[Nikto-discuss] (no subject)

[Robin Wood]

On 12 Sep 2013 00:41, "a" <resident.deity at gmail.com> wrote:
>
> I see the problem: the plugin names are wrong, it should usually be
without the nikto_. You can see the full list of plugins and their names by
doing a:
>   nikto -list-plugins
>
> Although the plugin name is usually nikto_plugin it doesn't have to be.
In case of doubt always use the name shown when doing a -list-plugins.
>
> The command line you're looking for is:
>   nikto -Plugins 'outdated' -no404 -host http://www.domain.com
>
> Be warned: reporting is done by a plugin as well, so if you want to save
the result to a file, you'll need to include the reporting plugin as well:
>   nikto -Plugins 'outdated,report_xml' -no404 -host http://www.domain.com-output domain.xml
>

Couldn't you automatically bring the appropriate report plugin in as
required? It sounds like the kind of thing that someone could waste a lot
of time on trying to work out reporting is failing.

Robin

>
> On 2 September 2013 09:02, Thiébaut Devergranne <t.devergranne at gmail.com>
wrote:
>>
>> Thanks for the feedback. If I uses theses options Nikto doesn't tell me
about any problems any more ; here's a test :
>>
>> hstd# nikto -Plugins "@@none;nikto_outdated;nikto_versions" -no404 -h
http://www.domain.com
>> - Nikto v2.1.5
>>
---------------------------------------------------------------------------
>> + Target IP:          bla.bla.
>> + Target Hostname:    www.domain.com
>> + Target Port:        80
>> + Start Time:         2013-09-02 09:58:56 (GMT2)
>>
---------------------------------------------------------------------------
>> + Server: Apache/2.2.6 (Unix) PHP/5.2.5 mod_ssl/2.2.6 OpenSSL/0.9.8g
>> + 6545 items checked: 0 error(s) and 0 item(s) reported on remote host
>> + End Time:           2013-09-02 09:58:56 (GMT2) (0 seconds)
>>
---------------------------------------------------------------------------
>>
>> So the server runs a vulnerable version of php but Nikto doesn't give me
any information about it. Is there something i'm missing ?
>>
>> Thanks !
>> TD
>>
>>
>> Le 1 sept. 2013 à 15:28, csullo at gmail.com a écrit :
>>
>>> I am not near a computer, sorry, but you want to use the -no404 option
combined with -Plugins.
>>>
>>> It should be like:  -Plugins "@@none;nikto_outdated;nikto_versions"
>>>
>>> Those are from memory so check output of -list-plugins to be sure those
are correct.
>>>
>>> Also see:
>>> http://cirt.net/nikto2-docs/options.html#id2741238
>>>
>>> I'm not sure it will be one request but probably 2-3 if you set the
options right, since it tests ssl and possibly more than one method. You
can use -ssl and -nossl to save a request if you know ahead of time or
don't mind guessing based on port.
>>>
>>> Let us know how it turns out!
>>>
>>> -Sullo
>>>
>>> On Aug 30, 2013, at 9:30 AM, Thiébaut Devergranne <
t.devergranne at gmail.com> wrote:
>>>
>>>> Hi guys,
>>>>
>>>> I'm very new to Nikto and I'm trying to find out how to conduct a
server version tests (like php, asp) sending the minimal number of
requests, ideally one.
>>>>
>>>> I understand it's possible to do that using the -Plugin parameter but
i'm kind of lost after that.
>>>>
>>>> Anyone could help to put me on the right track ?
>>>> Thanks
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> Nikto-discuss mailing list
>>>> Nikto-discuss at attrition.org
>>>> https://attrition.org/mailman/listinfo/nikto-discuss
>>
>>
>>
>> _______________________________________________
>> Nikto-discuss mailing list
>> Nikto-discuss at attrition.org
>> https://attrition.org/mailman/listinfo/nikto-discuss
>>
>
>
> _______________________________________________
> Nikto-discuss mailing list
> Nikto-discuss at attrition.org
> https://attrition.org/mailman/listinfo/nikto-discuss
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://attrition.org/pipermail/nikto-discuss/attachments/20130912/bda9a606/attachment.html>