20. Vulnerability Scanning and Assessment
20.5 Nikto: Web Server Scanning
Nikto checks web servers for dangerous files, outdated server software, default pages and missing security headers. It is noisy (not stealthy) but quick – perfect for a first look at the Apache and Nginx servers you built in Chapters 7–9.
nikto -h http://192.168.56.20 # scan the web server on Metasploitable 2
nikto -h http://192.168.56.20/dvwa/ # scan one application path
nikto -h 192.168.56.20 -p 80,8180 # several ports (8180 = Tomcat on Metasploitable 2)
nikto -h http://192.168.56.20 -o nikto_msf2.html -Format htm # save an HTML report
Typical findings and what they mean:
| Nikto says | Meaning | Fix (from what you learned earlier) |
|---|---|---|
Server version disclosed (Apache/2.2.8) |
Attacker learns the exact version | ServerTokens Prod, ServerSignature Off (Apache); server_tokens off; (Nginx) |
| Directory indexing found | Files in a folder are listed publicly | Options -Indexes (Apache); autoindex off; (Nginx) |
phpinfo.php found |
Full PHP configuration exposed | Delete test files from the web root |
| X-Frame-Options / Content-Security-Policy header missing | Clickjacking and XSS protection absent | Add security headers in the server config |
| HTTP TRACE method enabled | Old cross-site tracing risk | TraceEnable off (Apache) |
Ravindra Bagale's Tip
Nikto khup "OSVDB" aani "may be" findings deto – sagle khare nastat. Pratyek finding browser madhe kiwa curl -I ne swatah confirm kara. Aani mahatvacha: Chapter 16 chya reels project madhe phpinfo.php test sathi thevla asel tar aata kadhun taka!
Lab
Run Nikto against http://192.168.56.20 and save the HTML report. Pick three findings and confirm each manually with curl -I or the browser. Then run Nikto against your own Apache server from Chapter 8, fix two findings in the config, restart with sudo service httpd restart, and scan again to confirm they are gone.