2

I am trying to complete a war game on Hell Bound Hackers.

I wish to use the nikto scanner to check some pages for vulnerabilities, however I first need to log into the Hell Bound Hackers war game, and then begin scanning Pen Test 1 challenge.

Here is the URL on the specific challenge:

https://www.hellboundhackers.org/challenges/pentest/pentest1/index.php

The command I am trying to use is this, however the scanner keeps on getting redirected to the index page https://www.hellboundhackers.org which is frustrating as I wish to scan /challenge/pentest/pentest1/index.php. I believe this is because the authentication -id+ part is not working correctly?

nikto -ssl -id username:password -h https://www.hellboundhackers.org/challenges/pentest/pentest1/index.php?

Thank you.

EDIT: I believe I need to login with my web browser, and then somehow copy the cookie to nikto?

  • Have you run a packet capture and see why you are getting redirected? Why are you set on running Nikto? Have you used the -Display parameter to debug? – schroeder Apr 30 '18 at 16:16
  • @schroeder If I go to that URL without logging in I get redirected to the homepage, so obviously I need to login to do the challenge. – user5623335 May 1 '18 at 18:31
  • But do you know why? Is there a redirect, error, message, etc.? If it is a wargame, especially, there is no such thing as "obviously", – schroeder May 1 '18 at 18:47
  • @schroeder Dude just visit that challenge URL in a web browser, you get redirected to the homepage as it wants you to login I believe? You have to be a member of HellBoundHackers to do challenges. – user5623335 May 3 '18 at 8:37
  • Dude, this is your question and your problem. Just fire up Wireshark (or Burp) and see for yourself. You don't need to be a member... If you want to do war games and if you want to be a security auditor, then you will have to start digging down through the technology layers to start understanding why things happen. – schroeder May 3 '18 at 8:42
9

I actually went ahead and checked out your challenge and noticed that it required the cookie fusion_user for loading up the challenge. This can be confirmed from the BurpSuite Screenshot I have posted below:

Burp Suite Repeater showing the fusion_user Cookie in Action

Hence when scanning using nikto we will have to send across this cookie along with the requests.

There are two ways that I know of to do this.

Method 1

  1. Open the nikto.conf file in the location /etc/nikto.conf
  2. Search for the text STATIC-COOKIE and add your cookie and its value like the image below.

Adding the Cookie Value

  1. Now that we have added the cookie you might want to proxy it through burpsuite to verify the traffic that nikto generates. To do so set the proxy in the nikto.conf file as depicted in the image below.

Setting the proxy

  1. Try running nikto now using the below command

    nikto --host https://www.hellboundhackers.org/challenges/pentest/pentest1/index.php -useproxy

  2. [Possible Errors] In case you get the below error proceed to step 6

  • ERROR: Proxy error: opening stream: can't connect: proxy connect failed: proxy connect to 127.0.0.1:8080 failed: Invalid argument at /var/lib/nikto/plugins/LW2.pm line 5157.
  1. The above error could probably be caused by an SSL Error in Nikto itself. The temporary workaround would be to LW_SSL_ENGINE from auto to SSLeay as depicted in the image below.

Changing the SSL Engine

Now that you have done all that is required try running the command

nikto --host https://www.hellboundhackers.org/challenges/pentest/pentest1/index.php -useproxy

once again and observe the traffic in BurpSuite, Nikto should now ideally be scanning the Application with your added cookie.

Method 2

The second method is for you to try around. You could set the user-agent in nikto, proxy it through burp and replace the user-agent with the cookie value using the Match and Replace feature of burp.

Do let me know if you find any issues while implementing the above fixes.

  • is there any way we can set cookie in nikto 's command line without embedded in local file ? – Tejas Pandya Oct 4 at 6:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.