Web application vulnerability scanners in Kali Linux
Kali Linux includes multiple tools for automated vulnerability scanning of web applications. We have examined some of these already, particularly the ones focused on specific vulnerabilities such as sqlmap for SQL injection or XSSer for Cross-Site Scripting (XSS).
Next, we will cover the basic usage of some of the more general web vulnerability scanners listed here:
- Nikto
- Skipfish
- Wapiti
- OWASP-ZAP
Nikto
A long-time classic, Nikto is perhaps the most widely used and well-known web vulnerability scanner in the world. Even though its scanning operation is not very deep and its findings are somewhat generic (they are, by and large, related to outdated software versions, the use of vulnerable components, or misconfigurations detected by analyzing the response headers), Nikto is still a very useful tool because of its extensive set of tests and due to its low likelihood of breaking things.
Nikto is a command-line tool. In the following screenshot, nikto...
