- Nikto v2.6.0
---------------------------------------------------------------------------
+ Your Nikto installation is out of date.
+ Target IP:          54.82.22.214
+ Target Hostname:    zero.webappsecurity.com
+ Target Port:        80
+ Platform:           Windows
+ Start Time:         2026-02-24 07:53:10 (GMT-5)
---------------------------------------------------------------------------
+ Server: Apache-Coyote/1.1
+ [999986] /: Retrieved access-control-allow-origin header: *.
+ No CGI Directories found (use '-C all' to force check all possible dirs). CGI tests skipped.
+ [999962] /: Server banner changed from 'Apache-Coyote/1.1' to 'Apache/2.2.6 (Win32) mod_ssl/2.2.6 OpenSSL/0.9.8e mod_jk/1.2.40'.
+ [013587] /: Suggested security header missing: content-security-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
+ [013587] /: Suggested security header missing: referrer-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
+ [013587] /: Suggested security header missing: strict-transport-security. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
+ [013587] /: Suggested security header missing: x-content-type-options. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
+ [013587] /: Suggested security header missing: permissions-policy. See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
+ [999990] OPTIONS: Allowed HTTP Methods: GET, HEAD, POST, PUT, DELETE, TRACE, OPTIONS, PATCH .
+ [400001] HTTP method ('Allow' Header): 'PUT' method could allow clients to save files on the web server.
+ [400000] HTTP method ('Allow' Header): 'DELETE' may allow clients to remove files on the web server.
+ [400004] HTTP method: 'PATCH' may allow client to issue patch commands to server. See RFC-5789.
+ [001406] /server-status: The mod_status module reveals Apache information. See: https://httpd.apache.org/docs/2.4/mod/mod_status.html
+ [999100] /readme.txt: Uncommon header(s) 'content-disposition' found, with contents: attachment; filename="readme.txt".
+ [001822] /readme.txt: This might be interesting.
+ [006230] /admin/index.html: Admin login page/section found.
+ [006332] /login.html: Admin login page/section found.
+ [006433] /: Apache HTTP Server 2.0.x and 2.2.x contain an XSS when JavaScript is used as the method. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6203
+ Scan terminated: 0 errors and 17 items reported on the remote host
+ End Time:           2026-02-24 07:54:11 (GMT-5) (61 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested