1 1 00:00:00,360 --> 00:00:02,790 Web application scanners. 2 2 00:00:02,790 --> 00:00:04,650 In this lesson, we're going to talk about 3 3 00:00:04,650 --> 00:00:06,480 a couple of web application scanners, 4 4 00:00:06,480 --> 00:00:08,760 but first we need to define them. 5 5 00:00:08,760 --> 00:00:11,130 What is a web application scanner? 6 6 00:00:11,130 --> 00:00:14,190 Well, it's a specific type of vulnerability testing tool 7 7 00:00:14,190 --> 00:00:15,780 and it's designed to identify issues 8 8 00:00:15,780 --> 00:00:18,120 with web servers and web applications. 9 9 00:00:18,120 --> 00:00:20,680 So we talked before about using things Nessus 10 10 00:00:20,680 --> 00:00:22,920 and Qualys to look at the infrastructure of your network. 11 11 00:00:22,920 --> 00:00:25,680 We can scan it and identify what things have been installed 12 12 00:00:25,680 --> 00:00:28,260 or not installed across all of your network devices 13 13 00:00:28,260 --> 00:00:30,060 and all of your hosts and servers. 14 14 00:00:30,060 --> 00:00:32,250 But I said at that time that there are specific ones 15 15 00:00:32,250 --> 00:00:34,770 that we can use when we're testing a web application 16 16 00:00:34,770 --> 00:00:36,630 because they do a better job of it. 17 17 00:00:36,630 --> 00:00:38,610 Now, web application scanners are set up 18 18 00:00:38,610 --> 00:00:41,460 to detect XSS, SQL injection, 19 19 00:00:41,460 --> 00:00:43,350 and other types of web attacks 20 20 00:00:43,350 --> 00:00:44,730 and so they're really important to use 21 21 00:00:44,730 --> 00:00:47,820 as a cybersecurity analyst who's testing web applications. 22 22 00:00:47,820 --> 00:00:49,830 Now, there are two we're going to talk about specifically 23 23 00:00:49,830 --> 00:00:50,910 in this lesson. 24 24 00:00:50,910 --> 00:00:53,340 These are Nikto and Arachni. 25 25 00:00:53,340 --> 00:00:55,680 Now, Nikto is one of the most widely available 26 26 00:00:55,680 --> 00:00:58,260 and widely used web application scanners. 27 27 00:00:58,260 --> 00:01:00,690 This is a vulnerability scanner that can be used to identify 28 28 00:01:00,690 --> 00:01:03,840 known web server vulnerabilities and misconfigurations. 29 29 00:01:03,840 --> 00:01:06,150 It'll also be used to identify web applications running 30 30 00:01:06,150 --> 00:01:06,983 on that server, 31 31 00:01:06,983 --> 00:01:09,540 and identify any potential known vulnerabilities 32 32 00:01:09,540 --> 00:01:11,580 in those web applications. 33 33 00:01:11,580 --> 00:01:12,810 Now, when you run Nikto, 34 34 00:01:12,810 --> 00:01:14,460 you're going to use it from the command prompt. 35 35 00:01:14,460 --> 00:01:16,800 You're going to type in Nikto, you're going to type in the host 36 36 00:01:16,800 --> 00:01:18,240 and the port you want to test. 37 37 00:01:18,240 --> 00:01:20,490 In this case, I'm testing the web server located 38 38 00:01:20,490 --> 00:01:25,490 at 69.64.34.144 over port 80, the unencrypted port. 39 39 00:01:26,097 --> 00:01:28,410 Now you can see here it shows me the target IP 40 40 00:01:28,410 --> 00:01:31,650 the target host name, the target port, and the start time. 41 41 00:01:31,650 --> 00:01:33,300 Then it identified the server. 42 42 00:01:33,300 --> 00:01:35,250 It tells me what information it can get 43 43 00:01:35,250 --> 00:01:37,260 and it shows me any kind of server leaks that we see. 44 44 00:01:37,260 --> 00:01:39,000 In this case, we have some. 45 45 00:01:39,000 --> 00:01:40,260 Then it starts telling me about there's some 46 46 00:01:40,260 --> 00:01:42,960 anti-clickjacking going on with X frame header options 47 47 00:01:42,960 --> 00:01:44,790 that isn't present, and it goes on to tell me 48 48 00:01:44,790 --> 00:01:46,470 there's some XSS errors, 49 49 00:01:46,470 --> 00:01:48,450 there's some other X type content errors, 50 50 00:01:48,450 --> 00:01:49,380 and other things like that 51 51 00:01:49,380 --> 00:01:51,420 that it's identifying as it goes through the scan. 52 52 00:01:51,420 --> 00:01:53,790 Just like you use something like Nessus or Qualys, 53 53 00:01:53,790 --> 00:01:56,790 you can use Nikto to test those web applications. 54 54 00:01:56,790 --> 00:01:58,500 Now, the one bad thing about Nikto 55 55 00:01:58,500 --> 00:02:00,300 is that it's really this text-based program. 56 56 00:02:00,300 --> 00:02:03,420 It's not nearly as clean and easy to see all of these errors 57 57 00:02:03,420 --> 00:02:05,250 because it's just a bunch of texts being outputted 58 58 00:02:05,250 --> 00:02:06,360 into the screen. 59 59 00:02:06,360 --> 00:02:08,790 Now I can redirect that into a file, but again, 60 60 00:02:08,790 --> 00:02:10,890 it's text-based, so if I want to use something 61 61 00:02:10,890 --> 00:02:13,470 a little bit prettier I can use Arachni. 62 62 00:02:13,470 --> 00:02:16,410 Arachni is another open-source web scanner application 63 63 00:02:16,410 --> 00:02:18,420 and it actually has a graphical user interface, 64 64 00:02:18,420 --> 00:02:19,410 so it looks a little bit more 65 65 00:02:19,410 --> 00:02:21,090 like what you're used to when you're using something 66 66 00:02:21,090 --> 00:02:23,550 like OpenVAS or Nessus or Qualys. 67 67 00:02:23,550 --> 00:02:25,020 Now, when you're using Arachni, 68 68 00:02:25,020 --> 00:02:27,210 it can actively test different vulnerabilities 69 69 00:02:27,210 --> 00:02:30,960 including code injection, SQL injection, XSS, 70 70 00:02:30,960 --> 00:02:32,490 cross-site request forgery, 71 71 00:02:32,490 --> 00:02:35,640 local and remote file inclusions, session fixation 72 72 00:02:35,640 --> 00:02:37,890 directory traversal, and many more. 73 73 00:02:37,890 --> 00:02:39,450 All of those bad things we talked about 74 74 00:02:39,450 --> 00:02:41,490 back in the web application section, 75 75 00:02:41,490 --> 00:02:43,680 all of that can be tested by this tool, 76 76 00:02:43,680 --> 00:02:45,570 and when it does it it's going to show you a report 77 77 00:02:45,570 --> 00:02:47,070 like you see here on the screen. 78 78 00:02:47,070 --> 00:02:49,470 And you can see in this case, we have path reversals, 79 79 00:02:49,470 --> 00:02:52,260 we have XSS, we have SQL injections, 80 80 00:02:52,260 --> 00:02:54,480 we have XSS in the XML tags 81 81 00:02:54,480 --> 00:02:56,250 and we have unencrypted password forms 82 82 00:02:56,250 --> 00:02:58,020 as well as a lot of other issues. 83 83 00:02:58,020 --> 00:02:59,880 Arachni will also tell you what is more severe 84 84 00:02:59,880 --> 00:03:01,800 or less severe based on the color. 85 85 00:03:01,800 --> 00:03:03,810 As you can see here, these red ones that are 86 86 00:03:03,810 --> 00:03:06,000 at the top of the list are the most severe, 87 87 00:03:06,000 --> 00:03:08,610 and as we go lower down the list, we get down to blues 88 88 00:03:08,610 --> 00:03:11,360 and then eventually whites, which are the least severe.