One of the tools that we're going to become very familiar with throughout the
course of pin testing and especially when we're pin testing remote sites that
are on web servers is Nikto and in IKTO and it comes default installed on Cali.
So we shouldn't have to install anything else.
Now, yes, there is a Windows variant to this, but we want to stay true to pin
103 and pin 200 objectives and try to stick with Cali as much as possible.
So let's pop over to the side screen real quick and you can see here that in
the background, I have our be WAP.test site available to us.
And in order for us to be able to get an assessment of the actual site itself,
we can run a Nikto generalized scan to get an output for us.
So we're going to start off with pseudo because I like running this as pseudo
in IKTO and we're going to go -h be it our host HTTP.
WAP WAP.test and then the -o is going to tell us where our output is.
So for this case, we're going to say slash home Cali desktop and I'm going to
create a folder here on the desktop.
And call it Nikto.
And then we can complete that with Nikto.
And then I'm going to say -f for format in HTML.
Now this does support multiple formats.
The reason we're doing an HTML is to make it a little bit easier on us to be
able to visually examine the results from what's happening.
It'll still, as I press enter, ask us for our pseudo password and run in the
background.
You can see there that I'm unable to open Nikto for write.
And it would probably help if I put in the full path to the actual file name
that I wanted to be saved as to.
And as I'm running this, I will have the commands for this below as we make our
way through the different options that Niko has to give us.
You can see that it's running in the background and also it's going to create a
file inside of our Nikto folder.
And as I zoom in for us real quick, you could see that it's covering a couple
of things.
It's basically doing a crawl, so to speak, not necessarily downloaded
everything for that crawl as we would traditionally think, but it is trying to
examine as much as it can based on the permissions that it has.
And you can see that there are other things notified, like options available to
us for HTTP request.
Now I'm going to go into the actual results page, Nikto, and then go into
results, HTM, and show us what this actually looks like as an example.
So that way it's a little bit easier to read.
And I'm going to start off, put this in a way to where we can see it a little
bit better right there.
You can see that it not only gave us, sorry, the actual name of the web server
that we put in ourselves in the command, but also it resolved the actual IP
address based on information and DNS.
Now this may vary, depending on if, let's say your web servers like on cloud
flare or something like that, where it has a variety of different IPs that it
masks itself behind, but it will get as close as possible based on readily
available information.
In addition to that, it tells us also the type of server that it's running the
port that we're going through.
And as we continue down, you can see that we actually have PHP information as
well.
And that power retreat, X powered by header, we're using PHP 7.4.33.
Now I mentioned in the previous skill that that's how bwap.test operates
because it does, it's not fully functional with PHP 8.
But this type of information right here is what we're able to take away and
start doing more research in documentation to see what vulnerabilities are
available in this versioning of PHP.
Now this is the most recent version of PHP 7.
So any vulnerabilities that pop up in C.I.S.A.
or even Nessus definitions would be applicable to this generally.
And as we go down, we start to see that we even have a little bit of
vulnerability assessment on the site itself.
For instance, we're taking a look here at the anti clicking X frame options
header is not present.
Now, what does this do and what does it mean for our actual website?
Because you could see their references, we actually have a documentation to
where we can go through it and understand further what anti clickjacking means
for our website.
Well, I'm glad you asked because I can actually reference this against the O
Auth top 10 site and I will put this on a link below.
You can see here, make sure my OBS is reporting correctly that this is the
information pertaining to the actual clickjacking defense.
Sorry, I had to re-click on it and I will have a link for this below.
And it gives us a cheat sheet.
Basically, how to defend against the actual clickjacking itself.
So different types of configurations, different types of policies that you
could put in place on the actual server itself.
And you take this information right here and test against the actual website in
existence.
So we're taking information that defenders would normally use in their
vulnerability assessment and we're applying it as an offense.
So we're going to be able to go through and apply future exploits to decide to
try to take it over.
Now, as you can see, there are many different vulnerabilities that were
identified inside of our basic NITO scan of the actual website overall.
But one thing I do want to point out as well is that when this scan was ran, it
was ran against the actual top level FQDN of BWAP.test.
And we want to examine it a little bit deeper. We may also need to put in a
directory that were found through tools like DOBUSTER or WGET when we were
trying to execute the entirety of the actual crawl itself.
And at the very bottom, you can see the actual full command that we were used
along with the versioning.
Now, one thing that I do want to point out is that NITO is not quiet, but we're
going to go more into that in a minute because I want to cover just a couple
more examples of usage of NITO.