search

sullo / nikto

Nikto web server scanner
Other
8.16k stars 1.19k forks source link

Nikto not finding webserver #575

Open dsolstad opened 5 years ago

dsolstad commented 5 years ago

There is a webserver using self-signed certificate that Nikto does not recognize. I can however reach it via normal web browsers. I had to proxy Nikto through Burp to be able to scan it.

curl complains about that the dh key is too small:

$ curl -ik https://192.168.1.50:9043 curl: (35) error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small

Is this something that should and can be fixed?

$ nikto -host 192.168.1.55 -port 9043 -D v

sullo commented 5 years ago

My best guess is this is an underlying OS/encryption issue since curl can't handle it (can wget?). It's possible the perl TLS modules and/or Libwhisker can't handle it--there are a lot of things that can wrong in that chain.

I'd make sure that your perl libraries for Net::SSLeay and Net::SSL are up to date.

Also, I'd force change the SSL library nikto is using, and try both rather than letting it auto select. See nikto.conf and update this bit:

# SSLeay        - use Net::SSLeay 
# SSL           - use Net::SSL 
# auto          - automatically choose whats available 
#                 (SSLeay wins if both are available) 
LW_SSL_ENGINE=auto
dsolstad commented 5 years ago

wget finds it with --no-check-certificate. It didn't make any difference by changing LW_SSL_ENGINE. Everything from an updated Kali machine.

tautology0 commented 5 years ago

I've notice some problems with SSL and perl on Windows, but not on Linux. Could you try it with "-D d" instead of "-D v" as that will dump the actual request headers?

dsolstad commented 5 years ago

D:Thu Nov 29 05:12:42 2018 - Loading DB: /var/lib//nikto/databases/db_parked_strings D:Thu Nov 29 05:12:42 2018 - Loading DB: /var/lib//nikto/databases/db_404_strings D:Thu Nov 29 05:12:42 2018 - Loading DB: /var/lib//nikto/databases/db_outdated D:Thu Nov 29 05:12:42 2018 - Loading DB: /var/lib//nikto/databases/db_variables D:Thu Nov 29 05:12:42 2018 - Loading DB: /var/lib//nikto/databases/db_tests

tautology0 commented 5 years ago

Here's the problem, this bugger: error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small

Basically the Diffie-Hellman key on the server is <1024 bits. This isn't supported in the version of openssl you're using. The ideal solution would be to get the server to match modern TLS standards

ms08067 commented 5 years ago

I am having the same issue. The target site is http so no SSL/TLS. I can see it making HEAD requests in wireshark, I dont see any RST packets or anything negative that the server responds with. I can navigate to the site manually just fine. First time ive seen this happen.

ms08067 commented 5 years ago

Here is a curl and response...Ive censored the domain.

curl -IL http://www.########.com

HTTP/1.1 200 OK Server: openresty/1.11.2.4 Date: Wed, 19 Dec 2018 15:38:42 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/5.3.29-pl0-gentoo Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache X-Pingback: http://www.#######.com/xmlrpc.php Link: http://www.#######.com/; rel=shortlink Set-Cookie: PHPSESSID=5ab739ef1c3b9b1232263f5ead67158a; path=/ X-Webcom-Cache-Status: BYPASS

sullo commented 5 years ago

@ms08067 I don't see anything in that response that should be a problem. Can you post a debug dump in a file? If you use -D DS it should scrub the output of the hostname (verify though). I'm particularly looking for the first request or two to see the request/response. Thanks.

tautology0 commented 5 years ago

I think the two problems aren't related. I think @dsolstad's problem is the version of openssl and the server being scanned. We need more information from @ms08067.

cyc115 commented 4 years ago

Curl will accept tlsv1.0 if you remove CipherString = DEFAULT@SECLEVEL=2 from /etc/ssl/openssl.cnf. But nkito won't budge. eg. curl https://example.com --tlsv1.0 -k