Confirm every Nikto hit by hand against a soft-404 server

short · 50 min · Objective 3.3

Task

Run a web server scanner against a lab server configured to return soft 404s, and confirm each hit by hand before it becomes a finding — because the scanner's false-positive rate is high by design and a server returning 200 for everything makes every check look like a hit.

Steps

  1. On the lab web server you own, configure a soft 404: a missing path returns 200 with a "not found" page. Plant one real finding — a backup file in the web root.
  2. From the attacker VM, run a web server scanner (nikto-style) and save output to /tmp/nikto.txt.
  3. Request a path you know does not exist and record the baseline response, so you can tell a real hit from a soft 404.
  4. For each reported hit, request it yourself, compare against the baseline, and mark it real or soft-404.
  5. Keep only the confirmed finding — the backup file — and establish its impact for this environment.
  6. Note that the scanner run is loud and self-identifying: it belongs in the activity log so the client's analysts can reconcile it.

Verify

grep -cE "^\+|OSVDB|/.*: " /tmp/nikto.txt
grep -ciE "\.bak|backup" /tmp/confirmed.md
grep -ciE "soft.?404|false|baseline" /tmp/confirmed.md

The first count is the scanner's raw hits — it will be inflated by the soft 404s. The second must be non-zero: you confirmed the real backup-file finding by hand. The third must be non-zero: you marked which reported hits were soft 404s, which is the whole discipline — the scanner narrows where to look, and you decide what is true. A run that skips the by-hand confirmation is a scanner export with a cover page.

Notes

Nikto checks the web server, not the application logic, and it is deliberately loud — not a stealth tool, and being blocked partway silently invalidates the rest of the run. Its curated database and your own wordlist find different things, so merge both. Every hit is confirmed by hand, checked against a soft 404, and given impact before it becomes a finding. The whole run targeted a server you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.