Kali Linux: nikto cari web vulnerability - Revision history

Unknown user: /* Scan Facebook */

2022-09-13T06:22:53Z

Scan Facebook

← Older revision		Revision as of 06:22, 13 September 2022
Line 62:		Line 62:
	==Scan Facebook==		==Scan Facebook==

	~~Finally~~, ~~lets point nikto at~~ www.facebook.com.		Akhirnya, mari kita coba scan www.facebook.com.

	nikto -h facebook.com		nikto -h facebook.com

	~~As you can see~~, Facebook ~~is tightly secured with few vulnerabilities~~. ~~As you can imagine~~, if Facebook ~~weren't secure~~, ~~every~~ script-kiddie ~~on the~~ planet ~~would be hacking it to see who his true love is chatting with~~ online.		Seperti yang kita lihat, Facebook sangat aman dengan sedikit kerentanan. Seperti yang dapat kita bayangkan, jika Facebook tidak aman, setiap script-kiddie di planet ini akan meretasnya untuk melihat dengan siapa cinta sejatinya mengobrol secara online.




	==Referensi==		==Referensi==

	* https://null-byte.wonderhowto.com/how-to/hack-like-pro-find-vulnerabilities-for-any-website-using-nikto-0151729/		* https://null-byte.wonderhowto.com/how-to/hack-like-pro-find-vulnerabilities-for-any-website-using-nikto-0151729/

Unknown user: /* Scan WonderHowTo */

2022-09-13T06:21:41Z

Scan WonderHowTo

← Older revision		Revision as of 06:21, 13 September 2022
Line 51:		Line 51:

	Mari kita scan beberapa situs lagi dan melihat apa yang dapat memberitahu kita tentang situs-situs tersebut. Mari kita lihat apa yang bisa kita ketahui tentang situs, www.wonderhowto.com.		Mari kita scan beberapa situs lagi dan melihat apa yang dapat memberitahu kita tentang situs-situs tersebut. Mari kita lihat apa yang bisa kita ketahui tentang situs, www.wonderhowto.com.


	nikto -h wonderhowto.com		nikto -h wonderhowto.com
Line 57:		Line 56:
	Seperti yang kita lihat, ini memberi tahu kita bahwa WonderHowTo menggunakan Microsoft IIS 8.5 sebagai server web dan kemudian tercatat banyak potensi kerentanan.		Seperti yang kita lihat, ini memberi tahu kita bahwa WonderHowTo menggunakan Microsoft IIS 8.5 sebagai server web dan kemudian tercatat banyak potensi kerentanan.

	~~However~~, ~~any attempt to exploit the vulnerabilities listed will reveal that they're all~~ false-~~positives~~, as WonderHowTo ~~simply returns a harmless~~ 404 ~~page~~. ~~This is because~~ WonderHowTo ~~is not built on~~ php or asp ~~as the noted exploits expect~~.		Namun, setiap upaya untuk mengeksploitasi kerentanan yang terdaftar akan mengungkapkan bahwa semuanya false-positive, karena WonderHowTo hanya mengembalikan halaman 404 yang tidak berbahaya. Ini karena WonderHowTo tidak dibangun di atas php atau asp seperti yang diharapkan oleh eksploitasi yang dicatat.

	False ~~positives like this can appear because the scan does not actually execute each of the possible vulnerabilities~~, ~~but rather scans to see if the~~ server ~~responds without error to known exploitable URLs~~.		False positive seperti ini dapat muncul karena scanner tidak benar-benar mengeksekusi setiap kerentanan yang mungkin, melainkan memindai untuk melihat apakah server merespons tanpa kesalahan ke URL yang diketahui dapat dieksploitasi.

	==Scan Facebook==		==Scan Facebook==

Unknown user: /* Scan WonderHowTo */

2022-09-13T06:18:55Z

Scan WonderHowTo

← Older revision		Revision as of 06:18, 13 September 2022
Line 50:		Line 50:
	==Scan WonderHowTo==		==Scan WonderHowTo==

	~~Let's~~ scan ~~a few more sites and see what it can tell us about these sites~~. ~~Let's see what we can find out about our own website~~, www.wonderhowto.com.		Mari kita scan beberapa situs lagi dan melihat apa yang dapat memberitahu kita tentang situs-situs tersebut. Mari kita lihat apa yang bisa kita ketahui tentang situs, www.wonderhowto.com.

	~~nikto -h wonderhowto.com~~

	~~As you can see~~, ~~it tells us that~~ WonderHowTo ~~is using~~ Microsoft's IIS 8.5 ~~as a~~ web ~~server and then lists numerous potential vulnerabilities~~.		nikto -h wonderhowto.com

			Seperti yang kita lihat, ini memberi tahu kita bahwa WonderHowTo menggunakan Microsoft IIS 8.5 sebagai server web dan kemudian tercatat banyak potensi kerentanan.

	However, any attempt to exploit the vulnerabilities listed will reveal that they're all false-positives, as WonderHowTo simply returns a harmless 404 page. This is because WonderHowTo is not built on php or asp as the noted exploits expect.		However, any attempt to exploit the vulnerabilities listed will reveal that they're all false-positives, as WonderHowTo simply returns a harmless 404 page. This is because WonderHowTo is not built on php or asp as the noted exploits expect.

Unknown user: /* Step 2: Scan Web Server */

2022-09-13T04:53:41Z

Step 2: Scan Web Server

← Older revision		Revision as of 04:53, 13 September 2022
Line 30:		Line 30:
	nikto -h 192.168.1.104		nikto -h 192.168.1.104

	Nikto kemungkinan akan me-respon dengan banyak informasi.		Nikto kemungkinan akan me-respon dengan banyak informasi, contoh:

	~~First~~, ~~it tells us the server is~~ Apache 2.2.14, ~~probably on~~ Ubuntu. ~~It nailed this~~ info ~~and gives up more information on other potential vulnerabilities on this~~ web ~~server~~.		* Pertama, ini memberi tahu kita bahwa servernya adalah Apache 2.2.14, mungkin di Ubuntu. Itu memakukan info ini dan memberikan lebih banyak informasi tentang kerentanan potensial lainnya di server web ini.

	~~Note near the bottom that it identifies some vulnerabilities with the~~ OSVDB ~~prefix~~. ~~This is the~~ Open Source Vulnerability Database. ~~This is a~~ database ~~maintained of known vulnerabilities at~~ www.osvdb.org, ~~in addition to other databases I covered~~, ~~such as~~ SecurityFocus ~~and~~ Microsoft's Technet.		* Perhatikan di dekat bagian bawah bahwa ini mengidentifikasi beberapa kerentanan dengan awalan OSVDB. Ini adalah Open Source Vulnerability Database. Ini adalah database yang dikelola dari kerentanan yang diketahui di www.osvdb.org, selain database lain yang kita bahas, seperti SecurityFocus dan Microsoft's Technet.
	~~Step 3Scan the Site~~

	~~Let's try another site. In an earlier tutorial, we had hacked a web server named webscantest.com. Let's see what nikto can tell us about this site.~~		==Step 3: Scan Situs==

	~~nikto~~ -h webscantest.com		Mari kita coba situs lain. Disini kita akan mencoba meng-hack server web bernama webscantest.com. Mari kita lihat apa yang bisa diceritakan nikto tentang situs ini.

	~~Once again, it identifies the server (Apache) and then proceeds to identify numerous potential vulnerabilities pre~~-~~fixed with OSVDB. We can take a look at that website at www.osvdb.org to learn more about these vulnerabilities~~.		nikto -h webscantest.com

	~~Now~~, ~~let's use this site to find information on one of the vulnerabilities identified by nikto as~~ OSVDB~~-877~~. ~~We can put that reference number into the search function and it retrieves the following page~~.		Sekali lagi, ini mengidentifikasi server (Apache) dan kemudian mulai mengidentifikasi berbagai kerentanan potensial yang telah diperbaiki sebelumnya dengan OSVDB. Kita dapat melihat situs web itu di www.osvdb.org untuk mempelajari lebih lanjut tentang kerentanan ini.

	~~Note~~, ~~in lower half of this page there are cross~~-~~references to the various information sources about this vulnerability~~, ~~as well as references to tools and filters such as~~ Nikto, Nessus, ~~and~~ Snort.		Sekarang, mari gunakan situs ini untuk menemukan informasi tentang salah satu kerentanan yang diidentifikasi oleh nikto sebagai OSVDB-877. Kami dapat memasukkan nomor referensi itu ke dalam fungsi pencarian dan itu mengambil halaman berikut.

			Perhatikan, di bagian bawah halaman ini terdapat referensi silang ke berbagai sumber informasi tentang kerentanan ini, serta referensi ke alat dan filter seperti Nikto, Nessus, dan Snort.

	==Scan WonderHowTo==		==Scan WonderHowTo==

Unknown user at 04:47, 13 September 2022

2022-09-13T04:47:38Z

← Older revision		Revision as of 04:47, 13 September 2022
Line 8:		Line 8:
	Tool kecil dan sederhana ini memeriksa situs web dan melaporkan kembali kepada kita akan potensi kerentanan yang ditemukan yang dapat kita gunakan untuk mengeksploitasi atau meretas situs. Selain itu, ini adalah salah satu tool kerentanan situs web yang paling banyak digunakan di industri dan di banyak kalangan dianggap sebagai standar industri.		Tool kecil dan sederhana ini memeriksa situs web dan melaporkan kembali kepada kita akan potensi kerentanan yang ditemukan yang dapat kita gunakan untuk mengeksploitasi atau meretas situs. Selain itu, ini adalah salah satu tool kerentanan situs web yang paling banyak digunakan di industri dan di banyak kalangan dianggap sebagai standar industri.

			Meskipun tool ini sangat berguna dan efektif, tool ini dapat di deteksi (tidak tersembunyi) . Situs web apa pun dengan IDS atau tindakan keamanan lainnya akan mendeteksi bahwa kita sedang men-scan. Awalnya dirancang untuk pengujian keamanan, oleh karena itu tidak pernah dimaksudkan untuk dilakukan dengan diam-diam.

	Although this tool is extremely useful and effective, it is NOT stealthy. Any website with an IDS or other security measures in place will detect that you are scanning it. Originally designed for security testing, it was never meant to be stealthy.

	~~==Step 1Fire Up Kali & Open Nikto==~~

	~~Let's fire up~~ Kali ~~and get started with nikto. Once we have Kali up and running, go to Kali Linux -> Vulnerability Analysis -> Misc Scanners -> nikto, like in the screenshot below.~~		==Step 1: Jalankan Kali & Buka Nikto==

	~~Image via wonderhowto~~.~~com~~		Untuk menjalankan Nikto, kita perlu menjalankan Kali.
			Ketika Kali sudah jalan, masuk ke

	~~Although there are many options in using~~ nikto, ~~we will limit ourselves here to the basic syntax~~, ~~such as this~~:		Kali Linux -> Vulnerability Analysis -> Misc Scanners -> nikto

			Meskipun ada banyak pilihan dalam menggunakan nikto, kita akan membatasi diri di sini pada sintaks dasar, seperti ini:

	nikto -h <IP or hostname>		nikto -h <IP or hostname>

	==Step 2 Scan ~~the~~ Web Server==		==Step 2: Scan Web Server==

			Mari kita mulai dengan server web yang aman di jaringan kita sendiri. Dalam hal ini, kita dapat menjalankan layanan http di komputer lain di jaringan. Tidak ada situs web yang dihosting oleh mesin ini, hanya server web. Mari kita scan kerentanannya dengan mengetik:

	Let's start with a safe web server on our own network. In this case, I have started the http service on another machine on my network. There is not a website hosted by this machine, just the web server. Let's scan it for vulnerabilities by typing:

	nikto -h 192.168.1.104		nikto -h 192.168.1.104

	Nikto ~~responds with a lot of information, as you can see below~~.		Nikto kemungkinan akan me-respon dengan banyak informasi.

	First, it tells us the server is Apache 2.2.14, probably on Ubuntu. It nailed this info and gives up more information on other potential vulnerabilities on this web server.		First, it tells us the server is Apache 2.2.14, probably on Ubuntu. It nailed this info and gives up more information on other potential vulnerabilities on this web server.

Unknown user at 04:26, 13 September 2022

2022-09-13T04:26:37Z

← Older revision		Revision as of 04:26, 13 September 2022
Line 2:		Line 2:


			Sebelum menyerang situs web apa pun, sangat penting untuk melakukan pengintaian yang baik. Beberapa menit pengintaian dapat menghemat berjam-jam waktu hacking. Hanya dengan mencoba berbagai teknik hacking tanpa terlebih dahulu menemukan kerentanan situs adalah kebodohan murni.

	~~Before attacking any website~~, it's critical to do good reconnaissance. A few minutes of recon can save you hours on a hack. Simply trying various attacks without first finding which attacks the site is vulnerable is pure foolishness.		Ada sejumlah tool dan aplikasi untuk menemukan kerentanan di sebuah situs web, tetapi salah satu yang paling sederhana adalah nikto.

	~~There are a number of tools and applications to find vulnerabilities in websites~~, ~~but one of the simplest (and one of my favorites) is nikto~~.		Tool kecil dan sederhana ini memeriksa situs web dan melaporkan kembali kepada kita akan potensi kerentanan yang ditemukan yang dapat kita gunakan untuk mengeksploitasi atau meretas situs. Selain itu, ini adalah salah satu tool kerentanan situs web yang paling banyak digunakan di industri dan di banyak kalangan dianggap sebagai standar industri.

	This small and simple tool examines a website and reports back to you the potential vulnerabilities that it found that you could use to exploit or hack the site. In addition, it's one of the most widely used website vulnerabilities tools in the industry and in many circles considered the industry standard.

	Although this tool is extremely useful and effective, it is NOT stealthy. Any website with an IDS or other security measures in place will detect that you are scanning it. Originally designed for security testing, it was never meant to be stealthy.		Although this tool is extremely useful and effective, it is NOT stealthy. Any website with an IDS or other security measures in place will detect that you are scanning it. Originally designed for security testing, it was never meant to be stealthy.
	Step 1Fire Up Kali & Open Nikto
			==Step 1Fire Up Kali & Open Nikto==

	Let's fire up Kali and get started with nikto. Once we have Kali up and running, go to Kali Linux -> Vulnerability Analysis -> Misc Scanners -> nikto, like in the screenshot below.		Let's fire up Kali and get started with nikto. Once we have Kali up and running, go to Kali Linux -> Vulnerability Analysis -> Misc Scanners -> nikto, like in the screenshot below.

Unknown user at 02:44, 13 September 2022

2022-09-13T02:44:06Z

← Older revision		Revision as of 02:44, 13 September 2022
Line 13:		Line 13:

	Let's fire up Kali and get started with nikto. Once we have Kali up and running, go to Kali Linux -> Vulnerability Analysis -> Misc Scanners -> nikto, like in the screenshot below.		Let's fire up Kali and get started with nikto. Once we have Kali up and running, go to Kali Linux -> Vulnerability Analysis -> Misc Scanners -> nikto, like in the screenshot below.
	Image via wonderhowto.com
			Image via wonderhowto.com

	Although there are many options in using nikto, we will limit ourselves here to the basic syntax, such as this:		Although there are many options in using nikto, we will limit ourselves here to the basic syntax, such as this:
Line 19:		Line 20:
	nikto -h <IP or hostname>		nikto -h <IP or hostname>

	Step ~~2Scan~~ the Web Server		==Step 2 Scan the Web Server==

	Let's start with a safe web server on our own network. In this case, I have started the http service on another machine on my network. There is not a website hosted by this machine, just the web server. Let's scan it for vulnerabilities by typing:		Let's start with a safe web server on our own network. In this case, I have started the http service on another machine on my network. There is not a website hosted by this machine, just the web server. Let's scan it for vulnerabilities by typing:
Line 41:		Line 42:

	Note, in lower half of this page there are cross-references to the various information sources about this vulnerability, as well as references to tools and filters such as Nikto, Nessus, and Snort.		Note, in lower half of this page there are cross-references to the various information sources about this vulnerability, as well as references to tools and filters such as Nikto, Nessus, and Snort.
	Scan WonderHowTo
			==Scan WonderHowTo==

	Let's scan a few more sites and see what it can tell us about these sites. Let's see what we can find out about our own website, www.wonderhowto.com.		Let's scan a few more sites and see what it can tell us about these sites. Let's see what we can find out about our own website, www.wonderhowto.com.
Line 52:		Line 54:

	False positives like this can appear because the scan does not actually execute each of the possible vulnerabilities, but rather scans to see if the server responds without error to known exploitable URLs.		False positives like this can appear because the scan does not actually execute each of the possible vulnerabilities, but rather scans to see if the server responds without error to known exploitable URLs.
	Scan Facebook
			==Scan Facebook==

	Finally, lets point nikto at www.facebook.com.		Finally, lets point nikto at www.facebook.com.

Onnowpurbo: Created page with "sumber: https://null-byte.wonderhowto.com/how-to/hack-like-pro-find-vulnerabilities-for-any-website-using-nikto-0151729/ Before attacking any website, it's critical to do g..."

2017-04-03T21:54:49Z

Created page with "sumber: https://null-byte.wonderhowto.com/how-to/hack-like-pro-find-vulnerabilities-for-any-website-using-nikto-0151729/ Before attacking any website, it's critical to do g..."

New page

sumber: https://null-byte.wonderhowto.com/how-to/hack-like-pro-find-vulnerabilities-for-any-website-using-nikto-0151729/

Before attacking any website, it's critical to do good reconnaissance. A few minutes of recon can save you hours on a hack. Simply trying various attacks without first finding which attacks the site is vulnerable is pure foolishness.

There are a number of tools and applications to find vulnerabilities in websites, but one of the simplest (and one of my favorites) is nikto.

This small and simple tool examines a website and reports back to you the potential vulnerabilities that it found that you could use to exploit or hack the site. In addition, it's one of the most widely used website vulnerabilities tools in the industry and in many circles considered the industry standard.

Although this tool is extremely useful and effective, it is NOT stealthy. Any website with an IDS or other security measures in place will detect that you are scanning it. Originally designed for security testing, it was never meant to be stealthy.
Step 1Fire Up Kali & Open Nikto

Let's fire up Kali and get started with nikto. Once we have Kali up and running, go to Kali Linux -> Vulnerability Analysis -> Misc Scanners -> nikto, like in the screenshot below.
Image via wonderhowto.com

Although there are many options in using nikto, we will limit ourselves here to the basic syntax, such as this:

nikto -h <IP or hostname>

Step 2Scan the Web Server

Let's start with a safe web server on our own network. In this case, I have started the http service on another machine on my network. There is not a website hosted by this machine, just the web server. Let's scan it for vulnerabilities by typing:

nikto -h 192.168.1.104

Nikto responds with a lot of information, as you can see below.

First, it tells us the server is Apache 2.2.14, probably on Ubuntu. It nailed this info and gives up more information on other potential vulnerabilities on this web server.

Note near the bottom that it identifies some vulnerabilities with the OSVDB prefix. This is the Open Source Vulnerability Database. This is a database maintained of known vulnerabilities at www.osvdb.org, in addition to other databases I covered, such as SecurityFocus and Microsoft's Technet.
Step 3Scan the Site

Let's try another site. In an earlier tutorial, we had hacked a web server named webscantest.com. Let's see what nikto can tell us about this site.

nikto -h webscantest.com

Once again, it identifies the server (Apache) and then proceeds to identify numerous potential vulnerabilities pre-fixed with OSVDB. We can take a look at that website at www.osvdb.org to learn more about these vulnerabilities.

Now, let's use this site to find information on one of the vulnerabilities identified by nikto as OSVDB-877. We can put that reference number into the search function and it retrieves the following page.

Note, in lower half of this page there are cross-references to the various information sources about this vulnerability, as well as references to tools and filters such as Nikto, Nessus, and Snort.
Scan WonderHowTo

Let's scan a few more sites and see what it can tell us about these sites. Let's see what we can find out about our own website, www.wonderhowto.com.

nikto -h wonderhowto.com

As you can see, it tells us that WonderHowTo is using Microsoft's IIS 8.5 as a web server and then lists numerous potential vulnerabilities.

However, any attempt to exploit the vulnerabilities listed will reveal that they're all false-positives, as WonderHowTo simply returns a harmless 404 page. This is because WonderHowTo is not built on php or asp as the noted exploits expect.

False positives like this can appear because the scan does not actually execute each of the possible vulnerabilities, but rather scans to see if the server responds without error to known exploitable URLs.
Scan Facebook

Finally, lets point nikto at www.facebook.com.

nikto -h facebook.com

As you can see, Facebook is tightly secured with few vulnerabilities. As you can imagine, if Facebook weren't secure, every script-kiddie on the planet would be hacking it to see who his true love is chatting with online.

==Referensi==

* https://null-byte.wonderhowto.com/how-to/hack-like-pro-find-vulnerabilities-for-any-website-using-nikto-0151729/