I am trying to perform a scanning of a web server using Nikto using:

nikto -id id:pass -h xxx.xxx.xx.xxx

I am specifying HTTP Basic authentication credentials and indeed with this credentials I can log to the IP address I am scanning. So I am expecting result, but instead I am getting the following:

 Server: blahblah
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the 
user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user 
agent to render the content of the site in a different fashion to the MIME type
+ / - Requires Authentication for realm 'MD5'
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ / - Requires Authentication for realm 'MD5'
+ / - Requires Authentication for realm 'MD5'

I assumed the problem is with the HTTP credentials, but I am adding the right one. Since Nikto is new to me I cannot really understand what the issue is.

Could you please help me with that?

As Nikto's README.md point out; The parameter for host authentication -id's format is:

  • id:pass or id:pass:realm

You can probably try this: nikto -id id:pass:MD5 -h xxx.xxx.xx.xxx

Also, you can find here the authentication plugin's code (written in Perl), and here the Wiki of this project.

  • Could you tell me what is the possible reason for this authentication message? I do not get it anytime, but when I am testing a specific dns. – Vanina Yordanova Nov 28 at 12:31
  • Unfortunately, Nikto's documentation doesn't provide any insight about this specific message. But, based on plugin's code (link), it tries to read the authentication header of host and if it finds a specific realm (like MD5), outputs this message to inform you. Did id:pass:realm worked in this case? – mike Nov 28 at 12:53

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.