In this lesson,
we're going to go through ways to look at web applications.
What I'm going to do first is jump into my lab environment,
and we're going to start with Nikto.
As I said, Nikto is a web application vulnerability scanner.
If you think about Nessus and Qualys and things like that,
those are used against your infrastructure:
servers, routers, switches, and hosts.
But if you want to look at a web application in depth,
you really want to use something like Nikto.
So you're going to go into your terminal
and you're going to run the command
nikto -host and the IP of the host you're trying to scan.
In my case, it's 10.1.0.10.
Now, once you do that,
you're going to see some of the issues that were found.
For instance, you can see on this first line
that the server is an Apache 2.4.6 server
being run on CentOS.
Now as you go through,
you can see there are some anti-clickjacking options
that are not present.
You could see some cross-site scripting protection headers
are not defined.
You can see some X-Content-Type-Options is not set.
And as you go down,
you're see all the different vulnerabilities.
As you get even further down,
you're going to see things that say OSVDB,
which are some vulnerability database files
that are going to tell you exactly what was tested.
So you could see that under 877,
there's an HTTP TRACE method that is activated,
and this suggests that the host is vulnerable to an attack.
And so as you go through,
you can identify each of these different things
and then you can look them up,
research them, and figure out how to exploit those issues.
Now the next thing we want to do is test our website
and look at it from a probing perspective
for directories and files.
We can do this using a different plugin inside of Nikto.
So I'm going to use nikto -host
10.1.0.10 -Plugins,
and then the plugin I want to use.
In my case, it's going to be a dictionary
under dictionary:usr/share/wordlists
/dirb/common.txt.
When I do that, I'm going to be able to run a scan
for common file and directory names on that server.
Next, let's run a command to find any files
that require authorization to view.
I can do this by using nikto -host
10.1.0.10 -Display and the number 4.
Note, this will show me all of the files
that are now identified
that would've required authorization to view.
The next thing I want to do
is try to perform a credentialed scan
against that web application,
and I want to save that output as an HTML report.
Nikto can do this as well.
We're going to type in nikto -host
http://10.1.0.10/dvwa,
which is the web application that I want to go after,
then -id and the credentials,
in my case admin with a password of password.
And then I want to output that by using -o
and then /root/Downloads/dvwa.htm
and then /format and put it into HTML format,
so I'll type in htm.
Once I do that,
I'm going to now have that file inside that root directory
underneath the Downloads folder.
If I want to see that,
because it's an HTML file,
I need to open it using Firefox.
So I'll type in firefox space
/root/Downloads/dvwa.html,
and this will show me all of the information in that report.
Now, as I go through that report,
I can see all the different issues that were found.
For instance, there's directory indexing not found,
there's configuration information
that could be remotely available,
and there's other things like that as we go through it.
For instance, this PHP reveal that's being shown
where sensitive information is being displayed to the client
as they go into that application.
So these are all just a quick summary
of some of the issues we found
with this vulnerable web application.
Now for the exam,
it's important that you can read basic outputs
from different tools, such as Nikto.
For example, they might give you a snippet
from a Nikto output,
just like you saw here in this video,
and then ask you which vulnerability is associated with it?
Or they might show you a snippet,
such as from the Nikto output,
and then ask you what type of attack
you're going to plan to do
in the attack and exploitation phase?
Based on what you're seeing in those results
as part of your reconnaissance,
you should be able to analyze those results
and then determine what vulnerabilities exist
on that given target server.
For example, based on the Nikto output we saw,
we could see that the Apache server was out of date.
It's using a vulnerable version of OpenSSL,
and it's vulnerable to cross-site scripting attacks
because it didn't have
the cross-site scripting protection header
defined inside the HTTP header.
This allows a lot of different vulnerabilities
for an attacker or penetration tester to exploit.
Now, if you didn't catch that
going through the video the first time,
please go back
and then pause it on that output screen
and take a look at it.
As that output comes up, read through it,
take a look at what it is,
figure out if you understand
what are some of the key vulnerabilities
that this server has.
Being able to do this level of analysis
is going to be really important for you come exam day.
Now, as we move into Domain 3 with attacks and exploits,
we're going to use Nikto again
as part of showing what vulnerabilities exist
and then what we can do
to attack those particular vulnerabilities
we found in this video.
As I said, we're going to spend more time with this tool
and we'll follow it up again as we get into Domain 3.
But for right now, I just need to introduce you to this tool
and the fact that we can use it for web application scanning
and get you more comfortable with the type of outputs
you can expect from a tool like Nikto.