Nikto Scan Results: Which Finding Should the Administrator Investigate Next?
A security analyst reviews the following results of a Nikto scan:
Which of the following should the security administrator investigate next?
Community Insight
The question tests triage of raw Nikto output — ranking an exposed admin interface with default credentials above availability-only or informational findings — and the trap is treating the word 'DoS' on shtml.exe as more urgent than a full administrative takeover.
A Nikto web-server scan surfaces several candidate findings — a wiki instance, an exposed phpList install, a legacy FrontPage shtml.exe, and an sshome path — and the analyst must decide which one warrants investigation first. This page establishes that the phpList finding outranks the others because it exposes an administrative interface protected only by default credentials alongside documented remote administrative access.
Picking shtml.exe (C) because a denial-of-service exploit sounds severe, while overlooking that the phpList line describes a reachable admin interface using the shipped admin/phplist default login plus known pre-2.6.4 remote administrative access — a direct path to full application control.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Nikto's phpList entry is the only option that combines a live administrative interface with a shipped default credential (admin/phplist) and documented remote administrative access in versions prior to 2.6.4. That is an exploitable, high-impact condition: an attacker who logs in can harvest user data, alter mailing content, and pivot into the underlying host. Triage doctrine in vulnerability management ranks findings by exploitability times impact, and unauthorized administrative access scores at the top of that matrix. It is also the cheapest finding to confirm — a single request to the /phplist/admin path either produces a login prompt that accepts the default pair or does not. Investigating that first removes the largest amount of risk per unit of analyst time.Why the Other Options Are Wrong
Option A (tiki) is a wiki presence/version disclosure with an OSVDB-style reference; even if it hints at a URL-trick authentication bypass, the finding requires the specific vulnerable build to be running and the exploit path to be reachable, and the scan text does not confirm either. Option C (shtml.exe) describes a legacy FrontPage extension that can be crashed via a crafted DOS device request — an availability impact only, with no data exposure or privilege gain, and on many hosts the extension is not even installed. Option D (sshome) is an informational path/directory entry that names no exploitable vulnerability, so there is nothing concrete to chase. None of these three gives an attacker standing administrative rights the way the phpList line does.Community Comment Notes
The majority of learners landed on phpList: taketaa argued that the admin default login is decisive because unauthorized administration privileges beat "a possible DoS attack", and Popeyes_Chicken pointed out that the report itself says phpList "contains a number of vulnerabilities including remote administrative access". Paradox_Walnut defended C, reasoning that "shtml.exe being able to be exploited by an attacker to crash the FrontPage" is still a major vulnerability — a fair point, but an availability-only one. agfencer preferred A on the grounds that the tiki entry lets an attacker "circumvent the login screen"; that is a reasonable confidentiality argument, but the phpList finding also grants login bypass by simply using the documented default credentials, and it carries administrative access with it.Official Reference
Exam Strategy
When a question hands you raw scanner output, grade each line on exploitability and impact rather than on how alarming the wording sounds. Default or shipped credentials on an administrative interface always outrank doS-only, directory-listing, or version-banner entries, and the option that can be verified with one HTTP request is almost always the intended 'investigate next' answer.
Frequently Asked Questions
Why not investigate the shtml.exe FrontPage finding before phpList?
shtml.exe only enables a denial-of-service crash of FrontPage extensions, which affects availability. phpList exposes an admin login using default credentials, giving an attacker direct administrative control.
Does the tiki URL-trick authentication bypass outrank the phpList finding?
No. The tiki entry depends on a specific vulnerable build being reachable, while the phpList line already names a working default admin credential plus documented remote admin access.