[MUSIC PLAYING]
Another great web app pen testing tool is Nikto.
It's going to do some automated scans for us.
Again, make sure it's in scope.
Don't rely on this as your end-all be-all for web app pen
testing.
But it is a great way to start.
Let's jump into the lab environment to play with it.
It will be in the terminal.
Let's check our IP address.
We have the network here.
We can ping the dot 3, and it is up.
And we can run a quick Nmap scan of the dot 3.
We see that port 80 is open.
Well, let's take a look.
We're going to find that it is the OWASP Mutillidae, which
while it's a free tool, it works great,
and it will show all the things that we need to show off here.
You could install this locally on your own machine
if you want it on your own VM even
and run attacks against it.
We're going to utilize it because it's open source,
and it's free.
And it works.
Shows exactly what we want.
So we're going to start off by using the Nikto tool.
And I will just run Nikto and without any arguments.
Nikto just shows us the version, and there's an error-- no
host or URL.
That's fine.
I would just want to show you what options are in here.
If we pick a host, it'll go after that host URL.
There's even some tuning that can be done.
And it says use tack capital H for the full help text.
So let's run that.
And you see, there's even more details in here.
You see, there's evasion possibilities.
There's some display options, formatting options.
You can even change up what you want your output to say--
if you want to ignore these 404 codes.
There's a lot in there.
Tuning has some specific things.
For example, there is a local file inclusion that
can be included-- file upload.
There's a lot.
Remote file retrieval, that could be neat.
We will investigate a few of those in a little bit.
Let's start off just by running Nikto against our target.
And we do that with an HTTP.
So tack host or tack H will do the job.
And throw our IP address in there from before.
So quick thing as we get back, it's an Apache server.
We didn't have to run a whole server scan.
Nikto handled that for us.
It gets the port based on the IP address.
Got some low-hanging fruit in there.
The version of Ubuntu, this might be vulnerable.
We've got some cookies from the PHP session that were in there.
It's a lot of output.
They'll make it little easier to read.
But in here, we have got--
it found data, it found includes,
it found the passwords.
We've attacked this web app before in other labs,
so that shouldn't be too surprising.
There's also PHP info which does a test script.
The phpmyadmin is in there.
That's dangerous.
That could give us a lot of access.
Did I see a robots.txt is in.
Here it's got eight entries that could be useful.
We've also got-- right here, there's this vulnerable file
transversal--
file traversal.
Sorry, I added an N. If you had an index.php.
And then page equals these dot dot forward
slash dot dot forward slash.
This Is directory traversal eventually getting back
to root and then etc password.
So we will play with that a little bit and double check
that we can do what it says.
There's a lot in there.
That's a very useful skin.
We were able to see, the target server and the back end.
A lot included in there.
Well let's check out that local file inclusion.
Mutillidae is neat in that we can
get a 2017, A5, broken access control.
Go to this insecure directory object for reference, IDOR,
and then local file inclusion.
And it brings up a page that is vulnerable to local file
inclusion on purpose, so we can test things out,
see what it looks like.
And it's this index.php page equals.
And we could grab the exact code.
Or let's just grab this whole URL.
What's neat about Nikto is we can scan that.
So we have the full URL.
And we'll just do tuning, tack tuning 5 and tack display
and V for verbose.
So we'll have Nikto test it for final inclusion.
And we get a lot of 202s or a lot of 200s.
Sounds very, very vulnerable.
Yeah, a lot of these hit.
It's a lot of 200 gets.
There's etc password and a lot of things
afterwards that all seem to work.
All right.
Well, let's actually try that.
Let's look at what happens.
If we do a dot dot forward slash and etc password.
Well, we get the outcome and the output of etc password
right here in our browser.
So this is on the web server that we are attacking.
On the dot 3, we included--
because page to look up and we traversed back to root.
This just ensured that we made it back to root.
And then from root, got etc password
and displayed all the output from there.
Pretty.
That's not good.
You don't want that in your web app.
Another neat thing that we can do with all this
is we could output it.
This was a lot to read, and it's not fun to read.
So let's change that.
Let's make a nice output, a report for us.
We'll do tack O, and we'll call it Nikto.html and tack
format and HTM.
So it runs all of that.
One more time.
Could've left off the verbose.
And then at last, we see, we've got Nikto.html.
And we could just open up our File Explorer.
And I will click New to that HTML,
and it opens it in the browser.
Now, we've got a nice little GUI of that output.
So it tested index.php like we asked.
And it's showing all the things that it tried
and what it got back.
Eventually, this etc password returned bad stuff.
And it worked for us.
Can we look at it?
Boom.
It works.
We can even try out a few of these other ones
and see what they return.
I feel like it's not supposed to look like that.
And that's really the power of Nikto right there.
So I hope you got a bit out of this.
Showing you another tool at including your toolbox.
More things that you can utilize,
ways you can find vulnerabilities and bugs in web
apps, and some nice ways of getting your output
reports, so you can go back through later
after your assessment to then build up
your report to your client.
With that, we're going to change a little bit
and actually do some active attacks instead
of running scans or utilizing tools
that do things automatically.
We're going to do some attacks, so we'll
see you in the next lab.