{"id":9641,"date":"2021-07-10T22:43:50","date_gmt":"2021-07-10T19:43:50","guid":{"rendered":"https:\/\/kifarunix.com\/?p=9641"},"modified":"2024-03-18T19:43:27","modified_gmt":"2024-03-18T16:43:27","slug":"install-and-use-nikto-web-scanner-on-ubuntu-20-04","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/install-and-use-nikto-web-scanner-on-ubuntu-20-04\/","title":{"rendered":"Install and Use Nikto Web Scanner on Ubuntu 20.04"},"content":{"rendered":"\n<p>Hello folks, today we are going to learn how to install and use Nikto web scanner on Ubuntu 20.04 server.<\/p>\n\n\n\n<p>Nikto is a<strong>&nbsp;<code>Perl<\/code><\/strong>&nbsp;based open-source web vulnerability scanner that can unearth every other potential threat on your web server including but not limited to;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Insecure files and programs<\/li>\n\n\n\n<li>Outdated servers and programs<\/li>\n\n\n\n<li>Server and software misconfigurations<\/li>\n\n\n\n<li>Default files and programs<\/li>\n<\/ul>\n\n\n\n<p>Nikto can run on almost any Operating system with Perl interpreter installed. It supports SSL, proxies, host authentication, attack encoding, IDS evation etc.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Installing Nikto Web Scanner on Ubuntu 20.04<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Install Nikto on Ubuntu 20.04<\/h3>\n\n\n\n<p>Installation of nikto on Ubuntu 20.04 is pretty straight forward as the package is available on the default repositories. Thus, run the commands below to install nikto.<\/p>\n\n\n\n<p>Update your package repos and upgrade your server;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>apt update<\/code><\/pre>\n\n\n\n<p>Install Nikto on Ubuntu 20.04<\/p>\n\n\n\n<p>Perl is already installed on Ubuntu 20.04:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>apt list perl -a<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Listing... Done\nperl\/focal-updates,focal-security,now 5.30.0-9ubuntu0.2 amd64 &#91;installed,automatic]\nperl\/focal 5.30.0-9build1 amd64<\/code><\/pre>\n\n\n\n<p>Therefore, the command below will install Nikto and all the required dependencies.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>apt install nikto -y<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Basic Usage of Nikto<\/h3>\n\n\n\n<p>The basic nikto command line syntax is:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code><strong>nikto [options...]<\/strong><\/code><\/pre>\n\n\n\n<p>When run without any command line options, it shows basic description of various command options;<\/p>\n\n\n\n<pre id=\"block-33b401f5-0dd3-47cf-b6b8-62a935545039\" class=\"wp-block-preformatted\">nikto<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>- Nikto v2.1.5\n---------------------------------------------------------------------------\n+ ERROR: No host specified\n\n       -config+            Use this config file\n       -Display+           Turn on\/off display outputs\n       -dbcheck            check database and other key files for syntax errors\n       -Format+            save file (-o) format\n       -Help               Extended help information\n       -host+              target host\n       -id+                Host authentication to use, format is id:pass or id:pass:realm\n       -list-plugins       List all available plugins\n       -output+            Write output to this file\n       -nossl              Disables using SSL\n       -no404              Disables 404 checks\n       -Plugins+           List of plugins to run (default: ALL)\n       -port+              Port to use (default 80)\n       -root+              Prepend root value to all requests, format is \/directory \n       -ssl                Force ssl mode on port\n       -Tuning+            Scan tuning\n       -timeout+           Timeout for requests (default 10 seconds)\n       -update             Update databases and plugins from CIRT.net\n       -Version            Print plugin and database versions\n       -vhost+             Virtual host (for Host header)\n   \t\t+ requires a value\n\n\tNote: This is the short help output. Use -H for full help text.\n<\/code><\/pre>\n\n\n\n<p>If you want to see more details about the options above, run the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -H<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Using Nikto to Perform Web Scanning<\/h3>\n\n\n\n<p>In this section, we are going to see how Nikto is used with various command line options shown above to perform web scanning.<\/p>\n\n\n\n<p>In its basic functionality, Nikto requires just an host an to scan. The target host can be specified with the&nbsp;<strong>-h&nbsp;<\/strong>or&nbsp;<strong>-host&nbsp;<\/strong>option. For example, to scan a web server whose IP address is&nbsp;<strong>192.168.60.19<\/strong>, run Nikto as follows;<\/p>\n\n\n\n<pre id=\"block-95be1356-7756-45c3-9018-37a0c33895a7\" class=\"wp-block-code\"><code>nikto -host 192.168.60.19<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n- Nikto v2.1.5\n---------------------------------------------------------------------------\n+ Target IP:          192.168.60.19\n+ Target Hostname:    dvwa.kifarunix-demo.com\n+ Target Port:        80\n+ Start Time:         2021-07-12 19:24:17 (GMT0)\n---------------------------------------------------------------------------\n+ Server: Apache\/2.4.37 (rocky)\n+ Retrieved x-powered-by header: PHP\/7.4.6\n+ The anti-clickjacking X-Frame-Options header is not present.\n+ Cookie PHPSESSID created without the httponly flag\n+ Cookie security created without the httponly flag\n+ Root page \/ redirects to: login.php\n+ Server leaks inodes via ETags, header found with file \/robots.txt, fields: 0x1a 0x5c6f1b510366c \n+ File\/dir '\/' in robots.txt returned a non-forbidden or redirect HTTP code (302)\n+ \"robots.txt\" contains 1 entry which should be manually viewed.\n+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST\n+ OSVDB-3268: \/config\/: Directory indexing found.\n+ \/config\/: Configuration information may be available remotely.\n+ OSVDB-3268: \/tests\/: Directory indexing found.\n+ OSVDB-3092: \/tests\/: This might be interesting...\n+ OSVDB-3268: \/icons\/: Directory indexing found.\n+ OSVDB-3268: \/docs\/: Directory indexing found.\n+ OSVDB-3233: \/icons\/README: Apache default file found.\n+ \/login.php: Admin login page\/section found.\n+ OSVDB-3092: \/.git\/index: Git Index file may contain directory listing information.\n+ 6544 items checked: 0 error(s) and 17 item(s) reported on remote host\n+ End Time:           2021-07-12 19:24:26 (GMT0) (9 seconds)\n---------------------------------------------------------------------------\n+ 1 host(s) tested\n<\/code><\/pre>\n\n\n\n<p>As you can see from the output, when the target host is specified without a port, nikto scans port&nbsp;<strong>80<\/strong>&nbsp;by default.<\/p>\n\n\n\n<p>However, if your web server is running on a different port, you have to specify the port using the&nbsp;<strong>-p<\/strong>&nbsp;or&nbsp;<strong>-port<\/strong>&nbsp;option.<\/p>\n\n\n\n<p>See example below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -h 192.168.60.15 -p 8080<\/code><\/pre>\n\n\n\n<p>If you have multiple virtualhosts on the same host server listening on different ports, you can specify multiple ports by separating them with comma.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -h 192.168.60.19 -p 8080,8888<\/code><\/pre>\n\n\n\n<p>You can also specify a range of ports in the format&nbsp;<strong>port1-portN<\/strong>&nbsp;for example,<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -h 192.168.60.19 -p 8080-8888<\/code><\/pre>\n\n\n\n<p>Instead of using the IP address to specify the target host, URLs can also be used for example;<\/p>\n\n\n\n<pre id=\"block-72950419-32a4-4225-8222-de27ac820349\" class=\"wp-block-preformatted\">nikto -h mydvwa.example.com<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -h https:\/\/mydvwa.example.com<\/code><\/pre>\n\n\n\n<p>You can also specify the port when you use URL;<\/p>\n\n\n\n<pre id=\"block-87aafcca-767e-4237-9d4b-fa6a275197d7\" class=\"wp-block-preformatted\">nikto -h mydvwa.example.com -p 8080<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -h https:\/\/mydvwa.example.com -p 8443<\/code><\/pre>\n\n\n\n<p>or<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -h mydvwa.example.com:8080<\/code><\/pre>\n\n\n\n<pre id=\"block-6ec548e3-ba13-40d5-a405-8c3eff64082e\" class=\"wp-block-preformatted\">nikto -h https:\/\/mydvwa.example.com:8443\/<\/code><\/pre>\n\n\n\n<p>As much as target hosts can be specified using the&nbsp;<strong>-p<\/strong>&nbsp;option, it is also possible to specify a file containing a list of target hosts one per line. For instance, you file should should contains the targets in the format;<\/p>\n\n\n\n<pre id=\"block-70127863-cf3f-4c51-9331-1fb74300ad8d\" class=\"wp-block-preformatted\">cat scan-targets<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>https:&#47;&#47;mydvwa.example.com:443\/\n192.168.60.19:8888\n192.168.43.101<\/code><\/pre>\n\n\n\n<p>To scan these hosts at the same time, run the command below;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -h scan-targets<\/code><\/pre>\n\n\n\n<p>It is also possible to scan the hosts in a network listening on web server ports using Nmap and pass the output to nikto. For example to scan for open port 80 in a network, 192.168.43.0\/24,<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nmap -p80 192.168.43.0\/24 -oG - | nikto -h -<\/code><\/pre>\n\n\n\n<p>If you are going through a proxy server, you can ask nikto to use proxy by using the&nbsp;<strong>-useproxy<\/strong>&nbsp;option. You can set the proxy details on the nikto configuration file,&nbsp;<strong>\/etc\/nikto\/config.txt&nbsp;<\/strong>or you can it on the command line as shown below;<\/p>\n\n\n\n<p>To define the proxy server details in the \/etc\/nikto\/config.txt file, use the format;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PROXYHOST=192.168.20.45\nPROXYPORT=3128\nPROXYUSER=username\nPROXYPASS=password<\/code><\/pre>\n\n\n\n<p>When you have defined the proxy details as shown above, then run nikto as follows;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -h 192.168.20.128 -useproxy<\/code><\/pre>\n\n\n\n<p>To specify the proxy connection details on the command line;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -h 192.168.20.128 -useproxy http:\/\/id:password@192.168.20.23:3128\/<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -h 192.168.20.128 -useproxy http:\/\/@192.168.20.23:3128\/<\/code><\/pre>\n\n\n\n<p>Nikto can export scan results in different formats; CSV, HTML, XML, NBE, text. To save the results in a specific output format, you need to specify the&nbsp;<strong>-o\/-output<\/strong>&nbsp;option as well as the&nbsp;<strong>-Format<\/strong>&nbsp;option to define the output format. See examples below to save the scan results in html format.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -h 192.168.60.19 -o test.html -F html<\/code><\/pre>\n\n\n\n<p>You can therefore access the report via web browser. See screenshot below;<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/07\/nikto.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1385\" height=\"726\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/07\/nikto.png\" alt=\"Install and Use Nikto Web Scanner on Ubuntu 20.04\" class=\"wp-image-9663\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/07\/nikto.png?v=1626118473 1385w, https:\/\/kifarunix.com\/wp-content\/uploads\/2021\/07\/nikto-768x403.png?v=1626118473 768w\" sizes=\"(max-width: 1385px) 100vw, 1385px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>Nikto can also be fine tuned to perform specific scans. Below is a description of the tuning options that can be used to achieve this functionality.<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\n1 - Interesting File \/ Seen in logs\n2 - Misconfiguration \/ Default File\n3 - Information Disclosure\n4 - Injection (XSS\/Script\/HTML)\n5 - Remote File Retrieval - Inside Web Root\n6 - Denial of Service\n7 - Remote File Retrieval - Server Wide\n8 - Command Execution \/ Remote Shell\n9 - SQL Injection\n0 - File Upload\na - Authentication Bypass\nb - Software Identification\nc - Remote Source Inclusion\nx - Reverse Tuning Options (i.e., include all except specified)\n<\/code><\/pre>\n\n\n\n<p>For example, to test for SQL Injection and Remote File Retrieval \u2013 Server Wide, you would use nikto like;<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\"><code>nikto -h 192.168.60.19 -Tuning 79 -o test.html -F html<\/code><\/pre>\n\n\n\n<p>Sample command output;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\n- Nikto v2.1.5\n---------------------------------------------------------------------------\n+ Target IP:          192.168.60.19\n+ Target Hostname:    dvwa.kifarunix-demo.com\n+ Target Port:        80\n+ Start Time:         2021-07-12 19:35:10 (GMT0)\n---------------------------------------------------------------------------\n+ Server: Apache\/2.4.37 (rocky)\n+ Retrieved x-powered-by header: PHP\/7.4.6\n+ The anti-clickjacking X-Frame-Options header is not present.\n+ Cookie PHPSESSID created without the httponly flag\n+ Cookie security created without the httponly flag\n+ Root page \/ redirects to: login.php\n+ Server leaks inodes via ETags, header found with file \/robots.txt, fields: 0x1a 0x5c6f1b510366c \n+ File\/dir '\/' in robots.txt returned a non-forbidden or redirect HTTP code (302)\n+ \"robots.txt\" contains 1 entry which should be manually viewed.\n+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST\n+ 21 items checked: 0 error(s) and 8 item(s) reported on remote host\n+ End Time:           2021-07-12 19:35:10 (GMT0) (0 seconds)\n---------------------------------------------------------------------------\n+ 1 host(s) tested\n\n<\/code><\/pre>\n\n\n\n<p>Feel free to explore the basic usage of other command line options from&nbsp;<a href=\"https:\/\/cirt.net\/nikto2-docs\/usage.html\" target=\"_blank\" rel=\"noreferrer noopener\">Nikto Documentation<\/a>&nbsp;page.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Other Tutorials<\/h3>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/detecting-malicious-files-with-wazuh-and-virustotal\/\" target=\"_blank\" rel=\"noreferrer noopener\">Detecting Malicious Files with Wazuh and VirusTotal<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/intercept-malicious-file-upload-with-modsecurity-and-clamav\/\" target=\"_blank\" rel=\"noreferrer noopener\">Intercept Malicious File Upload with ModSecurity and ClamAV<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/install-and-use-clamav-on-ubuntu-20-04\/\" target=\"_blank\" rel=\"noreferrer noopener\">Install and use ClamAV on Ubuntu 20.04<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hello folks, today we are going to learn how to install and use Nikto web scanner on Ubuntu 20.04 server. Nikto is a&nbsp;Perl&nbsp;based open-source web<\/p>\n","protected":false},"author":3,"featured_media":9649,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[34,121,150],"tags":[3838,3835,3837,3836,3839],"class_list":["post-9641","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-howtos","category-vulnerability-scanners","tag-install-nikto","tag-install-nikto-ubuntu-20-04","tag-nikto-ubuntu-20-04","tag-nikto-web-scanner","tag-ubuntu-20-04-scanner","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/9641"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=9641"}],"version-history":[{"count":7,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/9641\/revisions"}],"predecessor-version":[{"id":21738,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/9641\/revisions\/21738"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/9649"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=9641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=9641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=9641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}