Skip to main content

LAB-WEB-203 — Nikto Web Server Misconfiguration Review

LevelFoundation to intermediate
Duration60 minutes
Environmentweb.lab web server
EvidenceMisconfiguration validation sheet

Purpose​

Use Nikto to identify web-server configuration weaknesses, exposed files, banners and insecure defaults, then validate whether each observation is a real security issue in the Northstar environment.

Authorised scope​

Target only http://web.lab. Use one scan process, no mutation modes and no proxy chain outside the lab. Stop if the scanner resolves a redirect to another host.

Learning objectives​

  • run a bounded Nikto assessment with saved output;
  • distinguish web-server findings from application-layer vulnerabilities;
  • validate headers, default files and banner observations manually;
  • reduce false positives caused by custom error pages and redirects;
  • write precise remediation and retest criteria.

Task 1 — Baseline​

nikto -Version
curl -I http://web.lab/

Record the resolved address, HTTP status, redirect behaviour, server time and response headers.

Task 2 — Run the assessment​

mkdir -p evidence
nikto -h http://web.lab \
  -Format json \
  -output evidence/nikto-web-lab.json

Save the exact command and tool version. Do not use broad mutation options in this lab.

Task 3 — Validate findings​

For each result, reproduce the request with curl or Burp Repeater. Confirm:

  • the path exists and is reachable;
  • the response is not a custom 404;
  • the header or file is security-relevant;
  • the observation is not already mitigated elsewhere;
  • the evidence contains no credentials or personal data.

Use the web.nikto section of the synthetic evidence pack if a live target is unavailable.

Task 4 — Classify the result​

ClassificationDefinition
Confirmed findingReproduced and security impact is plausible
Hardening opportunityValid observation with limited direct exploitability
InformationalUseful inventory data without a weakness
False positiveScanner interpretation does not match target behaviour
Out of scopeRequires a prohibited or unapproved test

Checkpoint: A missing header is not automatically high risk. Link the control to the actual application behaviour and threat model.

Task 5 — Produce remediation guidance​

For two confirmed or hardening findings, write:

  • affected virtual host and path;
  • current behaviour;
  • risk and realistic abuse case;
  • exact configuration or deployment change;
  • regression risk;
  • retest request and expected response.

Evidence requirements​

  • Nikto JSON output;
  • baseline header capture;
  • manual validation requests;
  • classification table;
  • two remediation and retest statements.

Knowledge check​

1. What is Nikto primarily assessing?

Web-server exposure, default content, insecure files, outdated components and configuration weaknesses.

2. Why can custom 404 pages create false positives?

They may return a successful status or similar body for nonexistent paths, causing a scanner to interpret the response as exposed content.

3. Why retain the exact target URL?

Scheme, host, port and virtual-host routing affect what the server returns and are required for reproducibility.

References​