Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- How to check #webserver by #Nikto
- ------------------------------------
- This is wonderful #perl script to check the web server #security and #vulnerability .
- Get it from here :http://www.cirt.net/nikto2
- Here are some key features of "Nikto":
- - Uses rfp's LibWhisker as a base for all network funtionality
- - Main scan database in CSV format for easy updates
- - Determines "OK" vs "NOT FOUND" responses for each server, if possible
- - Determines #CGI directories for each server, if possible
- - Switch #HTTP versions as needed so that the server understands requests properly
- - SSL Support (#Unix with #OpenSSL or maybe Windows with ActiveState's Perl/#NetSSL)
- - Output to file in plain text, HTML or CSV
- - Generic and "server type" specific checks
- - Plugin support (standard PERL)
- - Checks for outdated server software
- - #Proxy support (with #authentication)
- - Host authentication (Basic)
- - Watches for "bogus" OK responses
- - Attempts to perform educated guesses for Authentication realms
- - Captures/prints any Cookies received
- - Mutate mode to "go fishing" on web servers for odd items
- - Builds Mutate checks based on robots.txt entries (if present)
- - Scan multiple ports on a target to find web servers (can integrate #nmap for speed, if available)
- - Multiple IDS evasion techniques
- - Users can add a custom scan #database
- - Supports automatic code/check updates (with web access)
- - Multiple host/port scanning (scan list files)
- - Username guessing plugin via the cgiwrap program and #Apache ~user methods
- Sample Output
- ------------------
- $ nikto.pl -h yourwebserver
- This is sample output - yours may be different.
- nikto.pl -h webserv
- - Nikto v2.03/2.04
- ---------------------------------------------------------------------------
- + Target IP: 198.162.5.2
- + Target Hostname: wevserv
- + Target Port: 80
- + Start Time: 2009-08-30 10:17:12
- ---------------------------------------------------------------------------
- + Server: Apache/2.2.0 (Fedora)
- + No CGI Directories found (use '-C all' to force check all possible dirs)
- + Apache/2.2.0 appears to be outdated (current is at least Apache/2.2.9). Apache 1.3.39 and 2.0.61 are also current.
- + OSVDB-877: TRACE / : TRACE option appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details
- + 3577 items checked: 2 item(s) reported on remote host
- + End Time: 2009-08-30 10:17:21 (9 seconds)
- ---------------------------------------------------------------------------
- + 1 host(s) tested
- Test Options: -h webserv
- ---------------------------------------------------------------------------
- Source : http://www.commandlinefu.com/commands/view/3241/how-to-check-webserver-by-nikto
- . #UnhappyGhost #GeekSchool #GeekSch00l
- .
- ##############################################################
- # ṲИℋÅℙℙУḠ♓☮$✝ #
- ##############################################################
- || Website --------> http://unhappyghost.com/ ||
- || Facebook -------> https://www.facebook.com/unhappygh0st ||
- || FB Page --------> https://www.facebook.com/geeksch00l ||
- || Twitter --------> https://twitter.com/unhappygh0st ||
- || Google+ --------> http://goo.gl/WCHeJR ||
- || Youtube --------> http://goo.gl/A3mQIE ||
- || IPv6 Vids ------> http://goo.gl/Rbcxk ||
- || IPv6 Event -----> http://goo.gl/TaeXv ||
- ##############################################################
- .
Add Comment
Please, Sign In to add comment
