Introduction
Nikto is a popular open-source web server scanner that performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version-specific problems on over 270 servers.
To ensure that Nikto can detect the latest vulnerabilities, it is crucial to keep its databases and plugins up to date. New vulnerabilities are discovered constantly, and the Nikto development team regularly releases updates to its scan engine, plugins, and vulnerability databases. In this lab, you will learn the simple process of updating Nikto to its latest version.
Check the current database and engine versions
In this step, you will check the current versions of your Nikto installation, including the core engine, the plugins, and the scan databases. This is an important first step to confirm the current state before performing an update, allowing you to verify that the update was successful later.
To check the version information, you will use the -Version option. Open a terminal and run the following command:
nikto -Version
You will see output similar to the following. Note that the specific version numbers may vary depending on the initial state of the lab environment.
---------------------------------------------------------------------------
- Nikto v2.x.x
---------------------------------------------------------------------------
+ Nikto v2.x.x
+ Target IP:
+ Target Hostname:
+ Target Port:
+ Start Time: ...
---------------------------------------------------------------------------
- Start of nikto scan
---------------------------------------------------------------------------
+ Nikto Core Revision: ...
+ LibWhisker Revision: ...
+ Plugin Revision: 20220410
+ Database Revision: 20220409
Pay close attention to the Plugin Revision and Database Revision lines. These are the components we will be updating.
Run the update command using -update
In this step, you will use Nikto's built-in update functionality. Nikto can update its own plugins and databases directly from the official repository at cirt.net.
The command to trigger this process is nikto -update. This command tells Nikto to connect to the remote server, check for newer versions of its components, and download them if available.
Execute the following command in your terminal to begin the update process:
nikto -update
Nikto will now attempt to connect to the internet and download the latest files.
Observe the update process for plugins and databases
This step is for observing the output of the command you just ran. After executing nikto -update, you will see a series of messages in your terminal that detail the update process. You do not need to run any new commands here; simply review the output from the previous step.
The output should look something like this:
---------------------------------------------------------------------------
- Nikto v2.x.x
---------------------------------------------------------------------------
+ Nikto v2.x.x
+ Target IP:
+ Target Hostname:
+ Target Port:
+ Start Time: ...
---------------------------------------------------------------------------
- Start of nikto scan
---------------------------------------------------------------------------
+ Checking for plugin updates...
+ Plugins are current, no update needed.
+ Checking for database updates...
+ The 'db_tests' file is not current.
+ Downloading db_tests.tar.gz...
...
+ Unpacking db_tests.tar.gz...
+ 1010 items unpacked.
+ Done.
This output confirms that Nikto has successfully checked for updates. In this example, the plugins were already current, but the test database (db_tests) was outdated and has now been downloaded and unpacked. Your output might show updates for both plugins and databases.
Verify the new component versions after the update
In this step, you will verify that the update was successful. Just as you did in the first step, you will check the version information again. This will confirm that the new plugin and database files are being recognized and used by Nikto.
Run the nikto -Version command one more time:
nikto -Version
Now, compare the new output with the one you saw in Step 1. The Plugin Revision and Database Revision dates should be more recent.
---------------------------------------------------------------------------
- Nikto v2.x.x
---------------------------------------------------------------------------
+ Nikto v2.x.x
...
---------------------------------------------------------------------------
- Start of nikto scan
---------------------------------------------------------------------------
+ Nikto Core Revision: ...
+ LibWhisker Revision: ...
+ Plugin Revision: 20231025 <-- Should be newer
+ Database Revision: 20231112 <-- Should be newer
Seeing updated revision numbers confirms that your Nikto instance is now using the latest components.
Perform a test scan with the updated components
In this final step, you will perform a quick test scan to ensure that Nikto is fully functional after the update. A simple scan against a local web server is sufficient to confirm that the engine, plugins, and databases are all working together correctly.
The lab environment has a local Apache web server running. You can scan it using localhost as the target host. The -h option is used to specify the host.
Run the following command to start the scan:
nikto -h localhost
Nikto will now start scanning the local web server. You will see output detailing the server information and any potential findings. A successful start to the scan indicates that the updated components are working correctly.
---------------------------------------------------------------------------
- Nikto v2.x.x
---------------------------------------------------------------------------
+ Target IP: 127.0.0.1
+ Target Hostname: localhost
+ Target Port: 80
+ Start Time: ...
---------------------------------------------------------------------------
- Server: Apache/2.4.52 (Ubuntu)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
...
+ 6557 requests: 0 error(s) and 7 item(s) reported on remote host
+ End Time: ...
---------------------------------------------------------------------------
- 1 host(s) tested
Seeing this output confirms that your updated Nikto scanner is operational.
Summary
Congratulations on completing this lab!
You have successfully learned how to manage and update your Nikto web scanner. You practiced checking the current component versions, running the nikto -update command to fetch the latest plugins and databases, verifying that the update was successful by re-checking the versions, and performing a test scan to ensure everything was working correctly.
Keeping your security tools up-to-date is a fundamental practice in cybersecurity, as it ensures you are equipped to detect the most recently discovered threats and vulnerabilities.
