php漏洞扫描kali,kali nikto的漏洞扫描

nikto帮助文档 帮助文档比较复杂，这里就使用最简单的几种方法:  root@kali:~# nikto -H      Options:        -ask+               Whether to ask about submitting updates                                yes   Ask about each (default)                                no    Don't ask, don't send                                auto  Don't ask, just send        -Cgidirs+           Scan these CGI dirs: "none", "all", or values like "/cgi/ /cgi-a/"        -config+            Use this config file        -Display+           Turn on/off display outputs:                                1     Show redirects                                2     Show cookies received                                3     Show all 200/OK responses                                4     Show URLs which require authentication                                D     Debug output                                E     Display all HTTP errors                                P     Print progress to STDOUT                                S     Scrub output of IPs and hostnames                                V     Verbose output        -dbcheck           Check database and other key files for syntax errors        -evasion+          Encoding technique:                                1     Random URI encoding (non-UTF8)                                2     Directory self-reference (/./)                                3     Premature URL ending                                4     Prepend long random string                                5     Fake parameter                                6     TAB as request spacer                                7     Change the case of the URL                                8     Use Windows directory separator (\)                                A     Use a carriage return (0x0d) as a request spacer                                B     Use binary value 0x0b as a request spacer         -Format+           Save file (-o) format:                                csv   Comma-separated-value                                htm   HTML Format                                msf+  Log to Metasploit                                nbe   Nessus NBE format                                txt   Plain text                                xml   XML Format                                (if not specified the format will be taken from the file extension passed to -output)        -Help              Extended help information        -host+             Target host        -IgnoreCode        Ignore Codes--treat as negative responses        -id+               Host authentication to use, format is id:pass or id:pass:realm        -key+              Client certificate key file        -list-plugins      List all available plugins, perform no testing        -maxtime+          Maximum testing time per host        -mutate+           Guess additional file names:                                1     Test all files with all root directories                                2     Guess for password file names                                3     Enumerate user names via Apache (/~user type requests)                                4     Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type requests)                                5     Attempt to brute force sub-domain names, assume that the host name is the parent domain                                6     Attempt to guess directory names from the supplied dictionary file        -mutate-options    Provide information for mutates        -nointeractive     Disables interactive features        -nolookup          Disables DNS lookups        -nossl             Disables the use of SSL        -no404             Disables nikto attempting to guess a 404 page        -output+           Write output to this file ('.' for auto-name)        -Pause+            Pause between tests (seconds, integer or float)        -Plugins+          List of plugins to run (default: ALL)        -port+             Port to use (default 80)        -RSAcert+          Client certificate file        -root+             Prepend root value to all requests, format is /directory        -Save              Save positive responses to this directory ('.' for auto-name)        -ssl               Force ssl mode on port        -Tuning+           Scan tuning:                                1     Interesting File / Seen in logs                                2     Misconfiguration / Default File                                3     Information Disclosure                                4     Injection (XSS/Script/HTML)                                5     Remote File Retrieval - Inside Web Root                                6     Denial of Service                                7     Remote File Retrieval - Server Wide                                8     Command Execution / Remote Shell                                9     SQL Injection                                0     File Upload                                a     Authentication Bypass                                b     Software Identification                                c     Remote Source Inclusion                                x     Reverse Tuning Options (i.e., include all except specified)        -timeout+          Timeout for requests (default 10 seconds)        -Userdbs           Load only user databases, not the standard databases                                all   Disable standard dbs and load only user dbs                                tests Disable only db_tests and load udb_tests        -until             Run until the specified time or duration        -update            Update databases and plugins from CIRT.net        -useproxy          Use the proxy defined in nikto.conf        -Version           Print plugin and database versions        -vhost+            Virtual host (for Host header)         + requires a value nikto使用示例 使用前需要更新nikto，输入命令： nikto -update 但有时候会出现网路问题，作者这里这样处理的，如下，不知道对不对。 root@kali:~# nikto -update + Retrieving 'db_tests'  我没有更新Kali系统,所以显示的不是最新版的nikto. + ERROR: Unable to get CIRT.net/nikto/UPDATES/2.1.5/db_tests 首先查找文件【 db_tests 】： root@kali:~# cd / root@kali:/# find . -name "db_tests"   ./usr/share/webshag/database/nikto/db_tests ./var/lib/nikto/databases/db_tests 然后删掉文件，重新更新，就可以了： root@kali:/# cd /var/lib/nikto/databases/ root@kali:/var/lib/nikto/databases# rm db_tests   root@kali:/var/lib/nikto/databases# nikto -update + Retrieving 'db_tests'   + CIRT.net message: Please submit Nikto bugs to http://trac2.assembla.com/Nikto_2/report/2 如果还是不行，就手动下载： root@kali:/var/lib/nikto/databases# wget CIRT.net/nikto/UPDATES/2.1.5/db_tests 更新好之后就可以扫描了： root@kali:/var/lib/nikto/databases# nikto -host http://192.168.168.109/DVWA-1.0.8 - Nikto v2.1.5   --------------------------------------------------------------------------- + Target IP:          192.168.168.109   + Target Hostname:    192.168.168.109 + Target Port:        80   + Start Time:         2015-04-30 20:08:40 (GMT8) ---------------------------------------------------------------------------   + Server: Apache/2.4.9 (Unix) OpenSSL/1.0.1g PHP/5.5.11 mod_perl/2.0.8-dev Perl/v5.16.3 + Retrieved x-powered-by header: PHP/5.5.11   + The anti-clickjacking X-Frame-Options header is not present. + Cookie PHPSESSID created without the httponly flag   + Cookie security created without the httponly flag + Root page / redirects to: login.php   + No CGI Directories found (use '-C all' to force check all possible dirs) + Server leaks inodes via ETags, header found with file /DVWA-1.0.8/robots.txt, fields: 0x1a 0x4dba8594c3d80   + File/dir '/' in robots.txt returned a non-forbidden or redirect HTTP code (302) + "robots.txt" contains 1 entry which should be manually viewed.   + Allowed HTTP Methods: POST, OPTIONS, GET, HEAD, TRACE + OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST   + OSVDB-3268: /DVWA-1.0.8/config/: Directory indexing found. + /DVWA-1.0.8/config/: Configuration information may be available remotely.   + OSVDB-3268: /DVWA-1.0.8/docs/: Directory indexing found. + /DVWA-1.0.8/login.php: Admin login page/section found.   + 6545 items checked: 0 error(s) and 13 item(s) reported on remote host + End Time:           2015-04-30 20:09:03 (GMT8) (23 seconds)   --------------------------------------------------------------------------- + 1 host(s) tested 漏洞使用 877漏洞： root@kali:/var/lib/nikto/databases# telnet 192.168.168.109 80 Trying 192.168.168.109...   Connected to 192.168.168.109. Escape character is '^]'.     get index.html     。。。。。。   。。。。。。   localhostApache/2.4.9 (Unix) OpenSSL/1.0.1g PHP/5.5.11 mod_perl/2.0.8-dev Perl/v5.16.3