Escaneo de servidores web con Nikto

Nikto es un escaner de servidores web que realiza tests de multiples instancias, incluyendo más de 6500 archivos potencialmente peligrosos como CGIs.

También checa versiones antiguas de servidores y comprueba problema tipicos de al rededor de 150 servidores web, y detecta versiones especificas de 270 servidores. 

Comprueba la configuración de los servidores web, así como comprobar múltiples archivos index. 

En general un excelente escaner de servidores web.

aquí un ejemplo de un escaneo con Nikto: 

villatux# nikto -host www.ejemplo.com

- Nikto v2.1.4

---------------------------------------------------------------------------

+ Target IP: 66.7.197.XX

+ Target Hostname: www.ejemplo.com

+ Target Port: 80

+ Start Time: 2013-04-31 08:59:08

---------------------------------------------------------------------------

+ Server: nginx admin

+ robots.txt contains 1 entry which should be manually viewed.

+ OSVDB-637: Enumeration of users is possible by requesting ~username (responds with 'Forbidden' for users, 'not found' for non-existent users).

+ DEBUG HTTP verb may show server debugging information. See http://msdn.microsoft.com/en-us/library/e8z01xdh%28VS.80%29.aspx for details.

+ /cgi-sys/formmail.pl: Many versions of FormMail have remote vulnerabilities, including file access, information disclosure and email abuse. FormMail access should be restricted as much as possible or a more secure solution found.

+ /cgi-sys/guestbook.cgi: May allow attackers to execute commands as the web daemon.

+ /cgi-sys/Count.cgi: This may allow attackers to execute arbitrary commands on the server

+ OSVDB-3233: /mailman/listinfo: Mailman was found on the server.

+ OSVDB-3092: /cgi-sys/entropysearch.cgi?query=asdfasdf&user=root&basehref=%2F%2Fwww.yourdomain.com/: CPanel's Entropy Search allows username enumeration via the user parameter.

+ OSVDB-3092: /cgi-sys/FormMail-clone.cgi: Default CGI, often with a hosting manager. No known problems, but host managers allow sys admin via web

+ OSVDB-3092: /cgi-sys/scgiwrap: Default CGI, often with a hosting manager. No known problems, but host managers allow sys admin via web

+ OSVDB-3268: /img/: Directory indexing found.

+ OSVDB-3092: /img/: This might be interesting...

+ OSVDB-3092: /img-sys/: Default image directory should not allow directory listing.

+ OSVDB-3092: /java-sys/: Default Java directory should not allow directory listing.

+ Server banner has changed from nginx admin to lighttpd/1.4.29, this may suggest a WAF or load balancer is in place

+ 6448 items checked: 80 error(s) and 14 item(s) reported on remote host

+ End Time: 2013-04-31 09:40:17 (2469 seconds)

---------------------------------------------------------------------------

+ 1 host(s) tested