Instructor: Web application scanners. 2 2
In this lesson, we're going to talk about 3 3
a couple of web application scanners, 4 4
but first we need to define them. 5 5
What is a web application scanner? 6 6
Well, it's a specific type of vulnerability testing tool 7 7
and it's designed to identify issues 8 8
with web servers and web applications. 9 9
So we talked before about using things Nessus 10 10
and Qualys to look at the infrastructure of your network. 11 11
We can scan it and identify what things have been installed 12 12
or not installed across all of your network devices 13 13
and all of your hosts and servers. 14 14
But I said at that time that there are specific ones 15 15
that we can use when we're testing a web application 16 16
because they do a better job of it. 17 17
Now, web application scanners are set up 18 18
to detect XSS, SQL injection, 19 19
and other types of web attacks 20 20
and so they're really important to use 21 21
as a cybersecurity analyst who's testing web applications. 22 22
Now, there are two we're going to talk about specifically 23 23
in this lesson. 24 24
These are Nikto and Arachni. 25 25
Now, Nikto is one of the most widely available 26 26
and widely used web application scanners. 27 27
This is a vulnerability scanner that can be used to identify 28 28
known web server vulnerabilities and misconfigurations. 29 29
It'll also be used to identify web applications running 30 30
on that server, 31 31
and identify any potential known vulnerabilities 32 32
in those web applications. 33 33
Now, when you run Nikto, 34 34
you're going to use it from the command prompt. 35 35
You're going to type in Nikto, you're going to type in the host 36 36
and the port you want to test. 37 37
In this case, I'm testing the web server located 38 38
at 69.64.34.144 over port 80, the unencrypted port. 39 39
Now you can see here it shows me the target IP 40 40
the target host name, the target port, and the start time. 41 41
Then it identified the server. 42 42
It tells me what information it can get 43 43
and it shows me any kind of server leaks that we see. 44 44
In this case, we have some. 45 45
Then it starts telling me about there's some 46 46
anti-clickjacking going on with X frame header options 47 47
that isn't present, and it goes on to tell me 48 48
there's some XSS errors, 49 49
there's some other X type content errors, 50 50
and other things like that 51 51
that it's identifying as it goes through the scan. 52 52
Just like you use something like Nessus or Qualys, 53 53
you can use Nikto to test those web applications. 54 54
Now, the one bad thing about Nikto 55 55
is that it's really this text-based program. 56 56
It's not nearly as clean and easy to see all of these errors 57 57
because it's just a bunch of texts being outputted 58 58
into the screen. 59 59
Now I can redirect that into a file, but again, 60 60
it's text-based, so if I want to use something 61 61
a little bit prettier I can use Arachni. 62 62
Arachni is another open-source web scanner application 63 63
and it actually has a graphical user interface, 64 64
so it looks a little bit more 65 65
like what you're used to when you're using something 66 66
like OpenVAS or Nessus or Qualys. 67 67
Now, when you're using Arachni, 68 68
it can actively test different vulnerabilities 69 69
including code injection, SQL injection, XSS, 70 70
cross-site request forgery, 71 71
local and remote file inclusions, session fixation 72 72
directory traversal, and many more. 73 73
All of those bad things we talked about 74 74
back in the web application section, 75 75
all of that can be tested by this tool, 76 76
and when it does it it's going to show you a report 77 77
like you see here on the screen. 78 78
And you can see in this case, we have path reversals, 79 79
we have XSS, we have SQL injections, 80 80
we have XSS in the XML tags 81 81
and we have unencrypted password forms 82 82
as well as a lot of other issues. 83 83
Arachni will also tell you what is more severe 84 84
or less severe based on the color. 85 85
As you can see here, these red ones that are 86 86
at the top of the list are the most severe, 87 87
and as we go lower down the list, we get down to blues 88 88
and then eventually whites, which are the least severe.