Add Nikto boefje that scans for outdated software

[Souf149]

Changes

Added a Nikto boefje written in javascript and a normalizer that scans/reports webservers for outdated software.

This boefje also makes use of #3383 to create a finding without having to create a new normalizer. (which could be removed since a normalizer also gets added with this pr)

Demo

QA notes

After enabling the Nikto boefje and normalizer, create an IPAddress or Hostname of a website and give it a clearance level of 3 or higher.
After doing this a new task should be created which will scan for outdated software.
(When adding a hostname with the name cynalytics.nl you should get a finding of an outdated software.)

---

Code Checklist

• All the commits in this PR are properly PGP-signed and verified.
• This PR only contains functionality relevant to the issue.
• I have written unit tests for the changes or fixes I made.
• I have checked the documentation and made changes where necessary.
• I have performed a self-review of my code and refactored it to the best of my abilities.

• Tickets have been created for newly discovered issues.
• For any non-trivial functionality, I have added integration and/or end-to-end tests.
• I have informed others of any required .env changes files if required and changed the .env-dist accordingly.
• I have included comments in the code to elaborate on what is not self-evident from the code itself, including references to issues and discussions online, or implicit behavior of an interface.

---

Checklist for code reviewers:

• The code does not violate Model-View-Template and our other architectural principles.
• The code prioritizes readability over performance where appropriate.
• The code does not bypass authentication or security mechanisms.
• The code does not introduce any dependency on a library that has not been properly vetted.
• The code contains docstrings, comments, and documentation where needed.

---

Checklist for QA:

• I have checked out this branch, and successfully ran a fresh make reset.
• I confirmed that there are no unintended functional regressions in this branch:
  • I have managed to pass the onboarding flow
  • Objects and Findings are created properly
  • Tasks are created and completed properly
• I confirmed that the PR's advertised feature or hotfix works as intended.
• I checked the logs for errors and/or warnings and made issues where necessary

What works:

• bullet point + screenshot (if useful) per tested functionality

What doesn't work:

• bullet point + screenshot (if useful) per tested functionality

Bug or feature?:

• bullet point + screenshot (if useful) if it is unclear whether something is a bug or an intended feature.

[underdarknl]

I think it makes more sense to start Nikto on Ipports that we know are talking http/https.
This way we avoid nikto on services that are not webservers, or even better:

It looks like there's also a way to differentiate between different hostnames on the same IP, so scanning on websites could also make sense as that would provide the best data-set including any differences between ipv4 and ipv6 addresses or the same host. Use the cli argument -host+ for this combined with -nolookup to make sure we connect only to the ip and -port we provide with the hostname we want.

[Souf149]

I have looked more into it and think using the OOI HostnameHTTPURL would be perfect. It has a hostname, port, and scheme which has everything. I was not able to find information from IpPort whether it was a webserver or not (unless you meant looking at the port's number).

-h+ is supposed to be an alias for -host+ although this is not specified in nikto's wiki. I will make sure to use -nolookup.

[Souf149]

The boefje now makes use of HostnameHTTPURL which tells the boefje whether its HTTP or HTTPS and contains a hostname as well.

In theory IPAddressHTTPURL could also be used, I plan to add this once the boefje is satisfactory.

In the current example -nolookup does not get used because I make use of the hostname.

[ammar92]

Looks good in general. Just a suggestion about the variables

[ammar92]

Perhaps you could use the HTTP_PROXY (and optionally HTTPS_PROXY) for this? This is a common proxy URI configuration. This will save a few variables and make the form less complex (given that it has a good example, e.g. http://user:[email protected]:3128/

[Souf149]

These are config variables required for Nikto. If we would make the boefje's schema less complex, then it would move the complexity to the code of the boefje.

I believe since the user chooses to activate the Nikto boefje, they would know that Nikto requires these variables which would make them self-explaining.

[ammar92]

See earlier remark