Nikto is a very popular open source web application security scanner. I emailed the author 'Chris Sullo' asking him about some of his plans, views, and other tool related questions.

How long has Nikto been in development and how many people are actively working on it?

Although I've had patches and updates from a couple of dozen people (a few of them regularly), I've been the sole developer of Nikto since it's release in December, 2001.

What are the three biggest challenges that you've faced while developing a web application security scanner from a developmental perspective?

The biggest challenge, from a technical perspective, is trying to test and fix bugs against against the huge variety of web servers in the wild. Even when decent bug reports come in, if I don't have access to a Joe-Bob 1.0 server, it's hard ensure the problem is resolved.

Time management and motivation are much bigger factors. Lets face it--open source is tough. On one hand you may have software in wide use, and on the other a lot of open source work is taken for granted by the people using it (and in some cases profiting from it)--this is the unfortunate, double-edged sword of open source!

If you could pick two things about Nikto to spend some time improving what would they be?

Perhaps not so much an improvement--rather an enhancement--but I would like to spend the time to make Nikto crawl a web site. Even without trying to recreate tools like WebInspect/Appscan/Paros, information gathered from a crawl could make scanning much more accurate and efficient.

I'd also like to revamp the plugin "architecture" (such as it is), to allow for easier writing of plugins, and automatic registration if they are dropped in the plugin directory.

What types of vulnerabilities does Nikto and other web application security scanners have difficulty finding?

Blind SQL injection testing is still pretty rough in most cases (I can't count the false-positives I've seen from automated testing tools). Also, AJAX is presenting problems for tools that don't work around the problem by having proxy capabilities.

How does Nikto's web application assessment compare to tools such as Nessus?

They are very complimentary, though they do overlap in some areas. I find that in pretty much every case, it's beneficial to run both tools against a site. I understand some places have a paranoia about Nessus running against their servers, while they don't have the same fear of running Nikto--perhaps because of Nessus' broad reach and DoS attacks (though in my experience, a properly built server and a reasonably configured Nessus policy almost never cause problems).

What are your plans for enhancing Nikto's reporting capabilities?

Version 2 contains a template-driven report format, which will allow users to customize HTML reports for their own needs. There is also an experimental knowledge base which should, when fully developed, allow someone to regenerate old reports, as well as do a quick re-check of a site to see if issues have been resolved.

Besides the cost factor how does Nikto compare to a commercial scanner?

Nikto, at the moment, doesn't do any crawling of the web site or checking for flaws in custom applications--this is by far the biggest difference. They also tend to have nice GUIs and reports with pretty graphs.

What plans do you have for Nikto and what should we be expecting from future releases?

The biggest change will be to have more robust checking for false-positive conditions by examining the server's setup more-closely, as well as being able to hard-code false-positive signatures directly in the scan database. Tests can still be easily written in CSV format, but will allow multiple conditions to prove or disprove the existence of a vulnerability, and will also be categorized so users can either include (or exclude) a whole class of vulnerabilities from a scan.

Besides your own, what other tools do you use to perform web based assessments?

Almost every situation requires a different toolset. I typically use a combination of commercial and open source tools, including Paros, Burp, AppScan, WebInspect, blindSQLiX, and of course Firefox (with a handful of add-ons).

Besides Nikto what other projects are you currently involved in?

I am a project leader and developer for the Open Source Vulnerability Database (OSVDB.org), which is a vulnerability database committed to providing a free, unbiased resource for security professionals. Everyone, (especially developers!!), should volunteer and help us out.

Is there anything else you'd like to add?

Given the media attention on big security incidents, viruses, and data theft, I am shocked at the number of companies still deploying insecure servers and applications. I don't expect every developer to understand subtle application attacks and be an expert in hacking techniques, but when their code doesn't contain any input filtering... well lets hope they move into management sooner rather than later!

Boxers or briefs?

Boxers FTW!