Nikto Cheat Sheet

Basic Usage!

! nikto -host example.com -port 8080 ! ! ! !

Display Options ! 1 2 3 4 D E P S V ! ! !

Tuning!

-Tuning

-Display

Show redirects Show cookies received Show all 200/OK responses Show URLs which require authentication Debug output Display all HTTP errors Print progress to STDOUT Scrub output of IPs and hostnames Verbose output ! !

Evasion Options! 1 2 3 4 5 6 7 8 A B

1 ! Interesting File / Seen in logs! 2 ! Misconguration / Default File! 3 ! Information Disclosure! 4 ! Injection (XSS/Script/HTML)! 5 ! Remote File Retrieval - Inside Web Root! 6 ! ! Denial of Service! 7 ! Remote File Retrieval - Server Wide! 8 ! Command Execution / Remote Shell! 9 ! SQL Injection! 0 ! File Upload! a ! Authentication Bypass! b ! Software Identication! c ! Remote Source Inclusion! x ! Reverse Tuning Options (i.e., include all ! except specied)! Specify Port Number! Use Proxy!

-evasion

-port!

Random URI encoding (non-UTF8) Directory self-reference (/./) Premature URL ending Prepend long random string Fake parameter TAB as request spacer Change the case of the URL Use Windows directory separator (\) Use a carriage return (0x0d) as a request spacer Use binary value 0x0b as a request spacer

-useproxy! -maxtime -until -nossl ! -ssl -no404 -id ! -key

Maximum testing time per host secs! Run for specied time or duration! Disables SSL! Force SSL! Disables 404 Guessing! Host authentication! format id:pass or id:pass:realm! Client certicate key le! Display Version! Help!

Output File Format! Use -o to save le with le extension.! csv! Comma-separated-value! htm ! HTML Format! msf+ ! Log to Metasploit! nbe ! Nessus NBE format! txt ! Plain text! xml ! XML Format!

-Format !

-Version! -H or -h! -update! -dbcheck! -config

Virtual host! Save Request & Response Headers! Can be replayed with replay.pl

-vhost! -save!

Update! DBCheck! Specify cong le!

NeedSec.com