<div dir="ltr">David's method seems to work for me:<div><br></div><div><div>./<a href="http://nikto.pl">nikto.pl</a> -h localhost -Plugins "@@none;outdated" -no404</div><div>- Nikto v2.1.6</div><div>---------------------------------------------------------------------------</div>
<div>+ Target IP: 127.0.0.1</div><div>+ Target Hostname: localhost</div><div>+ Target Port: 80</div><div>+ Start Time: 2013-09-12 08:40:49 (GMT-4)</div><div>---------------------------------------------------------------------------</div>
<div>+ Server: Apache/2.2.22 (Unix) DAV/2 mod_ssl/2.2.22 OpenSSL/0.9.8r</div><div>+ mod_ssl/2.2.22 appears to be outdated (current is at least 2.8.31) (may depend on server version)</div><div>+ OpenSSL/0.9.8r appears to be outdated (current is at least 1.0.1c). OpenSSL 0.9.8r is also current.</div>
<div>+ 6607 items checked: 0 error(s) and 2 item(s) reported on remote host</div><div>+ End Time: 2013-09-12 08:40:49 (GMT-4) (0 seconds)</div><div>---------------------------------------------------------------------------</div>
<div>+ 1 host(s) tested</div></div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Thu, Sep 12, 2013 at 8:21 AM, Thiébaut Devergranne <span dir="ltr"><<a href="mailto:t.devergranne@gmail.com" target="_blank">t.devergranne@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>Sorry I tried with the configuration you suggested but had no results whatsoever. </div>
<div>Regards</div><div><br>
</div>
<br><div><div>Le 12 sept. 2013 à 01:41, a <<a href="mailto:resident.deity@gmail.com" target="_blank">resident.deity@gmail.com</a>> a écrit :</div><div><div class="h5"><br><blockquote type="cite"><div dir="ltr">I see the problem: the plugin names are wrong, it should usually be without the nikto_. You can see the full list of plugins and their names by doing a:<div>
nikto -list-plugins</div><div><br></div><div>Although the plugin name is usually nikto_plugin it doesn't have to be. In case of doubt always use the name shown when doing a -list-plugins.</div>
<div><br></div><div>The command line you're looking for is:</div><div> nikto -Plugins 'outdated' -no404 -host <a href="http://www.domain.com/" target="_blank">http://www.domain.com</a></div><div><br></div><div>
Be warned: reporting is done by a plugin as well, so if you want to save the result to a file, you'll need to include the reporting plugin as well:</div>
<div> nikto -Plugins 'outdated,report_xml' -no404 -host <a href="http://www.domain.com/" target="_blank">http://www.domain.com</a> -output domain.xml<br></div><div><br></div></div><div class="gmail_extra"><br><br>
<div class="gmail_quote">
On 2 September 2013 09:02, Thiébaut Devergranne <span dir="ltr"><<a href="mailto:t.devergranne@gmail.com" target="_blank">t.devergranne@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div style="word-wrap:break-word"><div><div style="text-indent:0px;letter-spacing:normal;font-variant:normal;text-align:-webkit-auto;font-style:normal;font-weight:normal;line-height:normal;text-transform:none;font-size:medium;white-space:normal;font-family:Helvetica;word-wrap:break-word;word-spacing:0px">
Thanks for the feedback. If I uses theses options Nikto doesn't tell me about any problems any more ; here's a test : </div><div style="text-indent:0px;letter-spacing:normal;font-variant:normal;text-align:-webkit-auto;font-style:normal;font-weight:normal;line-height:normal;text-transform:none;font-size:medium;white-space:normal;font-family:Helvetica;word-wrap:break-word;word-spacing:0px">
<br></div><div style="text-align:-webkit-auto;text-indent:0px;word-wrap:break-word"><div style="word-wrap:break-word">hstd# nikto -Plugins "@@none;nikto_outdated;nikto_versions" -no404 -h <a href="http://www.domain.com/" target="_blank">http://www.domain.com</a></div>
<div style="word-wrap:break-word">- Nikto v2.1.5</div><div style="word-wrap:break-word">---------------------------------------------------------------------------</div><div style="word-wrap:break-word">+ Target IP: bla.bla.</div>
<div style="word-wrap:break-word">+ Target Hostname: <a href="http://www.domain.com/" target="_blank">www.domain.com</a></div><div style="word-wrap:break-word">+ Target Port: 80</div><div style="word-wrap:break-word">
+ Start Time: 2013-09-02 09:58:56 (GMT2)</div><div style="word-wrap:break-word">---------------------------------------------------------------------------</div><div style="word-wrap:break-word">+ Server: Apache/2.2.6 (Unix) PHP/5.2.5 mod_ssl/2.2.6 OpenSSL/0.9.8g</div>
<div style="word-wrap:break-word">+ 6545 items checked: 0 error(s) and 0 item(s) reported on remote host</div><div style="word-wrap:break-word">+ End Time: 2013-09-02 09:58:56 (GMT2) (0 seconds)</div><div style="word-wrap:break-word">
---------------------------------------------------------------------------</div></div><div><br></div>So the server runs a vulnerable version of php but Nikto doesn't give me any information about it. Is there something i'm missing ?</div>
<div><br></div><div>Thanks !</div><div>TD</div><div><br>
</div>
<br><div><div>Le 1 sept. 2013 à 15:28, <a href="mailto:csullo@gmail.com" target="_blank">csullo@gmail.com</a> a écrit :</div><div><div><br><blockquote type="cite"><div bgcolor="#FFFFFF"><div>I am not near a computer, sorry, but you want to use the -no404 option combined with -Plugins. </div>
<div><br></div><div>It should be like: -Plugins "@@none;nikto_outdated;nikto_versions"</div><div><br></div><div>Those are from memory so check output of -list-plugins to be sure those are correct. </div><div><br>
</div><div>Also see:<br><a href="http://cirt.net/nikto2-docs/options.html#id2741238" target="_blank">http://cirt.net/nikto2-docs/options.html#id2741238</a></div><div><br></div><div>I'm not sure it will be one request but probably 2-3 if you set the options right, since it tests ssl and possibly more than one method. You can use -ssl and -nossl to save a request if you know ahead of time or don't mind guessing based on port. </div>
<div><br></div><div>Let us know how it turns out!</div><div><br></div><div>-Sullo</div><div><br></div><div>On Aug 30, 2013, at 9:30 AM, Thiébaut Devergranne <<a href="mailto:t.devergranne@gmail.com" target="_blank">t.devergranne@gmail.com</a>> wrote:<br>
<br></div><div></div><blockquote type="cite">Hi guys, <div><br></div><div>I'm very new to Nikto and I'm trying to find out how to conduct a server version tests (like php, asp) sending the minimal number of requests, ideally one. </div>
<div><br></div><div>I understand it's possible to do that using the -Plugin parameter but i'm kind of lost after that.</div><div><br></div><div>Anyone could help to put me on the right track ? </div><div>Thanks<br>
<div><div style="font-family:Helvetica;font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word">
<div style="font-family:Helvetica;font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word">
<br></div><br></div><br style="font-family:Helvetica;font-size:medium;font-style:normal;font-variant:normal;font-weight:normal;letter-spacing:normal;line-height:normal;text-align:-webkit-auto;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px">
<br>
</div>
<br></div></blockquote><blockquote type="cite"><span>_______________________________________________</span><br><span>Nikto-discuss mailing list</span><br><span><a href="mailto:Nikto-discuss@attrition.org" target="_blank">Nikto-discuss@attrition.org</a></span><br>
<span><a href="https://attrition.org/mailman/listinfo/nikto-discuss" target="_blank">https://attrition.org/mailman/listinfo/nikto-discuss</a></span><br></blockquote></div></blockquote></div></div></div><br></div><br>_______________________________________________<br>
Nikto-discuss mailing list<br>
<a href="mailto:Nikto-discuss@attrition.org" target="_blank">Nikto-discuss@attrition.org</a><br>
<a href="https://attrition.org/mailman/listinfo/nikto-discuss" target="_blank">https://attrition.org/mailman/listinfo/nikto-discuss</a><br>
<br></blockquote></div><br></div>
</blockquote></div></div></div><br></div><br>_______________________________________________<br>
Nikto-discuss mailing list<br>
<a href="mailto:Nikto-discuss@attrition.org">Nikto-discuss@attrition.org</a><br>
<a href="https://attrition.org/mailman/listinfo/nikto-discuss" target="_blank">https://attrition.org/mailman/listinfo/nikto-discuss</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><br><a href="http://www.cirt.net" target="_blank">http://www.cirt.net</a> | <a href="http://richsec.com/" target="_blank">http://richsec.com/</a>
</div>