Nikto is a very popular open source web application security scanner. In this interview, Chris Sullo discusses his plans, views, and other tools.

How does Nikto's web application assessment compare to tools such as Nessus?

They are very complimentary, though they do overlap in some areas. I find that in pretty much every case, it's beneficial to run both tools against a site. I understand some places have a paranoia about Nessus running against their servers, while they don't have the same fear of running Nikto--perhaps because of Nessus' broad reach and DoS attacks (though in my experience, a properly built server and a reasonably configured Nessus policy almost never cause problems).

At CGI Security.

[ Read more ]