3. Nikto

Description:

Nikto is an open-source web server vulnerability scanner. It performs comprehensive tests against web servers to identify issues such as outdated software, insecure HTTP headers, and server misconfigurations. It’s particularly useful for discovering vulnerabilities in HTTP services.

Examples:

• 1. Basic Scan of a Web Server:
     • nikto -h http://example.com

Explanation: Performs a basic scan against example.com to find potential vulnerabilities, including outdated server versions, open directories, and insecure headers.

• 1. SSL/TLS Scan:
     • nikto -h https://example.com

Explanation: Runs a scan against an HTTPS server to check for SSL/TLS-related issues, including weak ciphers and certificate problems.

• 1. Custom Port Scan:
     • nikto -h http://example.com -p 8080

Explanation: Scans a web server running on a non-default port (8080 in this case).

• 1. Saving Scan Output to a File:
     • nikto -h http://example.com -o scan_report.txt

Explanation: Saves the output of the scan to scan_report.txt for later review.

• 1. Tuning Scan Parameters:
     • nikto -h http://example.com -Tuning x

Explanation: Controls the types of scans performed. For example, -Tuning 1 is for file uploads, -Tuning 4 is for injection vulnerabilities. The value x can be adjusted to specify different scan types.