Nikto, como esse negócio funciona?

[IgorM0L]

Olá.
Estou usando um servidor em casa e para ver se ele esta seguro rodei o nikto, aquele scanner de vulnerabilidade. Agora que queria saber como ele funciona, tipo, como vejo o que é vulnerabilidade ou não.

Vejam:

igormol@igormol-desktop:~$ nikto -h panoramaespirita.com.br
---------------------------------------------------------------------------
- Nikto 1.35/1.35     -     www.cirt.net
+ Target IP:       74.53.90.114
+ Target Hostname: panoramaespirita.com.br
+ Target Port:     80
+ Start Time:      Sun Jul 22 23:47:59 2007
---------------------------------------------------------------------------
- Scan is dependent on "Server" string which can be faked, use -g to override
+ Server: Apache/1.3.37 (Unix) mod_jk/1.2.14 mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 PHP/4.4.6 FrontPage/5.0.2.2635.SR1.2 mod_ssl/2.8.28 OpenSSL/0.9.7a
- Retrieved X-Powered-By header: PHP/4.4.6
+ /robots.txt - contains 12 'disallow' entries which should be manually viewed (added to mutation file lists) (GET).
+ PHP/4.4.6 appears to be outdated (current is at least 5.0.3)
+ Apache/1.3.37 appears to be outdated (current is at least Apache/2.0.54). Apache 1.3.33 is still maintained and considered secure.
+ PHP/4.4.6 appears to be outdated (current is at least 5.0.3)
+ FrontPage/5.0.2.2635.SR1.2 appears to be outdated (current is at least 5.0.4.3) (may depend on server version)
+ OpenSSL/0.9.7a appears to be outdated (current is at least 0.9.7e) (may depend on server version)
+ mod_ssl/2.8.2 - mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell (difficult to exploit). CAN-2002-0082.
+ FrontPage - http://www.insecure.org/sploits/Microsoft.frontpage.insecurities.html
+ /~root - Enumeration of users is possible by requesting ~username (responds with Forbidden for real users, not found for non-existent users) (GET).
+ /icons/ - Directory indexing is enabled, it should only be enabled for specific directories (if required). If indexing is not used all, the /icons directory should be removed. (GET)
+ /manual/images/ - Apache 2.0 directory indexing is enabled, it should only be enabled for specific directories (if required). Apache's manual should be removed and directory indexing disabled. (GET)
+ /cgi-sys/Count.cgi - This may allow attackers to execute arbitrary commands on the server (GET)
+ /cgi-sys/formmail.pl - Many versions of FormMail have remote vulnerabilities, including file access, information disclosure and email abuse. FormMail access should be restricted as much as possible or a more secure solution found. (GET)
+ /cgi-sys/guestbook.cgi - May allow attackers to execute commands as the web daemon. (GET)