0

I ran a Nikto scan on a machine by hostname

nikto -host https://machine.host.com

it identified a padding vulnerability :

OSVDB-68127: Server is vulnerable to http://www.microsoft.com/technet/security/bulletin/MS10-070.asp allowing a cryptographic padding oracle.

When I run Nikto against the IP address, it does not report the padding vulnerability.

I have checked that the hostname resolves to the IP address I am testing, the webserver is only running on 443, so I have a -port switch to use 443. The IP address is internal but Nikto connects and executes tests successfully.

nikto -host 10.10.10.10 -port 443

My assumption would be that Nikto resolves a hostname then checks the IP, so a scan on the IP or the hostname should yield the same result.

Why are they different?

  • Try -host ip -ssl. IIRC -port 443 just tried to speak http on port 443 which won't work – wireghoul Jan 23 '17 at 9:44
  • Thanks for the reply @wireghoul but the -ssl switch doesn't seem to change the output for me, it's the same as the results with no -ssl switch. That padding issue is still missing from the results. – iainpb Jan 23 '17 at 10:01
  • 4
    Then the ip and host are probably different virtual hosts and the ip vhost doesn't have dot net bindings? – wireghoul Jan 23 '17 at 10:33
  • @wireghoul - You are correct! There's multiple sites running on IIS with host headers. Individually they show as vulnerable but the 'root' doesn't. Will mark that as answer if you wish to post it. – iainpb Jan 23 '17 at 11:08
3

This vulnerability affects the dotnet framework. Any virtual host that does not have dotnet bindings will not show as vulnerable.

In your case the IP address most likely routes to the default virtual host which unlike the machine virtual host probably does not have any dotnet bindings configured.

That being said you should patch that server as it is a pretty nasty bug.

  • Nikto has a -vhost switch you can invoke to set the host header – iainpb Jan 24 '17 at 11:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.