Gavin owns a white-hat firm and is performing a website security audit for one of his clients. He begins by running a scan which looks for common misconfigurations and outdated software versions…

Question

Options

• ANikto
• BNmap
• CMetasploit
• DArmitage

• A
  88% (30)
• B
  3% (1)
• C
  6% (2)
• D
  3% (1)

Explanation

Explanation

Nikto is a web server scanner specifically designed to detect common misconfigurations, outdated software versions, dangerous files, and known vulnerabilities in web applications, making it the perfect tool for a website security audit of this nature. Nmap (B) is incorrect because it is primarily a network discovery and port scanning tool used to map network topology and identify open ports/services, not web-specific misconfigurations. Metasploit (C) is a full exploitation framework used to actively exploit known vulnerabilities, which goes beyond simple auditing and scanning. Armitage (D) is simply a graphical user interface (GUI) built on top of Metasploit, making it equally unsuitable for a passive web misconfiguration scan.

Memory Tip: Think of the name "Nikto" as "Nit-pick-to" - it nit-picks through web servers looking for every little misconfiguration and outdated component, just like a thorough auditor would. If the question mentions web server scanning + misconfigurations + outdated software, Nikto is your answer.

No community discussion yet for this question.