CKTricky over at http://cktricky.blogspot.com has been running an awesome Burp Tip of the Day series on his blog. After seeing him use Nikto through Burp. I decided to see if I could just export the list of checks to a text file so that I could use them over and over in Intruder. After a bit of awk and sed hell I figured it out, and submited it to him for acceptance to his BTotD series. Yesterday it was posted ;–)

Here: http://cktricky.blogspot.com/2009/10/btod-importing-nikto-db-to-intruder.html

Here is the ugly command I came up with:

• cat /pentest/web/nikto/plugins/db_tests | awk -F "," '{print $4}' | sed 's/^"*//;s/"$//' | sed 's/^@CGIDIRS//;s/@ADMIN//;s/^@NUKE//;s/^@POSTNUKE//;s/^@PHPMYADMIN//' | sed 's/^///' > ~/nikto_burp.txt1

What you are sacrificing here are the checks for the CGIDIRS, ADMIN, NUKE, POSTNUKE, and PHPMYADMIN interfaces. Personally, I’ve modified this script a bit, but you can modify it how best fits your tests:

• cat /pentest/web/nikto/plugins/db_tests | awk -F "," '{print $4}' | sed 's/^"*//;s/"$//' | sed 's/^@CGIDIRS/cgi-bin//;s/@ADMIN//;s/^@NUKE//;s/^@POSTNUKE//;s/^@PHPMYADMIN/phpMyAdmin//' | sed 's/^///' > ~/nikto_burp.txt

So that I could cover at least the most common cgi and phpmyadmin directories