I ran a Nikto scan on a machine by hostname
nikto -host https://machine.host.com
it identified a padding vulnerability :
OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070.asp allowing a cryptographic padding oracle.
When I run Nikto against the IP address, it does not report the padding vulnerability.
I have checked that the hostname resolves to the IP address I am testing, the webserver is only running on 443, so I have a
-port switch to use 443. The IP address is internal but Nikto connects and executes tests successfully.
nikto -host 10.10.10.10 -port 443
My assumption would be that Nikto resolves a hostname then checks the IP, so a scan on the IP or the hostname should yield the same result.
Why are they different?