Marlo Clarke
Cisco Ethical Hacker Candidate | ParoCyber Bootcamp Student
Cybersecurity & IT Professional
The objective of this lab was to use the Nikto web vulnerability scanner to identify common security issues, misconfigurations, and outdated software on web servers. The lab demonstrates how automated vulnerability scanning supports defensive security and penetration testing efforts.
- Kali Linux
- Nikto
- Firefox (for vulnerability research)
- National Vulnerability Database (NVD)
Nikto was launched from the command line and explored using the help option to understand available tuning and scan parameters.
Command: nikto –help
A basic scan was performed against scanme.nmap.org, a publicly available test server provided by Nmap for safe scanning.
Command:nikto -h scanme.nmap.org
Findings included missing security headers such as X-Content-Type-Options, which can allow MIME sniffing attacks.
Nikto was configured to scan HTTPS-enabled targets using the -ssl flag.
Command: nikto -h https://nmap.org -ssl
A list of internal lab IP addresses was created and scanned simultaneously.
Command: nikto -h IP_list.txt
Multiple web servers were identified, including Apache-based systems.
Reported CVEs were researched using the National Vulnerability Database (NVD), including:
- CVE-1999-0678
- CVE-2003-1418
This step helped validate findings and identify remediation strategies such as patching and secure configuration.
Nikto scan results were exported for reporting and further analysis.
Commands: nikto -h 172.17.0.2 -o scan_results.htm nikto -h 172.17.0.2 -o scan_results.txt -Format csv
- Missing security headers increase attack surface
- Outdated web server configurations expose sensitive information
- Automated scanners are effective for reconnaissance but require manual validation
All scans were conducted in authorized lab environments or approved public test servers. Vulnerability scanning must only be performed with proper permission.
- Web vulnerability scanning
- CVE research and remediation analysis
- Secure configuration assessment
- Ethical hacking documentation
- Manual testing with OWASP ZAP or Burp Suite
- Targeted SQL Injection and XSS testing
- Web application hardening and remediation validation