While perform scanning on any website that has security controls enabled like Intrusion Detection System or Intrusion Prevention System, they would get notified that they are being scanned. These are the three main target information used by Nikto to dig around and hunt the vulnerabilities.Īlthough we cannot deny the effectiveness of this tool, however one of the main disadvantages of the said tool is, it is not stealthy. an IP Address for a local service, a web domain or an SSL/HTTPS enabled website. Assume that you have a URL of a target, by using Nikto you need to provide it with one of the three different types of information i.e.

Hence playing a primary role to perform website assessment and detects possible vulnerabilities on a site to keep it safe from an attacker. It is an open source web server scanner that renders a bunch of vulnerabilities found on a website that could be exploited. So far, Nikto is one of the most commonly used website vulnerability scanners in the industry. After the attack surface is identified by the analyst, he would use some useful web scanning tools to further identify those vulnerabilities, which might become the primary attack vectors. The attack surface is nothing but a total sum of vulnerabilities that can be exploited to carry out a security attack.

When a penetration tester or a security analyst starts to perform website testing, the first step is to conduct reconnaissance where he would get information related to target and from that, he can identify the attack surface.

Run nessus on kali