mirror of
https://github.com/davidalvarezp/websec-audit.git
synced 2026-06-23 11:48:28 +02:00
57 lines
1.3 KiB
Markdown
57 lines
1.3 KiB
Markdown
|
---
|
||
|
|
title: "Module 07 · Nikto"
|
||
|
|
description: Nikto web server vulnerability scanner integration.
|
||
|
|
---
|
||
|
|
|
||
|
|
# Module 07 · Nikto
|
||
|
|
|
||
|
|
**Flag:** `--skip-nikto`
|
||
|
|
|
||
|
|
Runs Nikto against the target and classifies findings by severity.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## What Nikto checks
|
||
|
|
|
||
|
|
- Outdated server software with known CVEs
|
||
|
|
- Default files and scripts (admin panels, test pages, install scripts)
|
||
|
|
- Dangerous HTTP methods (PUT, DELETE, TRACE)
|
||
|
|
- Server misconfigurations
|
||
|
|
- Cookie and header issues not covered by Module 05
|
||
|
|
- Common web application vulnerabilities
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Mode behaviour
|
||
|
|
|
||
|
|
| Mode | Nikto flags |
|
||
|
|
|---|---|
|
||
|
|
| Normal | Default plugins, 10-minute max |
|
||
|
|
| Aggressive | `--Plugins @@ALL` — runs every available plugin |
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Severity classification
|
||
|
|
|
||
|
|
Nikto findings are auto-classified:
|
||
|
|
|
||
|
|
| Pattern in output | Assigned severity |
|
||
|
|
|---|:---:|
|
||
|
|
| `vuln`, `exploit`, `inject`, `XSS`, `CVE`, `OSVDB-XXXX` | <span class="sev sev-high">HIGH</span> |
|
||
|
|
| `outdated`, `version`, `disclose`, `found`, `enabled` | <span class="sev sev-medium">MEDIUM</span> |
|
||
|
|
| Everything else | <span class="sev sev-low">LOW</span> |
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
## Output files
|
||
|
|
|
||
|
|
```
|
||
|
|
vulns/
|
||
|
|
├── nikto.txt
|
||
|
|
└── nikto.json
|
||
|
|
```
|
||
|
|
|
||
|
|
!!! tip "Nikto can be noisy"
|
||
|
|
Nikto generates many false positives. Review each finding manually before including it in a formal report.
|
||
|
|
Use `--skip-nikto` in quick assessments where time is limited.
|