Now you may have noticed that I am no longer in MSF console and that's because those are
the two I wanted to show you inside of there and now it's time to move on to Nikto.
Nikto is probably one of the most powerful web scanning tools out there for vulnerability
assessment and some other stuff. But I saved it to last because it's not only not that difficult
to use but it's also one of the ones that you need to be most familiar with because this is
kind of the go-to for pen testers out there. Now this does web application scanning much like
BurpSweep but if you remember earlier in this course when we used BurpSweep we were doing
packet capturing essentially inside of the interceptor and then sending it to the repeater
after modifying the request and all that went through a proxy. So that means that you're
somewhere in the middle between the actual web server and the actual client themselves
and that's not always going to be the case because you aren't always on the actual organization's
network and you would have to go through and make sure that that client is actually using
you as a proxy. Now there are ways to get around that and we've discussed them and done one but
this is just something I wanted to bring up because with Nikto you can actually do a vulnerability
assessment without actually having to do those request captures and I mentioned OWASP earlier
where some of our Metasploit tools are in line with OWASP like our first vulnerability assessment
tool inside of for Metasploit WMAP. This one in particular Nikto does in fact ride and coincide
with using the rules and updates from OWASP ZAP. The ZAP side is the actual website vulnerability
assessment and basically you get all the top 20s and everything like that for actual websites
themselves. Now you may be wondering what is the complexity of writing Nikto and it's not that hard.
Commands below but we're going to be starting off with sudo and going into nikto-h 192.168.0.13
and we're going to assign statically the port of 80. Now if this is different for your website
I'd like for you to be keeping that in mind because if it's SSL or TLS it would be 443 or
if it's an uncommon port and we do things like Nessus and you would have to use the port for that
etc. So when you run this after you type in the password for Kali it's going to go in and find
that port 80 is open and when this is ran and completed we will take a look at this when it's
done. Well would you look at that it didn't take that long at all. I know it was just like that
but it actually only took about three to four minutes maybe. So that means it's not that bad
and in fact you can see that I'm actually over exaggerating it ran in 12 seconds and it will
give you a breakdown of everything that ran. Now you can output all this to a file if you want to
pipe it over there but this is probably one of the easiest tools and most comprehensive that we
have all together. It's the best of both worlds simplistic and goes through and checks for a lot
of stuff along with having a very simplistic output which is always good. So will it tell
you every single thing about the actual website itself? No but that's any tool you're not going
to get 100% results every single time which is why we're covering multiple tools inside of this skill
so what we do know is is that we got a very simplistic output of what's actually going on
the target host target ip address and the reason those match is because we did put it in by ip you
could put it in fqdn if you wanted and right away we know that the target port is port 80. We
identified that statically with the dash p in our syntax for the command which is in the code box
and it says right off the gate iis 10.0 and you already get the php versioning number for this
along with the header is not present for anti-click jacking x-frame options you're
starting to get a little bit more detail into this now as far as the vulnerabilities go
and this isn't really for us to take advantage of what is it earlier skills it's us for for us to
let the organization know what's actually going on on their particular website and how it can be
used against them and how okay yes let's do it and then show them for ourselves but in all
seriousness though you'll notice that some of the things like that last line where it says options
these are some of the same results that you're getting from the vulnerability assessments inside
of metasploit as well too so are we getting a lot of the same results absolutely but that's not to
take away from what it is that we're doing because if you go through this and do this on your own
like we pointed out a couple of different small things here and there you'll notice that there are
some differences here and there between the different vulnerability scanners and by piecing
all these different parts together you get a more perfect picture of what the total state
or current condition of that actual website is now you can go back and look at those results
and you'll notice that the actual php sites like the root page redirects to bwap.login.php
so if you're wanting to go through and use your other vulnerability scanners and assessment tools
to go straight to the actual site that you don't know where it's at you can use tools like neato
to actually get you there and you need to be cognizant of the fact that when these scanner
tools run they make a lot of noise on the network and that's something we've covered before too so
when you run these don't run them one right after the other like we just did this is the kind of
thing that will get us blocked on the network real quick and make our pen testing against
an organization way more complex