00:01:08.250 We'll turn intercept off, choose Options, 00:01:09.440 --> 00:01:15.470 and we already have the proxy listener at 127.0.0.1 on port 8080. 00:01:15.480 --> 00:01:21.240 So now we need to run a scan through Nikto and point it at this proxy listener. 00:01:21.490 --> 00:01:24.660 So let's go ahead and minimize this, go back to the terminal, 00:01:24.770 --> 00:01:26.250 and run a scan through the proxy. 00:01:27.040 --> 00:01:31.830 We'll run this nikto ‑host and then the URL, or xvwa. 00:01:31.830 --> 00:01:38.390 And we'll instruct Nikto to useproxy at localhost on port 8080. 00:01:38.460 --> 00:01:39.490 We'll give this a try. 00:01:40.040 --> 00:01:45.710 Target IP is proxied, target hostname xvwa.local on port 80. 00:01:45.850 --> 00:01:49.950 And while this is running we'll hop over to Burp Suite to see the results. 00:01:50.640 --> 00:01:53.820 So if we look at the HTTP History you can see all of the 00:01:53.960 --> 00:01:57.250 requests and responses being proxied through Burp. 00:01:57.740 --> 00:02:00.080 This is very handy if you wanted to take one of these, 00:02:00.080 --> 00:02:00.820 for instance, 00:02:01.340 --> 00:02:05.670 and then send that to your repeater or any of the other 00:02:05.670 --> 00:02:07.550 tools that your proxy has available. 00:02:08.740 --> 00:02:12.790 Also, you have your target site map now. 00:02:12.790 --> 00:02:16.630 So that can help you if you have actual correct error codes and you 00:02:16.630 --> 00:02:19.070 can take a look at some of the 200 status codes, 00:02:19.070 --> 00:02:19.450 etc. 00:02:19.460 --> 00:02:22.740 So setting up a proxy is as simple as that with Nikto. 00:02:22.960 --> 00:02:24.930 All right, so now this scan is completed. 00:02:25.150 --> 00:02:28.860 If you know that you're always going to use the same proxy settings and 00:02:28.860 --> 00:02:32.250 configuration you can edit one of the config files. 00:02:32.340 --> 00:02:37.530 We'll take a look at nano /etc/nikto.conf, 00:02:37.540 --> 00:02:39.540 which is your default configuration file. 00:02:39.550 --> 00:02:41.000 As you can see at the top here, 00:02:41.010 --> 00:02:45.770 the authors of the Nikto application do strongly suggest that you copy 00:02:45.770 --> 00:02:49.250 this file once you've made changes to it so that that way the file 00:02:49.250 --> 00:02:51.240 won't be overridden when you do a git pull. 00:02:51.290 --> 00:02:52.650 So let's scroll down a bit. 00:02:53.440 --> 00:02:55.810 And there we have the proxy settings. 00:02:56.940 --> 00:03:00.380 So we'll go ahead and enable these And we're not using a username 00:03:00.420 --> 00:03:02.670 or password for the proxy, it's just Burp Suite. 00:03:02.740 --> 00:03:08.130 Save this out and exit, and let's run another scan. This time I'm simply going 00:03:08.130 --> 00:03:13.760 to select useproxy, press Enter, and target IP is proxied again and target 00:03:13.760 --> 00:03:20.340 hostname xvwa. You can verify that this information is being proxied by going 00:03:20.340 --> 00:03:23.450 to Proxy and HTTP History and there it is. 00:03:24.640 --> 00:03:28.790 So let's jump back into our terminal, and we will cancel this scan, 00:03:28.790 --> 00:03:33.930 Ctrl+C, and clear the screen. Nikto has the capability to set cookies 00:03:33.940 --> 00:03:37.650 so that if you have something like a PHP session cookie you can use 00:03:37.650 --> 00:03:39.550 that for your authentication needs. 00:03:39.940 --> 00:03:43.590 So let's go ahead and take a look at how to configure that. 00:03:44.040 --> 00:03:48.780 We'll begin by going to a browser that is currently pointed at Burp Suite. 00:03:49.640 --> 00:03:52.050 So I've already changed the proxy settings in here. 00:03:52.840 --> 00:03:59.680 And then I would perform a login of bee and bug. And I'll hop 00:03:59.680 --> 00:04:02.820 over here to Burp Suite and scroll to the top. 00:04:02.830 --> 00:04:08.740 There we have our login where we used the login bee and password bug. 00:04:09.840 --> 00:04:11.960 Then we've got our response here. 00:04:11.960 --> 00:04:13.830 We've got a PHP session ID. 00:04:14.740 --> 00:04:17.380 So let's go ahead and look around. 00:04:17.380 --> 00:04:19.550 Maybe go to this one here. 00:04:21.100 --> 00:04:23.080 Click Hack. We'll take a look at that request. 00:04:24.080 --> 00:04:28.740 The session ID remains the same, and that cookie is being passed 00:04:28.740 --> 00:04:33.990 each time. So we'll copy this and then go to Kali, and we're going 00:04:33.990 --> 00:04:37.890 to modify the /etc/nikto.conf file again. 00:04:39.140 --> 00:04:44.850 Let's scroll down to STATIC‑COOKIE. And we will paste that 00:04:44.850 --> 00:04:47.800 cookie in there and then add the proper quotes. 00:04:47.850 --> 00:04:49.580 There is an example above this. 00:04:49.660 --> 00:04:50.290 There we go. 00:04:50.420 --> 00:04:52.230 We'll write this out and exit. 00:04:52.280 --> 00:04:55.330 Now we're going to run a scan and use the proxy so that we 00:04:55.330 --> 00:04:57.650 can see how Nikto is using the cookie. 00:04:59.640 --> 00:05:03.770 So here we have a scan, nikto ‑host, the URL, or the portal.php 00:05:03.770 --> 00:05:06.970 page, we're instructing it to use the proxy that we've got set 00:05:06.970 --> 00:05:08.970 up and ‑nossl. Give this a try. 00:05:10.340 --> 00:05:10.850 There we go. 00:05:10.850 --> 00:05:12.120 We can take a look at one of these. 00:05:12.120 --> 00:05:14.270 Look at the response and request. 00:05:14.580 --> 00:05:20.180 We'll look at the parameters. And you can see that the PHP session ID 00:05:20.180 --> 00:05:23.650 cookie is being passed with each of these requests. 00:05:24.080 --> 00:05:24.420 All right, 00:05:24.510 --> 00:05:27.350 so moving on, let's take a look at some of the different 00:05:27.360 --> 00:05:29.910 output formats that Nikto permits. 00:05:29.930 --> 00:05:32.850 Take a look at nikto ‑Help. Scroll up here. 00:05:32.860 --> 00:05:37.010 And if you use the ‑Format option you could save output as 00:05:37.010 --> 00:05:42.940 CSV, JSON, HTM, NBE, SQL, TXT, and XML. 00:05:43.050 --> 00:05:43.430 Okay, 00:05:43.430 --> 00:05:51.170 so we're going to run a basic scan using Nikto at the host 192.168.30.135 on 00:05:51.170 --> 00:05:58.150 default port 80, using the ‑Format option, and htm is the format that we 00:05:58.150 --> 00:06:02.710 want, and the output file to be named nikto.html. 00:06:02.760 --> 00:06:04.000 So let's give this a try. 00:06:06.740 --> 00:06:07.170 There we go. 00:06:07.170 --> 00:06:09.250 Let's take a look at the file that was generated. 00:06:09.430 --> 00:06:13.830 We've got nikto.html so we'll use Firefox to view this file. 00:06:14.120 --> 00:06:15.910 And here is a very nice report. 00:06:16.040 --> 00:06:20.280 It gives you information about your server, it has all of your findings, 00:06:20.280 --> 00:06:25.430 it has links to your server, and a summary of the host. 00:06:25.510 --> 00:06:30.540 What if you wanted to change the colors or change the title of this output? 00:06:30.800 --> 00:06:32.150 Well you can absolutely do that. 00:06:32.840 --> 00:06:35.990 Let's go ahead and close this out. Go back into the 00:06:35.990 --> 00:06:38.570 terminal and we will clear the screen. 00:06:39.440 --> 00:06:42.850 We'll take a look at one of the template files that we have in 00:06:42.850 --> 00:06:51.100 the nikto/templates directory. So we will edit the htm_start.tmpl 00:06:51.100 --> 00:06:56.010 file. And you can modify the title or you can change the styles. 00:06:56.010 --> 00:06:57.660 If we wanted larger font, 00:06:57.660 --> 00:07:00.540 for instance, you could change that here. You can change 00:07:00.540 --> 00:07:05.260 the colors and pretty much make the report something that's 00:07:05.260 --> 00:07:06.920 very specific for your needs. 00:07:07.340 --> 00:07:11.420 Now, please do keep in mind that you are not permitted to modify or 00:07:11.420 --> 00:07:14.450 remove the copyright statements within these templates. 00:07:14.840 --> 00:07:18.450 You could technically place them into a different template that's being used, 00:07:18.840 --> 00:07:22.500 but they absolutely must remain within the reports that are being generated. 00:07:22.510 --> 00:07:24.610 So let's close this out. Exit. 00:07:24.620 --> 00:07:27.250 We can run another scan to see the modifications. 00:07:28.200 --> 00:07:31.630 So let's take a look at it. And the font's a bit 00:07:31.630 --> 00:07:33.810 larger now. It's still the same report. 00:07:35.270 --> 00:07:38.180 Let's scroll down and look at the results of the report.