What type of vulnerabilities can Nikto identify on web servers?

• A. Configuration of firewall rules.
• B. Wireless encryption vulnerabilities.
• C. Dangerous files, outdated software, and potential security issues on web servers.
• D. Weak password policy checks.

Answer: (C)

Nikto scans web servers to identify dangerous files, outdated software, and other potential security issues. It analyzes how the server responds to a variety of probes and compares those responses against a database of known problems, flagging things like backup or configuration files left exposed, default or insecure CGI/scripts, outdated software versions, and common misconfigurations such as directory listings or insecure HTTP methods. This focus on web server surface area is exactly what makes it the best fit for identifying vulnerabilities on web servers. It doesn’t assess network firewall rules, wireless encryption, or general password policy checks, which are outside the scope of web server vulnerability assessment.