2

What does Nikto's "this could be interesting" log mean?

It identified a file (say, admin.html) as potentially interesting. However, when I wget or attempt to access this file in a browser, it just redirects me to the index.

How does Nikto find these files in the first place? Is it possible to see the GET request that found them? How can I access these files?

  • 1
    +1 I sometimes find the output of nikto confusing as well. I haven't yet discovered an option for "Show requests and responses for all printed findings, but for nothing else" (ie not verbose or similar, which just prints too much irrelevant info). – tim May 8 '18 at 19:07
2

Looking at the relevant section of source code:

# request by hostname
my ($res, $content, $error, $request, $response) = nfetch($mark, "/$file", "HEAD", "", "", "", "sitefiles");

if (($res == 200) && (!is_404("/$file", $content, $res, $response->{'location'})) && 
  ($content !~ /<html/i) && ($response->{'content-type'} ne 'text/html')) {    
    add_vulnerability($mark, "/$file: Potentially interesting archive/cert file found.", 740001, 0, "HEAD", "/$file", $request, $response);    
}

# request by ip    
($res, $content, $error, $request, $response) = nfetch($mark, "/$file", "HEAD", "", "", \%flags, "sitefiles");    
if (($res == 200) && (!is_404("/$file", $content, $res, $response->{'location'})) && 
  ($content !~ /<html/i) && ($response->{'content-type'} ne 'text/html')) {   
    add_vulnerability($mark, "/$file: Potentially interesting archive/cert file found. (NOTE: requested by IP address).", 740002, 0, "HEAD", "/file", $request, $response);    
}

We can see that a file is marked as "potentially interesting" if a HTTP HEAD request

  • returns 200 OK
  • doesn't return 404 Not Found
  • returns content without HTML
  • returns a Content-Type header without a value of text/html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.