Agora que estamos com tudo em dia, vamos levá-lo para fora, para um test drive.

O teste padrão, supondo que você instalou o Nikto diretamente em seu servidor:

# perl nikto.pl -h localhost

- Nikto v2.03/2.04
---------------------------------------------------
+ Target IP:          127.0.0.1
+ Target Hostname:    localhost
+ Target Port:        80
+ Start Time:         2009-09-29 14:04:32
----------------------------------------------------
+ Server: Apache/2.2.3 (Red Hat)
- Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE
+ OSVDB-877: HTTP method ('Allow' Header): 'TRACE' is typically only used for debugging and should be disabled. This
message does not mean it is vulnerable to XST.
+ Apache/2.2.3 appears to be outdated (current is at least Apache/2.2.11). Apache 1.3.41 and 2.0.63 are also current.
+ OSVDB-0: GET /webmail/ : Web based mail package installed.
+ OSVDB-877: TRACE / : TRACE option appears to allow XSS or credential theft. See
http://www.cgisecurity.com/whitehat-
mirror/WhitePaper_screen.pdf for details
+ OSVDB-3092: GET /phpmyadmin/ : phpMyAdmin is for managing MySQL databases, and should be protected or limited
to
authorized hosts.
+ OSVDB-3092: GET /phpMyAdmin/ : phpMyAdmin is for managing MySQL databases, and should be protected or limited
to
authorized hosts.
+ OSVDB-3092: GET /tmp/ : This might be interesting...
+ OSVDB-3093: GET /.bashrc : User home dir was found with a shell rc file. This may reveal file and path information.
+ OSVDB-3268: GET /icons/ : Directory indexing is enabled: /icons
+ OSVDB-3233: GET /icons/README : Apache default file found.
+ 3577 items checked: 11 item(s) reported on remote host
+ End Time:        2009-09-29 14:04:36 (4 seconds)
-------------------------------------------------------------------
+ 1 host(s) tested

Test Options: -h localhost
--------------------------------------------------------------------

Você também pode adicionar o sinalizador de evasão, que tenta contornar seus sistemas de IDS (como o Snort), assim:

# perl nikto.pl -h www.xyz.com.br -evasion 1

- Nikto v2.03/2.04
------------------------------------------------------------------
+ Target IP:          192.168.50.23
+ Target Hostname:    www.xyz.com.br
+ Target Port:        80
+ Using IDS Evasion:  Random URI encoding (non-UTF8)
+ Start Time:         2009-09-29 14:16:37
------------------------------------------------------------------
+ Server: Apache/2.2.3 (Red Hat)
+ No CGI Directories found (use '-C all' to force check all possible dirs)
- Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE
+ OSVDB-877: HTTP method ('Allow' Header): 'TRACE' is typically only used for debugging and should be disabled. This
message does not mean it is vulnerable to XST.
+ OSVDB-0: Retrieved X-Powered-By header: PHP/5.1.6
+ Apache/2.2.3 appears to be outdated (current is at least Apache/2.2.11). Apache 1.3.41 and 2.0.63 are also current.
+ OSVDB-0: GET /index.php?module=My_eGallery : My_eGallery prior to 3.1.1.g are vulnerable to a remote execution
bug
via SQL command injection.
+ OSVDB-0: GET /config.php : PHP Config file may contain database IDs and passwords.
+ OSVDB-3233: GET /phpinfo.php : Contains PHP configuration information
+ OSVDB-877: TRACE / : TRACE option appears to allow XSS or credential theft. See
http://www.cgisecurity.com/whitehat-
mirror/WhitePaper_screen.pdf for details
+ OSVDB-12184: GET /index.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 : PHP reveals potentially sensitive
information via certain HTTP requests which contain specific QUERY strings.
+ OSVDB-3092: GET /admin/ : This might be interesting...
+ OSVDB-3092: GET /phpmyadmin/ : phpMyAdmin is for managing MySQL databases, and should be protected or limited
to
authorized hosts.
+ OSVDB-3092: GET /phpMyAdmin/ : phpMyAdmin is for managing MySQL databases, and should be protected or limited
to
authorized hosts.
+ OSVDB-3092: GET /log/ : Ahh...log information...fun!
+ OSVDB-3093: GET /admin/index.php : This might be interesting... has been seen in web logs from an unknown
scanner.
+ OSVDB-3093: GET /index.php?base=test%20 : This might be interesting... has been seen in web logs from an unknown
scanner.
+ OSVDB-3093: GET /index.php?IDAdmin=test : This might be interesting... has been seen in web logs from an unknown
scanner.
+ OSVDB-3093: GET /index.php?pymembs=admin : This might be interesting... has been seen in web logs from an
unknown scanner.
+ OSVDB-3093: GET /index.php?SqlQuery=test%20 : This might be interesting... has been seen in web logs from an
unknown scanner.
+ OSVDB-3093: GET /index.php?tampon=test%20 : This might be interesting... has been seen in web logs from an
unknown
scanner.
+ OSVDB-3093: GET /index.php?topic=<script>alert(document.cookie)</script>%20 : This
might be interesting... has been seen in web logs from an unknown scanner.
+ OSVDB-3093: GET /.bashrc : User home dir was found with a shell rc file. This may reveal file and path information.
+ OSVDB-3268: GET /icons/ : Directory indexing is enabled: /icons
+ OSVDB-3268: GET /docs/ : Directory indexing is enabled: /docs
+ OSVDB-3233: GET /icons/README : Apache default file found.
+ 3577 items checked: 24 item(s) reported on remote host
+ End Time:        2009-09-29 14:16:42 (5 seconds)
---------------------------------------------------------------
+ 1 host(s) tested

Test Options: -h www.xyz.com.br -evasion 1
---------------------------------------------------------------

Existem 9 opções diferentes para flags de evasão, 1 é para Random URI encoding (non-UTF8). Esta varredura é decididamente mais lenta. Para obter mais informações sobre as opções disponíveis que o Nikto tem para oferecer, leia o arquivo README (localizado no diretório nikto/docs/nikto_usage.html ou online em http://www.cirt.net/nikto/README_nikto.html).

Conclusão

A segurança é um estado de ser, não um estado a ser alcançado. Ao testar suas configurações você pode encontrar furos que não percebeu. No entanto, nenhuma ferramenta é um caminho para um sistema seguro, mas apenas um guia. É altamente recomendável que você adeque-se e inscreva-se em alertas de segurança de uma autoridade respeitada no assunto. Só então você ficara à frente dos bandidos e manterá o seu servidor longe de ser comprometido.

Happy Scanning!