Checando vulnerabilidades com o Nikto
Neste artigo vou mostrar como instalar, atualizar e usar o Nikto. Este programa é um scanner de vulnerabilidades bastante simples e fácil de usar.
[ Hits: 66.716 ]
Por: Perfil removido em 12/07/2006
-***** SSL support not available (see docs for SSL install instructions) ***** --------------------------------------------------------------------------- - Nikto 1.35/1.36 - www.cirt.net + Target IP: 192.168.131.1 + Target Hostname: 192.168.131.1 + Target Port: 80 + Start Time: Tue Jun 6 21:10:44 2006 --------------------------------------------------------------------------- - Scan is dependent on "Server" string which can be faked, use -g to override + Server: Apache/2.0.52 (Fedora) + Allowed HTTP Methods: GET,HEAD,POST,OPTIONS,TRACE + HTTP method 'TRACE' is typically only used for debugging. It should be disabled. OSVDB-877. + Apache/2.0.52 appears to be outdated (current is at least Apache/2.0.55). Apache 1.3.33 is still maintained and considered secure. + /cgi-bin/.htaccess - Contains authorization information (GET) + /icons/ - Directory indexing is enabled, it should only be enabled for specific directories (if required). If indexing is not used, the /icons directory should be removed. (GET) + /index.html.var - Apache default foreign language file found. All default files should be removed from the web server as they may give an attacker additional system information. (GET) + /manual/images/ - Apache 2.0 directory indexing is enabled, it should only be enabled for specific directories (if required). Apache's manual should be removed and directory indexing disabled. (GET) + /cgi-bin/.htaccess.old - Backup/Old copy of .htaccess - Contains authorization information (GET) + /cgi-bin/.htaccess.save - Backup/Old copy of .htaccess - Contains authorization information (GET) + /cgi-bin/.htaccess - Contains authorization information (GET) + /cgi-bin/.htaccess~ - Backup/Old copy of .htaccess - Contains authorization information (GET) + /cgi-bin/.htpasswd - Contains authorization information (GET) + /.htaccess - Contains authorization information (GET) + /.htpasswd - Contains authorization information (GET) + / - TRACE option appears to allow XSS or credential theft. See http://www.cgisecurity.com/whitehat-mirror/WhitePaper_screen.pdf for details (TRACE) + /manual/ - Web server manual? tsk tsk. (GET) + /webmail/ - Redirects to src/login.php , Web based mail package installed. + The IBM Web Traffic Express Caching Proxy is vulnerable to Cross Site Scripting (XSS). CA-2000-02. (GET) + /webmail/src/read_body.php - This might be interesting... has been seen in web logs from an unknown scanner. (GET) + 2670 items checked - 15 item(s) found on remote host(s) + End Time: Tue Jun 6 21:10:50 2006 (6 seconds) --------------------------------------------------------------------------- + 1 host(s) testedAgora basta avaliar as opções de uso de Nikto e criar o relatório com as vulnerabilidades encontradas no seu sistema.
Cacti + Plugins (Settings, Monitor, Thold e Weathermap) - Instalação e configuração
Porque se aventurar no Linux (parte 2) - Instalei, e agora?
Como gravar o som da sua Zoom G2.1u
Formatando fontes no openoffice
Elastic SIEM - Instalação e Configuração do LAB (Parte I)
Sudoers 1.8.12 - Parte II - Manual
Criptografar sua atual partição root usando dm-crypt com luks
Servidor de Backup com Ubuntu Server 24.04 LTS, RAID e Duplicati (Dell PowerEdge T420)
Visualizar câmeras IP ONVIF no Linux sem necessidade de instalar aplicativos
Atualizar Debian Online de uma Versão para outra
Proteja seu Linux Mint com o Timeshift: Restaure o sistema mesmo que ele não inicie!
Instalando Google Chrome no Debian 13
Ajude-me a criar uma lista de jogos retrô! (7)
Salvar estado da VM no virt-manager (2)
Erro de interface de Rede no Virt Manager dentro Debian 13 KDE (1)
Alguém pode me recomendar um editor de textos? [RESOLVIDO] (9)