How To Setup And Use Nikto On Debian 10

Nikto is an open-source (GPL) web server scanner. Nikto is a free and command-line vulnerability scanner that scans webservers. Using Nikto helps you to find dangerous files/CGIs, outdated server software, and other problems. The presence of multiple index files and HTTP server options will be checked by Nikto. Then it can identify installed web servers and software and captures and prints any cookies received. This vulnerability scanner is written in Perl. In this article, you will learn How To Setup And Use Nikto On Debian 10. You can visit the available packages of Eldernode and order your own Linux VPS with the best price and support.

Tutorial Setup And Use Nikto On Debian 10 step by step

Using Nikto allows you to check for 6400 potentially dangerous files and scripts, 1200 outdated server versions, and nearly 300 version-specific problems on web servers. You can run Nikto directly from the command line in a BackTrack terminal. Join us with this article to learn more about Nikto and the way you can install, setup, and use it. The most important take-away from Nikto’s output is the Open Source Vulnerability Database (OSVDB) entries. It provides specific information about discovered vulnerabilities. Nikto is designed to be used on a number of OS platforms, including the Knoppix distribution which is based on the Debian variety of Linux.

What is Nikto and How it works?

Nikto is an effective, useful, and common vulnerability search tool in the security industry. As a web server scanner, you need to have Nikto in your toolset. It will scan the accessibility of a host and determining whether it’s reachable and also checks web servers for misconfigurations and vulnerabilities. This helpful tool is easy to operate and you can understand the output easily because Nikto tells you in detail about well configured and locked down on a system. So, you will know what needs to be improved or hardened.

Nikto Features

Let’s see some of the major features of Nikto and try to choose them when you finished this guide:

– SSL Support

– Full HTTP proxy support

– Scan items and plugins are frequently updating and can automatically update

– Checks for outdated server components

– Save reports in plain text, XML, HTML, NBE, or CSV

– Template engine to easily customize reports

– Scan multiple ports on a server, or multiple servers via input file (including Nmap output)

– LibWhisker’s IDS encoding techniques

– Easily update via command line

– Identifies installing software via headers, favicons, and files

– Host authentication with Basic and NTLM

– Subdomain guessing

– Apache and cgiwrap username enumeration

– Mutation techniques to “fish” for content on web servers

– Scan tuning to include or exclude entire classes of vulnerability checks

– Guess credentials for authorization realms

– Authorization guessing handles any directory, not just the root directory

– Enhanced false positive reduction via multiple methods: headers, page content, and content hashing

– Reports “unusual” headers seen

– Interactive status, pause, and changes to verbosity settings

– Save full request/response for positive tests

– Replay saved positive requests

– Maximum execution time per target

– Auto-pause at a specified time

– Checks for common “parking” sites

– Thorough documentation

Prerequisites to Install Nikto on Debian 10

To let this tutorial work better, please consider the below Prerequisites:

A non-root user with Sudo privileges.

To setup, follow our Initial server setup on Debian 10.

How to Install Nikto on Debian 10 | Debian 9

First of all, you can download Nikto for Debian. Then, open your terminal and run the following commands to install Nikto on Debian Linux:

sudo apt-get update

sudo apt-get upgrade

sudo apt-get install nikto

If all is done correctly, Nikto should have been installed successfully. Also, you can use the command below to verify that the Nikto website vulnerability scanner is installed and ready for use:

nikto

Note: Before you start using Nikto to scan web servers, you can use the -Help option to see everything that can be done inside Nikto.

nikto -Help

How to use Nikto on Debian Linux

Nikto has many options. The basic Nikto command line syntax is:

nikto [options...]

You can also substitute the <IP or hostname> with the actual IP address or hostname sans angle brackets:

nikto -h <IP or hostname>

Nikto is able to do a scan that can go after SSL and port 443, the port that HTTPS websites use. So, you are not limited to scanning old sites and you can do vulnerability assessments on sites that use SSL, which is pretty much a requirement these days to be indexed in search results. If you know it’s an SSL site that you are targeting, specify it in Nikto to save some time on the scan by adding -ssl to the end of the command:

nikto -h <IP or hostname> -ssl

How to scan specific ports with Nikto on Debian 10

Web servers run on non-standard ports like 8081 or 8080, or multiple web servers are run on the same host on different network ports. So, it is vital to have the ability to scan specific ports as well as the main 80 and 443 ports. To do this, run the command below:

nikto -h example.com -port 8083

Note: Do not forget to replace example.com with the host or IP you wish to scan, and 8083 with the port you wish to scan.

You can use Nikto on a  local network to find embedded servers such as a login page for a router or an HTTP service on another machine that’s just a server with no website. To find your IP address use the following command:

ifconfig

Conclusion

In this article, you learned How To Setup And Use Nikto On Debian 10. From now on, you can use this popular and useful web server testing tool and start, finding all sorts of obscure issues whether it’s directory indexing, admin panels, or remote code execution in a rare web application. Let your friends on the Edernode Community have your feedback if you are using Nikto or any other scanning web server analysis tools.