nikto-scan

Run web server vulnerability scanning using Nikto against an authorized target.

Decision Loop: In-the-Loop (target approval required before scanning)

Safety — MUST Confirm Before Scanning

Before executing ANY scan:

1. Display the target URL to the user
2. Ask for explicit confirmation: "ยืนยันการสแกนเป้าหมาย (Confirm scan target): <target>?"
3. Do NOT proceed without user approval
4. Note: Nikto sends many HTTP requests — may trigger WAF/IDS alerts

Arguments

Parse the user's input for:

• <target-url> — URL or host:port (REQUIRED)
• --ssl — Force SSL/TLS connection
• --tuning — Test types to include (default: all)

Tuning Options

| Code | Test Type | |------|-----------| | 1 | Interesting File / Seen in logs | | 2 | Misconfiguration / Default File | | 3 | Information Disclosure | | 4 | Injection (XSS/Script/HTML) | | 5 | Remote File Retrieval — Inside Web Root | | 6 | Denial of Service (SKIP for university targets) | | 7 | Remote File Retrieval — Server Wide | | 8 | Command Execution / Remote Shell | | 9 | SQL Injection |

Default for university scans: -Tuning 12345789 (skip DoS)

Execution

After user confirmation, run:

# Determine SSL flag
SSL_FLAG=""  # Add "-ssl" if --ssl specified or URL starts with https

# Determine tuning
TUNING="-Tuning 12345789"  # Skip DoS by default

nikto -h <target-url> ${SSL_FLAG} ${TUNING} -Format json -output /tmp/nikto-output.json 2>&1 | tee /tmp/nikto-console.txt

Output Format

Parse the Nikto output and present:

## ผลการสแกน Nikto (Nikto Scan Results)

### ข้อมูลเป้าหมาย (Target Info)
- **เป้าหมาย (Target)**: `<target>`
- **เซิร์ฟเวอร์ (Server)**: Apache/2.4.52 (Ubuntu)
- **IP**: 203.0.113.10
- **เวลา (Time)**: <timestamp>

### ผลการตรวจพบ (Findings)

| # | Severity | OSVDB | Finding |
|---|----------|-------|---------|
| 1 | HIGH | OSVDB-3092 | /admin/: Admin directory found |
| 2 | MEDIUM | OSVDB-3268 | /icons/: Directory indexing enabled |
| 3 | LOW | OSVDB-0 | X-Frame-Options header not set |

### สรุปตามความรุนแรง (Severity Summary)
- **CRITICAL**: 0
- **HIGH**: 1
- **MEDIUM**: 2
- **LOW**: 3
- **INFO**: 5

### การแมป OWASP (OWASP Mapping)

| Finding | OWASP Category |
|---------|---------------|
| Admin directory exposed | A01:2021 — Broken Access Control |
| Directory indexing | A05:2021 — Security Misconfiguration |
| Missing headers | A05:2021 — Security Misconfiguration |

### คำแนะนำถัดไป (Next Steps)
1. Fix HIGH/CRITICAL findings first
2. Run `/nuclei-scan <target>` for deeper vulnerability testing
3. Run `/sqlmap-scan` on forms/parameters discovered

Error Handling

• If nikto not found: "Nikto is not installed. Install with: sudo apt install nikto"
• If connection refused: "Cannot connect to target. Verify the URL and port."
• If timeout: "Scan timed out. Try with fewer tuning options."