Nmap told you a web port is open and gave you a rough banner. The next question is sharper: what is this web stack made of, and is it already misconfigured or out of date? Before you spend hours probing application logic, a few seconds of fingerprinting and a fast known-issue scan often hand you the easiest wins — an exposed admin panel, a leftover backup file, a server version with public exploits, a missing security header.
This lesson teaches the two staple Kali tools for that first pass:
- WhatWeb — a fast technology fingerprinter. From headers, body, cookies, and the favicon it names the web server, frameworks, languages, CMS, and JavaScript libraries.
- Nikto — a web server scanner that checks a target against a large signature database of dangerous default files, common misconfigurations, outdated server software, and known-bad URLs.
Scope warning. Both tools are active, and Nikto is loud — it fires thousands of requests for known paths and is trivially detected and logged. Run these only against the bundled NovaCart, systems you own, or targets covered by a signed scope or an in-scope bug-bounty asset. This is the unchanging rule from the ethics and authorization lesson.
In this lesson you will:
- See why this is server-level scanning, distinct from (and complementary to) a ZAP/Burp application active scan.
- Fingerprint a target's technology stack with WhatWeb.
- Run Nikto to surface outdated software, dangerous default/backup files, risky HTTP methods, and missing headers — and save the report with
-o. - Learn to triage Nikto's noisy, signature-based output and separate real findings from false positives.
- See how the version banners and findings feed searchsploit, WPScan, and the misconfiguration analysis.
Prerequisites: networking-fundamentals-part1 (TCP/IP and ports) and nmap-service-discovery (identifying the web port and banner that this lesson then fingerprints further).
Estimated time: ten to twelve minutes.
When you are ready, send the Continue signal.