Discover Vulnerabilities in Websites

The video tutorial covers the use of Nikto and OWASP ZAP for web vulnerability scanning. It begins with an introduction to vulnerability scanning, focusing on the Nikto tool, which tests for various vulnerabilities including the OWASP top 10. The tutorial demonstrates how to use Nikto to scan a web server, export results, and analyze vulnerabilities. Advanced scanning techniques, such as tuning for specific vulnerabilities like SQL injection, are also discussed. The video concludes with an introduction to OWASP ZAP, highlighting its ease of use for web application testing and its ability to categorize vulnerabilities.

What is the primary purpose of using Nikto in web vulnerability scanning?

• To create a backup of the website

• To monitor website traffic

• To enhance the website's SEO

• To perform comprehensive tests against multiple vulnerabilities

Which command is used to start a basic scan with Nikto?

• nikto -h [IP]

• nikto -scan [IP]

• nikto -start [IP]

• nikto -run [IP]

What is the default port used by Nikto when scanning a web server?

• 443

• 21

• 8080

• 80

How can you specifically scan for SQL injection vulnerabilities using Nikto?

• Select SQL scan from the menu

• Enable SQL mode in settings

• Use the tuning option with parameter 9

• Use the parameter -sql

What is a key feature of OWASP ZAP?

• It is a tool for database management

• It is used for creating web applications

• It provides a categorized list of vulnerabilities

• It can only scan for SQL injections

How does OWASP ZAP categorize vulnerabilities?

• By the number of affected users

• By the size of the vulnerability

• By the color indicating priority

• By the date they were discovered

What is the default session management method in OWASP ZAP?

• Token-based

• Cookie-based

• IP-based

• Time-based