LinuxCBT WebScan Edition d3x

Focus: Web Server Scanning
Duration: 4 Hours

Course Objective
Intro to Web Server Scanning with Nikto - Module XV

Introduction - Nikto - Features
Discuss Nikto Features
Pinpoint useful online resources
Identify key systems in topology
Explore possible scan targets

Nikto Installation
Download Nikto Web Scanner
Perform Installation
Explore run-time environment
Discuss Plugins - Signatures - DBs
Peruse configuration entries
Mention key CLI options

Staging Scan
Identify Staging targets
Scan Staging to ascertain server metadata
Perform comprehensive scans of targets
Watch web logs while scans are ongoing
Alter display of Web Scan Requests and Responses
Rule-out false-positives
Adjust security posture where applicable
Re-scan and compare and contrast

Production Scan
Identify PROD web instance
Discern useful metadata with reconnaissance
Drill deeper to determine more relevant attributes
Attempt to identify vulnerabilities on target
Peruse findings accordingly
Suggest methods of filtering false-positives

Reporting | Logging
Compare STDOUT to Report Data
Discuss Logging | Reporting options and formats
Enable Reports on various scans
Vary target reports for Cron mode
Tweak scans and redirect output accordingly

SSL Scans
Discuss applicabilitiy
Identify key options
Enable SSL scanning on targets
Compare Staging and Production output
Examine supported ciphers on targets
Search for cipher weaknesses
Evaluate results

Proxy Server Relay Scans
Discus pros and cons of Proxy Usage
Identify Squid Proxy Facility
Update Nikto configuration to support Proxy Usage
Perform Proxy Scans from multiple Web Scanners
Evaluate Proxy Requests | Responses in Real-Time
Compar and Contrast performance differentials
Evaluate results

Nikto Scan Tuning
Discuss features and benefits
Identify key Tuning Options
Filter scans to focus on targeted Plugins
Initiate multiple Tuned Scans
Evaluate Results