Checando vulnerabilidades com o Nikto
Neste artigo vou mostrar como instalar, atualizar e usar o Nikto. Este programa é um scanner de vulnerabilidades bastante simples e fácil de usar.
[ Hits: 65.968 ]
Por: Perfil removido em 12/07/2006
-***** SSL support not available (see docs for SSL install instructions) ***** --------------------------------------------------------------------------- - Nikto 1.35/1.36 - www.cirt.net + Target IP: 192.168.131.1 + Target Hostname: 192.168.131.1 + Target Port: 80 + Start Time: Tue Jun 6 21:10:44 2006 --------------------------------------------------------------------------- - Scan is dependent on "Server" string which can be faked, use -g to override + Server: Apache/2.0.52 (Fedora) + Allowed HTTP Methods: GET,HEAD,POST,OPTIONS,TRACE + HTTP method 'TRACE' is typically only used for debugging. It should be disabled. OSVDB-877. + Apache/2.0.52 appears to be outdated (current is at least Apache/2.0.55). Apache 1.3.33 is still maintained and considered secure. + /cgi-bin/.htaccess - Contains authorization information (GET) + /icons/ - Directory indexing is enabled, it should only be enabled for specific directories (if required). If indexing is not used, the /icons directory should be removed. (GET) + /index.html.var - Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information. (GET) + /manual/images/ - Apache 2.0 directory indexing is enabled, it should only be enabled for specific directories (if required). Apache's manual should be removed and directory indexing disabled. (GET) + /cgi-bin/.htaccess.old - Backup/Old copy of .htaccess - Contains authorization information (GET) + /cgi-bin/.htaccess.save - Backup/Old copy of .htaccess - Contains authorization information (GET) + /cgi-bin/.htaccess - Contains authorization information (GET) + /cgi-bin/.htaccess~ - Backup/Old copy of .htaccess - Contains authorization information (GET) + /cgi-bin/.htpasswd - Contains authorization information (GET) + /.htaccess - Contains authorization information (GET) + /.htpasswd - Contains authorization information (GET) + / - TRACE option appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details (TRACE) + /manual/ - Web server manual? tsk tsk. (GET) + /webmail/ - Redirects to src/login.php , Web based mail package installed. + The IBM Web Traffic Express Caching Proxy is vulnerable to Cross Site Scripting (XSS). CA-2000-02. (GET) + /webmail/src/read_body.php - This might be interesting... has been seen in web logs from an unknown scanner. (GET) + 2670 items checked - 15 item(s) found on remote host(s) + End Time: Tue Jun 6 21:10:50 2006 (6 seconds) --------------------------------------------------------------------------- + 1 host(s) testedAgora basta avaliar as opções de uso de Nikto e criar o relatório com as vulnerabilidades encontradas no seu sistema.
Agora SIM, aMSN com suporte a anti-aliasing
Instalando e configurando o Apache, PHP e MySQL no Slackware 10.1
Onde o Linux peca ao tentar atrair novos usuários
Estratégias de backup e ferramentas livres
Gerar par de chaves com o GnuPG em 11 passos
Honeypot Kippo 0.8 - Instalação e utilização
Convergência entre segurança física e lógica
Atenção a quem posta conteúdo de dicas, scripts e tal (2)
Manutenção de sistemas Linux Debian e derivados com apt-get, apt, aptitude e dpkg
Melhorando o tempo de boot do Fedora e outras distribuições
Como instalar as extensões Dash To Dock e Hide Top Bar no Gnome 45/46
Como Atualizar Fedora 39 para 40
Instalar Google Chrome no Debian e derivados
Consertando o erro do Sushi e Wayland no Opensuse Leap 15
Instalar a última versão do PostgreSQL no Lunix mantendo atualizado
Flathub na sua distribuição Linux e comandos básicos de gerenciamento
Problemas com o Lutris e o Wine no Slackware 15.0 (1)
redirecionando saida de comando touch para o AWK[AJUDA] (18)
Sistema da Coréia do Norte - Red Star OS (13)