nikto_usage.html

来自「一个用perl写的功能强大的cgi漏洞检测程序」· HTML 代码 · 共 332 行 · 第 1/2 页

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SKIPPORTS - Port number never to scan (so you don't crash services, perhaps?).<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PROXYHOST - Server to use as a proxy, either IP or hostname, no 'http://' needed.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PROXYPORT - Port number that PROXYHOST uses as a proxy.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PROXYUSER - If the PROXYHOST requires authentication, use this ID. Nikto will prompt for it if this is not set & it is needed.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PROXYPASS - If the PROXYHOST requires a password for PROXYUSER, use this password.  Nikto will prompt for it if this is not set & it is needed.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PLUGINDIR - If Nikto can't find it's plugin directory for some reason, enter the full path and the problem is solved.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;UPDATES   - Turns data push to cirt.net on. Please see the CIRT.NET UPDATES section for details.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MAX_WARN  - If the number of OK or MOVED messages reaches this number, a warning will printed.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;PROMPTS   - If set to "no", Nikto will *never* prompt for anything--proxy auth, updates, nothing...<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;DEFAULTHTTPVER - First try this HTTP method. If this fails, Nikto will attempt to find a valid one. Useful if you want try something non-standard.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;STATIC-COOKIE  - The name/value of this cookie, if set, will be sent for every request (useful for auth cookies).<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Variables that start with the 'at' sign (@) will be used when scan rules are loaded. For each value (seperated by space), the rule<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;will be duplicated. See the TEST DATABASES section for more information.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Predefined variables are:<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;@CGIDIRS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- CGI directories to look for, valid ones (or all) will be used for CGI checks against the remote host.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;@MUTATEDIRS  - Additional directories to use when operating under the Mutate mode besides ones already defined the .db files.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;@MUTATEFILES - Additional files to use when operating under the Mutate mode besides ones already defined the .db files.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;@ADMINDIRS   - Typical administration directories.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;@USERS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  - Typical user names for the user guessing plugins.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
<b>CIRT.NET UPDATES</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;In order to help keep the Nikto databases up-to-date, you have the ability to easily submit some updates back to cirt.net for inclusion<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;in new copies of the databases.  Currently, this only includes software versions (such as "Apache/7.0.3"). If Nikto scans a host and sees a <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;newer version on the host than it has in the database, or it is missing entirely, (and your databases are fairly recent), this information can<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;be automatically (or manually) sent back to cirt.net.  <br>
    <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Behaviour of this option is controlled in config.txt through the UPDATES variable. If UPDATES is set to "no", Nikto will<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;not send or ask about sending values to cirt.net. If set to "auto", it will automatically send the data through an HTTP request. If set to "yes"<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(which is the default), when there are updates it will ask if you would like to submit and show you the data (unless PROMPTS=no).<br>
    <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;There is only one thing submitted to cirt.net when you do this: the "updated" version string.  No information specific to the host tested is sent.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;No information from the scanning source is sent (it does log your IP address as seen by cirt.net's web server, but... nothing else). <br>
    <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;If you're not comfortable with this, you may also email it to me at [e-mail] or just set UPDATES=no. Please don't complain and say I'm <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;stealing your data... just trying to save me some work ;)<br>
    <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Again: the default configuration of Nikto does *not* send *any* data to cirt.net.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
<b>TEST DATABASES</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Rules in the scan databases can use dynamic variables from config.txt. Any variable that starts with the 'at' sign (@)<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;will be substited in rules. For example:<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;A rule of "generic","@CGIDIRStest.html","200","GET","Test" with "@CGIDIRS=/cgi-bin/ /cgi-sys/" will test for:<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/cgi-bin/test.html<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;/cgi-sys/test.html<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Any number of these variables can be set, and any number can be used in a rule (i.e., "@[e-mail]").<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Additionally, the generic @HOSTNAME and @IP are available, which use the current target's hostname or IP.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Rules can be specified which also have conditionals for test success. This can allow a test to look for a 200 HTTP response<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;but not contain the word "home". This would look like "200!home" in the scan_database.db file.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
<b>EXAMPLES</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;A basic scan of a web server on port 80. The -h option is the only option that is required for a basic scan of a web<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;server on the standard HTTP port.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nikto.pl -h 10.100.100.10<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;A basic scan of a web server on port 443, forcing SSL encryption and ignoring the Server header.  Note that Nikto does<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;not assume port 443 to be SSL, but if HTTP fails it will try HTTPS.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nikto.pl -h 10.100.100.10 -p 443 -s -g<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Scanning multiple ports on the server, letting Nikto determine if they are HTTP and SSL encrypted.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nikto.pl -h 10.100.100.10 -p 80-90 <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Scanning specific ports on the system.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nikto.pl -h 10.100.100.10 -p 80,443,8000,8080<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;You may combine IDS evasion techniques as desired.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nikto.pl -h 10.100.100.10 -p 80 -e 167<br>
<br>
<br>
<b>IMPORTANT FILES</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;config.txt  - run-time configuration options, see the CONFIG FILE section<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nikto_core.plugin - main Nikto code, absolutely required<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nikto_plugin_order.txt - determines the order in which plugins are executed<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LW.pm - The stand-alone LibWhisker file.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;user_scan_database.db - If it exists in the plugins directory, it will load these checks as well. Same syntax as scan_database.db<br>
<br>
<br>
<b>ADDITIONAL SOFTWARE</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LibWhisker is required for proper execution of Nikto. The LW.pm library is included with Nikto, but it is recommended<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;that you download and install the full LibWhisker module from http://www.wiretrip.net/. If you are not using an installed<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Libwhisker, you will need to change Nikto.pl so that it includes the proper LW.pm file.  Edit Nikto.pl and comment the line:<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;use LW;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;and uncomment the line below it:<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;require "./plugins/LW.pm";<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nmap can be used to speed up port scans. This should be much faster than relying on PERL code to perform port scans. Nmap can<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;be obtained from http://www.nmap.org/, it is not included with Nikto.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;SSL software is required to test using HTTPS.  For Windows systems, the SSL software and libraries can be obtained from<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.activestate.com/.  For unix systems, OpenSSL from http://www.openssl.org/ and the Net::SSLeay module from<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.cpan.org/ are required.<br>
<br>
<b>CHECKS</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Checks, both information and actual security problems, are derived from a number of sources. These include the mailing lists<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;BugTraq, NTBugTraq, WebAppSec (WWW-Mobile-Code), and others. The web sites www.securitytracker.com, www.securiteam.com, <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;www.packetstormsecurity.com and www.securityfocus.com.  Additionally, updates to Nessus are watched and many thanks to<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;all the plugin writers (and to Renaud for Nessus itself) (http://www.nessus.org/).<br>
<br>
<b>WARNINGS</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Nikto can cause harm to your local system, the remote system and/or the network.  Some options can generate over 70,000 <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;HTTP requests to a target. Do not run Nikto againsts hosts you are not authorized to perform testing against. Cirt.net<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;takes no responsibility for anything done with this software, any problems it may cause or problems it may find.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Plugins are standard PERL.  They are included and executed when Nikto is run. If you run the -update option, new and<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;updated plugins will be downloaded from cirt.net. This means you are downloading code, and potentially running it, <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;without viewing it yourself.  Please consider the implications.  Do not assume code distributed from Cirt.net is not<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;harmful, as accidents happen and a malicious third party may have inserted a dangerous plugin. Cirt.net assumes no <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;responsibility if any malicious code is delivered via the -update option.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
<br>
<b>DISTRIBUTION</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Nikto and updated databases and plugins is distributed from http://www.cirt.net/<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
<b>SEE ALSO</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;LibWhisker - http://www.wiretrip.net/<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Nmap - http://www.nmap.org/<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;OpenSSL - http://www.openssl.org/<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CPAN - http://www.cpan.org/<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ActiveState - http://www.activestate.com/<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Nessus - http://www.nessus.org/<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
<b>LICENSE</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This copyright applies to all code included in this distribution, but does not include the LibWhisker software, which is<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;distributed under its own license.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Copyright (C) 2001-2003 Sullo/CIRT.net<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;as published by the Free Software Foundation; either version 2  of the License, or (at your option) any later version.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more details.<br>
<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;You should have received a copy of the GNU General Public License along with this program; if not, write to the <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Contact Information: See the AUTHOR section.<br>
<br>
<br>
<b>AUTHOR</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Sullo, [e-mail]<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://www.cirt.net/<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Suggestions/fixes/support from: Jericho/attrition.org, rfp/wiretrip.net, Zel/firewallmonkeys.com, Zeno/cgisecurity.com, <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Darby/cirt.net, Valdez/cirt.net, S Saady, P Eronen/nixu.com, M Arboi, T Seyrat, J DePriest, P Woroshow, fr0stman, E Udassin,<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;H Heimann and more<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Many tests and contributed/suggested by: M Richardson, Jericho/attrition.org, Prickley Paw, M Arboi, H Heimann and more<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;And Xiola.net for succeeding where everyone else has failed.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>