Network Security Tools

Existing Nikto Plug-ins

Now let’s examine the plug-ins that come bundled with Nikto. This will help you understand how the existing plug-ins function, before you write your own.

nikto_core

The core plug-in, as the name suggests, contains the core functionality for the main vulnerability-checking routines. These routines are available for use within the rest of the plug-ins. This plug-in and its exported routines were discussed in detail in the previous section.

nikto_realms

This plug-in checks whether the web server uses HTTP Basic authentication. If it does, it loads default usernames and passwords and attempts to guess valid credentials.

nikto_headers

This plug-in iterates through the returned HTTP headers in the server response and reports back any that are interesting from a security perspective; these include X-Powered-By, Content-Location, Servlet-Engine, and DAAP-Server.

nikto_robots

This plug-in retrieves the robots.txt file if it is available and reports back interesting entries, such as Disallow. The robots.txt file is checked by “friendly” web site crawlers to determine if it should follow any rules when crawling the web site.

nikto_httpoptions

This plug-in reviews the allowed HTTP methods, as reported via an OPTIONS request to the web server. Dangerous methods include PUT, CONNECT, and DELETE, among others.

nikto_outdated

This plug-in focuses on the Server HTTP header and uses a “best-guess” parser that determines the web server version, then checks that version ...