Nikto - No webserver found on x.x.x.x - using vhost and https #585
Comments
|
So the problem here is that the website isn't returning a sensible HTTP(s) result: This could be for a few reasons; SNI may be required, the server may be detecting depending on User-Agent, or it could be a bug. So the first thing I'd try is changing the user-agent, by using: If that doesn't work, could you try and add -D D to the command line which will dump the request and response hash; this may reveal the real error message. |
|
I second this. I found that Nikto had a similar error and despite changing the user agent the issue still persists. |
|
I am having this same issue. Using Nikto 2.1.6. The tool works fine on one server, but this issue on a different server. Same versions of Nikto. |
|
If i remember correctly the webapplication i was testing in my post above had no default virtualhost listening on all incoming hostnames. We also got trouble in this configuration to get our loadbalancer running, so we had to change it. So i can't test it at the moment. @bigj75024 Are you using the "-vhost" Flag? |
|
Okay, i tested the issue in my test enviroment and I can confirm the error occurs if i run nikto with the -vhost option against an https webservice running on IIS 8.5 if there is no default https listener. If i create a default listener for https on port 443 everything works fine. Edit: unencryptet http (port 80) works fine even without default listener. Maybe it has something todo with the different reply from the webserver if there are no default listener
Edit2: After a few tests it seems it could also have something todo with SNI (server name indication) if i remove the SNI option, even with no default vhost it works. It seems the (IIS) Webserver at least has to have one https listener without SNI.
|
|
Thank you for the reply. I was able to resolve my issue last night by
modifying the minprotocol value in the config file for openssl to negotiate
TLS1 instead of TLS1.2.
Thanks again!
…On Thu, Oct 10, 2019, 2:59 AM Towky ***@***.***> wrote:
Okay, i tested the issue in my test enviroment and I can confirm the error
occurs if i run nikto with the -vhost option against an https webservice
running on IIS 8.5 if there is no default https listener.
If i create a default listener for https on port 443 everything works fine.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#585?email_source=notifications&email_token=AHBVMHLLWQRSI25SJ7TULRLQN3OHBA5CNFSM4GPMUGQKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEA3JQJA#issuecomment-540448804>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AHBVMHMBGA3H5FZXNRYV5YDQN3OHBANCNFSM4GPMUGQA>
.
|
|
@bigj75024 |
|
Glad I could help. |
|
This is good info, thanks. I wonder how we can do this in the config and
pass through? I'll have to do some reading.
…On Thu, Dec 19, 2019 at 10:40 AM bigj75024 ***@***.***> wrote:
Glad I could help.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#585?email_source=notifications&email_token=AALICRBYL7G7BMLSF5KLD33QZOIXFA5CNFSM4GPMUGQKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEHKAA3Q#issuecomment-567541870>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AALICRDYBMQPR3RJAIJCWFLQZOIXFANCNFSM4GPMUGQA>
.
|
|
vhost have to before host root@kali:~# nikto -vhost host.domain.de -host https://10.0.0.90/9999/ |
|
I'm a windows user and when I run with administrator it worked fine, |
|
I was getting the
I resolved this by editing the following in Hopefully this helps someone else who stumbles across this post. Disclaimer I am working in a lab environment with VMs. Not a suggested fix for your normal OS. |
|
In my own case (on Kalinux) I had to install ssl support for perl as follows:
|
As mentioned in #250 (comment) i got the Message "No web server found on x.x.x.x"
Webserver configuration:
Microsoft Internet Information Service 8.5
1 binding: https on vhost "host.domain.de" port 443 on any ip-adress on the server (here: 10.0.0.90)
the certificate is issued by an internal pki (root certificate not trusted by the kali-linux mashine)
Verbose Output:
My first idea was, that the server isn't responding to the IP-Adress, because there is no explicit binding on the ip, just on the vhost.
But checking with curl, the server is responding with "HTTP 404".
Maybe it has something todo with https and the untrusted certificate?
Testing the connection with curl:
**IP-Adresses and DNS/vhost name changed
The text was updated successfully, but these errors were encountered: