Nick too is an open source web server scanner which performs comprehensive tests against multiple vulnerabilities
including dangerous files outdated versions and mainly the always top 10 vulnerabilities.
It's very wise to start scanning a Web site before performing any penetration tests on it.
So let's get to the bread and butter of that.
Just open your Cowley terminal here and write Nick to hyphen uppercase H.
You can see the help menu here.
So most some of the important switches that we will use as the format and the tuning for the tuning.
You can tune your scan to perform tests against these vulnerabilities including SQL injections file
upload information disclosure and et cetera.
Now if you go to your web server to your web browser I have installed metal splitter Bill too on this
IP.
Here is just a virtual machine contains various web applications for example dumb vulnerable web application.
I will issue my need to command against this web server soon to hash or dash H.
Which means host.
And then just put the IP of the server
and then press enter as you can see it start giving us some information about the server.
The Web site is hosted along Apache and are using open to a Linux server.
And here are some of the vulnerabilities that are included on the server such as the process scripting
protection header it is not defined exe content type options header it is not set and etc. as well.
There are some OS VTB which is open source vulnerability database which is similar to the common vulnerability
and common limit exposures to ease.
You can just look them up on the Internet and it will tell you exactly what type of vulnerabilities
that although that it mentions here the vulnerability at a high level.
So this is one of the tests that includes lots of options though.
If you want to feel comfortable just export it would dash output and then specify the file name output
Nick to here and then dash format.
Make sure to put the f uppercase and then HDMI Elmer's press enter.
It will create the file it will output the same result in an HMO format.
If you open it here just try to click on this file and open in Firefox and you'll be able to see the
report in an entertainment format.
This is very important especially if you're a penetration tester.
That's very important to document all the work that you do.
Here it tells you the target IP the target hostname the port.
We can change the port by issuing the hyphen P switch and just put any point but by default it's 80.
The server is running a patchy version 2.0 2.8 on a one two and you can see all of operability is here
with the description and the link to the OR as PDB entries.
It's a very handy report now going back again next to as we saw once we issued this minus age is that
we can do no worse can for different purposes like if you want to scan specifically for Eskil injections
we need to use the parameter 9.
So let me show you how.
Suppose that we don't want to output.
So Nick to hyphen H.
Then the IP then use high fine tuning.
Then the number 9.
It will specifically scan this Web site against the SPL injection attack and you can see the results.
Now you can as well use HDP in the hostname for slash and then specifically mention the application
in which is the DM vulnerable of application.
So now it will count against SPL injection attacks on the them vulnerable application.
So as you can see it's a very handy tool and it's very easy to use tool and it's considered somehow
a standard for web vulnerability scanning another easy to use penetration testing tool for finding vulnerabilities
in web application is the Zap post it's easy to invoke it.
Just go to applications then web applications analysis and click on a wasp zap.
Just follow the instructions on the screen to start the application.
Actually it's a very easy tool to use.
You just have to enter the IP address of the web server or the web application here and just press on
attack.
So let's try that
just hit on attack and as you can see here this is the same method supportable box that we are testing.
It will run through the whole list of your URLs and will eventually display the list of vulnerabilities
here under alerts on the left side and we'll categorize them by the vulnerability type as you can see
these are increasing here.
We have application error disclosure frame option header not set it will categorize them based on the
color as well so these ones in yellow are low in priority.
Just you can see it here.
It's low low and it will describe the vulnerability it will give you the solution for that and we'll
give you some Web references as well.
You can as well go to the medium rated vulnerabilities click on that.
This is again the same thing goes in description solution and references.
It's a very easy and a handy tool to use.
Let's solve that here.
Let me tell you about some advanced features of this tool.
You can select an application for example this down vulnerable love application and click on the session
properties you can go down here and select the authentication method in case you want to provide the
username and password.
You can put the username password here.
You can select the URL from here.
It will pop up the parameters automatically just make sure to select username here and password here
for the users just need to add the user of the Web site in order to authenticate.
So I'll put admin and just write admin and password which is the default credentials for that and just
have to press.
OK make sure that such a management is cookie based and which is the default press OK.
And then right click on that and perform that task again.
Just start the scan and it will list as well.
The vulnerabilities on the other stub in a categorized manner.