Hello Again HF!,
Welcome to another Hacking Tutorial by MeshCollider.
If you are interested, here are links to my other hacking tutorials:Spoiler (Click to View)
Hacking a website: a brief introduction.
Websites are hosted on a webserver - which is just a computer. if we can gain access to the webserver, we can steal or change the files (e.g. defacing), or move from there to attack an entire network.
To gain access, we can either guess/crack passwords for the FTP server on the computer, etc, or we could exploit vulnerabilities in the server or programs running there to gain access quickly and easily.
This tutorial will demonstrate a simple tool to find potential vulnerabilities in a web server, in order to exploit them. This tool is called Nikto. It is one of the most widely used website vulnerabilities tools for security (penetration) testing and black hat hacking.
WARNING: Although the tool is effective, it is very "noisy" - it is not stealthy and can easily be detected if the webserver being scanned has some sort of detection software installed or has a proactive administrator.
1) Run Nikto on Kali Linux
As usual, we will use Kali because it already has Nikto installed. Choose "Kali Linux -> Vulnerability Analysis -> Misc Scanners -> nikto" and run it.
2) Scan the target server
To simple scan for vulnerabilities, we will use this command:
Where example.com is the target's URL. We can also use an IP address, for example 192.168.1.8 which is the IP address of a server on my own network. To find the IP of a server, simple type this command into a terminal window:
And it will tell you the IP address.
3) Analyse the detected vulnerabilities.
Nikto will give us a nice little report of potential vulnerabilities in the target server. For example, my scan tells us the server is Apache 2.2.14, probably on Ubuntu, and gives a list of potential weaknesses we could try to exploit. Some vulnerabilities will be given with a OSVDB prefix, which stands for Open Source Vulnerability Database - a database of known vulnerabilities at www.osvdb.org. You can read more about the vulnerabilities there, by searching the vulnerability ID.
WATCH OUT FOR FALSE POSITIVES! Nikto merely scans to see if the server responds without error to known exploitable URLs, it does not attempt to execute the exploits itself. Some of the "vulnerabilities" nikto returns may not be vulnerable - this is called a false positive.
In future tutorials, I will demonstrate other ways to scan for vulnerabilities, and ways to exploit these vulnerabilities after you have found them.
Thanks for reading, please reply with your thanks if you enjoyed this and/or found it useful.
Watch out for future hacking tutorials from me - further wireless cracking, metasploit and other common hacking topics!
Written by MeshCollider 🤝
Welcome to another Hacking Tutorial by MeshCollider.
If you are interested, here are links to my other hacking tutorials:Spoiler (Click to View)
Hacking a website: a brief introduction.
Websites are hosted on a webserver - which is just a computer. if we can gain access to the webserver, we can steal or change the files (e.g. defacing), or move from there to attack an entire network.
To gain access, we can either guess/crack passwords for the FTP server on the computer, etc, or we could exploit vulnerabilities in the server or programs running there to gain access quickly and easily.
This tutorial will demonstrate a simple tool to find potential vulnerabilities in a web server, in order to exploit them. This tool is called Nikto. It is one of the most widely used website vulnerabilities tools for security (penetration) testing and black hat hacking.
WARNING: Although the tool is effective, it is very "noisy" - it is not stealthy and can easily be detected if the webserver being scanned has some sort of detection software installed or has a proactive administrator.
1) Run Nikto on Kali Linux
As usual, we will use Kali because it already has Nikto installed. Choose "Kali Linux -> Vulnerability Analysis -> Misc Scanners -> nikto" and run it.
2) Scan the target server
To simple scan for vulnerabilities, we will use this command:
Code
nikto -h example.comCode
ping example.com3) Analyse the detected vulnerabilities.
Nikto will give us a nice little report of potential vulnerabilities in the target server. For example, my scan tells us the server is Apache 2.2.14, probably on Ubuntu, and gives a list of potential weaknesses we could try to exploit. Some vulnerabilities will be given with a OSVDB prefix, which stands for Open Source Vulnerability Database - a database of known vulnerabilities at www.osvdb.org. You can read more about the vulnerabilities there, by searching the vulnerability ID.
WATCH OUT FOR FALSE POSITIVES! Nikto merely scans to see if the server responds without error to known exploitable URLs, it does not attempt to execute the exploits itself. Some of the "vulnerabilities" nikto returns may not be vulnerable - this is called a false positive.
In future tutorials, I will demonstrate other ways to scan for vulnerabilities, and ways to exploit these vulnerabilities after you have found them.
Thanks for reading, please reply with your thanks if you enjoyed this and/or found it useful.
Watch out for future hacking tutorials from me - further wireless cracking, metasploit and other common hacking topics!
Written by MeshCollider 🤝
![[Image: TL-468X60-EN.gif]](https://cdn1.tessline.com/banners/en/TL-468X60-EN.gif)
