nikto - 웹서버 취약점 점검 도구

nikto는 펄 언어로 작성된 오픈 소스로 웹서버에 대한 취약점을 점검해주는 도구이다. 

칼리리눅스에서 nikto에 대한 특징으로 다음을 이야기 해준다.

Easily updatable CSV-format checks database Output reports in plain text or HTML Available HTTP versions automatic switching Generic as well as specific server software checks SSL support (through libnet-ssleay-perl) Proxy support (with authentication) Cookies support

 

 

반응형

ikto의 주요 옵션은 다음과 같다

-ask+               Whether to ask about submitting updates                                yes   Ask about each (default)                                no    Don't ask, don't send                                auto  Don't ask, just send        -Cgidirs+           Scan these CGI dirs: "none", "all", or values like "/cgi/ /cgi-a/"        -config+            Use this config file        -Display+           Turn on/off display outputs:                                1     Show redirects                                2     Show cookies received                                3     Show all 200/OK responses                                4     Show URLs which require authentication                                D     Debug output                                E     Display all HTTP errors                                P     Print progress to STDOUT                                S     Scrub output of IPs and hostnames                                V     Verbose output       -dbcheck           Check database and other key files for syntax errors        -evasion+          Encoding technique:                                1     Random URI encoding (non-UTF8)                                2     Directory self-reference (/./)                                3     Premature URL ending                                4     Prepend long random string                                5     Fake parameter                                6     TAB as request spacer                                7     Change the case of the URL                                8     Use Windows directory separator (\)                                A     Use a carriage return (0x0d) as a request spacer                                B     Use binary value 0x0b as a request spacer         -Format+           Save file (-o) format:                                csv   Comma-separated-value                                htm   HTML Format                                msf+  Log to Metasploit                                nbe   Nessus NBE format                                txt   Plain text                                xml   XML Format                                (if not specified the format will be taken from the file extension passed to -output)        -Help              Extended help information        -host+             Target host        -IgnoreCode        Ignore Codes--treat as negative responses        -id+               Host authentication to use, format is id:pass or id:pass:realm        -key+              Client certificate key file        -list-plugins      List all available plugins, perform no testing        -maxtime+          Maximum testing time per host        -mutate+           Guess additional file names:                                1     Test all files with all root directories                                2     Guess for password file names                                3     Enumerate user names via Apache (/~user type requests)                                4     Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type requests)                                5     Attempt to brute force sub-domain names, assume that the host name is the parent domain                                6     Attempt to guess directory names from the supplied dictionary file        -mutate-options    Provide information for mutates        -nointeractive     Disables interactive features        -nolookup          Disables DNS lookups        -nossl             Disables the use of SSL        -no404             Disables nikto attempting to guess a 404 page        -output+           Write output to this file ('.' for auto-name)        -Pause+            Pause between tests (seconds, integer or float)        -Plugins+          List of plugins to run (default: ALL)        -port+             Port to use (default 80)        -RSAcert+          Client certificate file        -root+             Prepend root value to all requests, format is /directory        -Save              Save positive responses to this directory ('.' for auto-name)        -ssl               Force ssl mode on port        -Tuning+           Scan tuning:                                1     Interesting File / Seen in logs                                2     Misconfiguration / Default File                                3     Information Disclosure                                4     Injection (XSS/Script/HTML)                                5     Remote File Retrieval - Inside Web Root                                6     Denial of Service                                7     Remote File Retrieval - Server Wide                                8     Command Execution / Remote Shell                                9     SQL Injection                                0     File Upload                                a     Authentication Bypass                                b     Software Identification                                c     Remote Source Inclusion                                x     Reverse Tuning Options (i.e., include all except specified)       -timeout+          Timeout for requests (default 10 seconds)       -Userdbs           Load only user databases, not the standard databases                                all   Disable standard dbs and load only user dbs                                tests Disable only db_tests and load udb_tests       -until             Run until the specified time or duration       -update            Update databases and plugins from CIRT.net       -useproxy          Use the proxy defined in nikto.conf       -Version           Print plugin and database versions       -vhost+            Virtual host (for Host header)

옵션이 다양하고 복잡한데,

기본적인 사용은 이렇게 단순하다.

nikto -h 192.168.0.1 -p 80 -C all -o result.html

이런 식으로 옵션을 주어 취약점 점검을 하면 되겠다.

nikto -h 192.168.0.1 -p 80 -C all -o result.html

728x90

예제처럼 nikto를 사용하였을 경우,

nikto -h 192.168.0.1 -p 80 -C all -o result.html

바로 확인된 웹서버에 대한 정보를 이렇게 보여준다.

이것은 일부 정보인데,

먼저 서버의 종류, 서버 배너 정보, 헤더 옵션 정보 등 기본 정보를 먼저 디스플레이한다.

nikto 동작 완료되면 result.html로 더 자세한 정보를 알 수 있겠다.

---

결과를 보고 웹서버에 취약한 부분이 있는지,

예를 들자면 불필요페이지가 발견된다던가,

디렉토리 인덱싱이 발견된다던가 하면 운영 상황에 맞게 수정하면 되겠다.

단순해보이지만 강력한 취약점 도구 nikto 였다