retour aux outils back to tools Ducklings

Nikto

Scanner de serveur web qui vérifie les fichiers dangereux, les versions de logiciels obsolètes et les mauvaises configurations courantes. Web server scanner that checks for dangerous files, outdated software versions, and common misconfigurations.

↗ https://github.com/sullo/nikto

Overview

Nikto is an open-source web server scanner that performs comprehensive tests including checking for over 6700 potentially dangerous files, outdated server software, and version-specific vulnerabilities. It’s noisy but thorough.

Common Usage

Basic scan

nikto -h https://target.com

Scan specific port

nikto -h 10.10.10.1 -p 8080

Scan with authentication

nikto -h https://target.com -id admin:password
# Save report
nikto -h https://target.com -o report.html -Format htm
nikto -h https://target.com -o report.txt

Scan through proxy (Burp)

nikto -h https://target.com -useproxy http://127.0.0.1:8080

Scan specific path

nikto -h https://target.com -root /webapp/

Disable SSL cert verification

nikto -h https://target.com -nossl

Key Findings to Review

  • Server version — check CVE databases for the detected version
  • Dangerous files — .git/, phpinfo.php, backup.zip, admin panels
  • Missing headers — X-Frame-Options, X-Content-Type-Options, CSP
  • Default content — default index files, sample scripts
Help / Man page 
nikto -h <host> [options]

TARGET:
  -h HOST         Target host/IP/URL
  -p PORT         Target port (default: 80)
  -ssl            Force SSL/HTTPS
  -vhost HOST     Virtual host to send in Host header

SCANNING:
  -Tuning x       Scan tuning (0-9, x = multiple):
                  0=File Upload, 1=Interesting File,
                  2=Misconfiguration, 3=Info Disclosure,
                  4=Injection, 5=Remote File Retrieval,
                  6=Denial of Service, 7=Remote Shell,
                  8=Command Execution, 9=SQL Injection

AUTHENTICATION:
  -id USER:PASS   HTTP Basic/NTLM authentication
  -C all          Test all cookies

OUTPUT:
  -o FILE         Output file
  -Format FORMAT  htm, csv, txt, xml, json

PERFORMANCE:
  -timeout N      Timeout per request (default: 10s)
  -useproxy URL   HTTP proxy

EVASION:
  -evasion N      IDS evasion technique (1-8)

Vue d’ensemble

Nikto est un scanner de serveur web open-source qui effectue des tests complets incluant la vérification de plus de 6700 fichiers potentiellement dangereux, de logiciels serveur obsolètes et de vulnérabilités spécifiques aux versions. Il est bruyant mais exhaustif.

Utilisation courante

# Scan de base
nikto -h https://target.com

# Scan sur un port spécifique
nikto -h 10.10.10.1 -p 8080

# Scan avec authentification
nikto -h https://target.com -id admin:password

# Sauvegarder le rapport
nikto -h https://target.com -o report.html -Format htm
nikto -h https://target.com -o report.txt

# Scanner via un proxy (Burp)
nikto -h https://target.com -useproxy http://127.0.0.1:8080

# Scanner un chemin spécifique
nikto -h https://target.com -root /webapp/

# Désactiver la vérification du certificat SSL
nikto -h https://target.com -nossl

Résultats clés à examiner

  • Version du serveur : vérifier les bases CVE pour la version détectée
  • Fichiers dangereux : .git/, phpinfo.php, backup.zip, panneaux d’administration
  • En-têtes manquants : X-Frame-Options, X-Content-Type-Options, CSP
  • Contenu par défaut : fichiers index par défaut, scripts exemples
Aide / Page de manuel 
nikto -h <host> [options]

TARGET:
  -h HOST         Target host/IP/URL
  -p PORT         Target port (default: 80)
  -ssl            Force SSL/HTTPS
  -vhost HOST     Virtual host to send in Host header

SCANNING:
  -Tuning x       Scan tuning (0-9, x = multiple):
                  0=File Upload, 1=Interesting File,
                  2=Misconfiguration, 3=Info Disclosure,
                  4=Injection, 5=Remote File Retrieval,
                  6=Denial of Service, 7=Remote Shell,
                  8=Command Execution, 9=SQL Injection

AUTHENTICATION:
  -id USER:PASS   HTTP Basic/NTLM authentication
  -C all          Test all cookies

OUTPUT:
  -o FILE         Output file
  -Format FORMAT  htm, csv, txt, xml, json

PERFORMANCE:
  -timeout N      Timeout per request (default: 10s)
  -useproxy URL   HTTP proxy

EVASION:
  -evasion N      IDS evasion technique (1-8)