Nikto
提供: セキュリティ
2013年1月9日 (水) 17:18時点におけるDaemon (トーク | 投稿記録)による版 (ページの作成：「<!-- vim: filetype=mediawiki --> Nikto は、Web サーバスキャナーです。 読み方 __TOC__ == 概要 == Nikto Web スキャナーは、危険な...」)
スポンサーリンク
Nikto は、Web サーバスキャナーです。
読み方
概要
Nikto Web スキャナーは、危険なファイルやCGI、古いサーバソフトウェアやその他の問題をテストします。 Nikto は、GPLのOSSです。
インストール
FreeBSDにインストールする場合
ports コレクションからインストールする場合
cd /usr/ports/security/nikto sudo make install clean
pkgコマンドでインストールする場合
sudo pkg install nikto
portmasterコマンドでインストールする場合
sudo portmaster -y -d /usr/ports/security/nikto
portinstallコマンドでインストールする場合
sudo portinstall /usr/ports/security/nikto
使い方
% which nikto /usr/local/bin/nikto % nikto -Help Options: -ask+ Whether to ask about submitting updates yes Ask about each (default) no Don't ask, don't send auto Don't ask, just send -Cgidirs+ Scan these CGI dirs: "none", "all", or values like "/cgi/ /cgi-a/" -config+ Use this config file -Display+ Turn on/off display outputs: 1 Show redirects 2 Show cookies received 3 Show all 200/OK responses 4 Show URLs which require authentication D Debug output E Display all HTTP errors P Print progress to STDOUT S Scrub output of IPs and hostnames V Verbose output -dbcheck Check database and other key files for syntax errors -evasion+ Encoding technique: 1 Random URI encoding (non-UTF8) 2 Directory self-reference (/./) 3 Premature URL ending 4 Prepend long random string 5 Fake parameter 6 TAB as request spacer 7 Change the case of the URL 8 Use Windows directory separator (\) A Use a carriage return (0x0d) as a request spacer B Use binary value 0x0b as a request spacer -Format+ Save file (-o) format: csv Comma-separated-value htm HTML Format msf+ Log to Metasploit nbe Nessus NBE format txt Plain text xml XML Format (if not specified the format will be taken from the file extension passed to -output) -Help Extended help information -host+ Target host -IgnoreCode Ignore Codes--treat as negative responses -id+ Host authentication to use, format is id:pass or id:pass:realm -key+ Client certificate key file -list-plugins List all available plugins, perform no testing -maxtime+ Maximum testing time per host -mutate+ Guess additional file names: 1 Test all files with all root directories 2 Guess for password file names 3 Enumerate user names via Apache (/~user type requests) 4 Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type requests) 5 Attempt to brute force sub-domain names, assume that the host name is the parent domain 6 Attempt to guess directory names from the supplied dictionary file -mutate-options Provide information for mutates -nointeractive Disables interactive features -nolookup Disables DNS lookups -nossl Disables the use of SSL -no404 Disables nikto attempting to guess a 404 page -output+ Write output to this file ('.' for auto-name) -Pause+ Pause between tests (seconds, integer or float) -Plugins+ List of plugins to run (default: ALL) -port+ Port to use (default 80) -RSAcert+ Client certificate file -root+ Prepend root value to all requests, format is /directory -Save Save positive responses to this directory ('.' for auto-name) -ssl Force ssl mode on port -Tuning+ Scan tuning: 1 Interesting File / Seen in logs 2 Misconfiguration / Default File 3 Information Disclosure 4 Injection (XSS/Script/HTML) 5 Remote File Retrieval - Inside Web Root 6 Denial of Service 7 Remote File Retrieval - Server Wide 8 Command Execution / Remote Shell 9 SQL Injection 0 File Upload a Authentication Bypass b Software Identification c Remote Source Inclusion x Reverse Tuning Options (i.e., include all except specified) -timeout+ Timeout for requests (default 10 seconds) -Userdbs Load only user databases, not the standard databases all Disable standard dbs and load only user dbs tests Disable only db_tests and load udb_tests -until Run until the specified time or duration -update Update databases and plugins from CIRT.net -useproxy Use the proxy defined in nikto.conf -Version Print plugin and database versions -vhost+ Virtual host (for Host header) + requires a value
デフォルトでは、80番ポートがスキャン対象になります。
nikto -h 192.168.0.1
ポート番号を指定するには、 -p (--port) オプションを使用します。
nikto -h 192.168.0.1 -p 443
nikto -h https://192.168.0.1:443/
443 ポートの場合は、-ssl オプションを指定する必要はありません。 443 以外のポートでSSLサーバが動いている場合には、-ssl を明示的に指定します。
nikto -h 192.168.0.1 -p 443 -ssl
nikto -h 192.168.0.1 -mutate 3 -mutate-options user-list.txt
複数のポートをテストする場合には、-p オプションに複数指定します。
nikto -h 192.168.0.1 -p 80,88,443
レンジで指定できます。
nikto -h 192.168.0.1 -p 80-90
実行例
PHP のビルトインウェブサーバーに対して実行しました。 ディレクトリには、何もファイルを置いていません。
% php -S localhost:8080 PHP 5.4.10 Development Server started at Wed Jan 9 06:27:31 2013 Listening on http://localhost:8080 Document root is /tmp/P Press Ctrl-C to quit.
% nikto -h localhost -p 8080 - Nikto v2.1.5 --------------------------------------------------------------------------- + Target IP: 127.0.0.1 + Target Hostname: localhost + Target Port: 8080 + Start Time: 2013-01-09 06:27:22 (GMT9) --------------------------------------------------------------------------- + Server: No banner retrieved + The anti-clickjacking X-Frame-Options header is not present. + No CGI Directories found (use '-C all' to force check all possible dirs) + OSVDB-27071: /phpimageview.php?pic=javascript:alert(8754): PHP Image View 1.0 is vulnerable to Cross Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html. + OSVDB-3931: /myphpnuke/links.php?op=MostPopular&ratenum=[script]alert(document.cookie);[/script]&ratetype=percent: myphpnuke is vulnerable to Cross Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html. + /modules.php?op=modload&name=FAQ&file=index&myfaq=yes&id_cat=1&categories=%3Cimg%20src=javascript:alert(9456);%3E&parent_id=0: Post Nuke 0.7.2.3-Phoenix is vulnerable to Cross Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html. + /modules.php?letter=%22%3E%3Cimg%20src=javascript:alert(document.cookie);%3E&op=modload&name=Members_List&file=index: Post Nuke 0.7.2.3-Phoenix is vulnerable to Cross Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html. + OSVDB-4598: /members.asp?SF=%22;}alert(223344);function%20x(){v%20=%22: Web Wiz Forums ver. 7.01 and below is vulnerable to Cross Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html. + OSVDB-2946: /forum_members.asp?find=%22;}alert(9823);function%20x(){v%20=%22: Web Wiz Forums ver. 7.01 and below is vulnerable to Cross Site Scripting (XSS). http://www.cert.org/advisories/CA-2000-02.html. + 6545 items checked: 24 error(s) and 7 item(s) reported on remote host + End Time: 2013-01-09 06:28:04 (GMT9) (42 seconds) --------------------------------------------------------------------------- + 1 host(s) tested
アップデート
sudo nikto -update
FreeBSD の場合 /usr/local/share/nikto/docs がなかったため、エラーが表示されました。 必要に応じて、手動でディレクトリを作成してください。
% sudo nikto -update + Retrieving 'nikto_report_csv.plugin' + Retrieving 'nikto_headers.plugin' + Retrieving 'nikto_cookies.plugin' + Retrieving 'db_tests' + Retrieving 'db_parked_strings' + Retrieving 'CHANGES.txt' + ERROR: Unable to open '/usr/local/share/nikto/docs/CHANGES.txt' for write: 1 at /usr/local/share/nikto/plugins/nikto_core.plugin line 1933. -config+ Use this config file -Display+ Turn on/off display outputs -dbcheck check database and other key files for syntax errors -Format+ save file (-o) format -Help Extended help information -host+ target host -id+ Host authentication to use, format is id:pass or id:pass:realm -list-plugins List all available plugins -output+ Write output to this file -nossl Disables using SSL -no404 Disables 404 checks -Plugins+ List of plugins to run (default: ALL) -port+ Port to use (default 80) -root+ Prepend root value to all requests, format is /directory -ssl Force ssl mode on port -Tuning+ Scan tuning -timeout+ Timeout for requests (default 10 seconds) -update Update databases and plugins from CIRT.net -Version Print plugin and database versions -vhost+ Virtual host (for Host header) + requires a value Note: This is the short help output. Use -H for full help text. % sudo mkdir /usr/local/share/nikto/docs % sudo nikto -update + No updates required. + CIRT.net message: Please submit Nikto bugs to http://trac2.assembla.com/Nikto_2/report/2
関連項目
ツイート
スポンサーリンク