<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 9pt;
font-family:ãæá¬Ù¥ô÷
}
</style>
</head>
<body class='hmmessage'>
Hello everyone! I am a newbie to Nikto. Please offer me some help. : )<br><br>I used Nikto to perform a scanning on Injection with command "<i>perl nikto.pl -h 127.0.0.1 -T 4</i> ".<br>Let's talk about my web application first. <br><br>I created a textbox where user can input anything to submit the server and filtering will NOT be done on both the client and server. When I input ' <script>alert("Hi there!")</script> ' , an alert appears. That means XSS can be performed, right?<br>However, Nikto cannot find out the XSS in my web application.<br><br>So, I would like to ask:<br><br>Is Nikto capable of scanning XSS on user created web application?<br>If yes, is there aything wrong with my Nikto scanning options so that
Nikto cannot find out this (I aslo perform a default scanning, but
nothing about XSS was shown)?<br>If not, what exactly the meaning of "Injection (XSS/Script/HTML). Any manner of injection, including cross site scripting (XSS) or content (HTML)" from the manual?<br><br>Thank you.<br> <br /><hr />Windows Live ð«Íê?ïÚ×â¡¢øºòþæ¨ <a href='http://www.microsoft.com/hk/windows/chinese/windowslive/products/photo-gallery-edit.aspx' target='_new'>ÝÂú½ßÓø¸îÜÜ×Ùâ¡£</a></body>
</html>