Nikto

Nikto (github.com/sullo/nikto, cirt.net) is an open-source web server scanner written in Perl. It tests web servers for thousands of dangerous files/CGIs, outdated server software, and version-specific vulnerabilities, and also performs checks on server configuration items such as the presence of multiple index files and installed HTTP methods. It doubles as a lightweight web enumeration tool during reconnaissance, complementing content brute-forcers like gobuster and wfuzz.

Nikto is not stealthy: it generates a large volume of requests and is easily detected by IDS/IPS and WAFs. It is also not a full exploit framework — it reports potential issues for follow-up verification with tools like nmap NSE scripts, burp-suite, or manual testing.

Basic usage

# Scan a host, save report as text
nikto -host $URL -Format txt -output report.txt
 
# Help and introspection
nikto -h              # short help
nikto -H              # long help (all options)
nikto -list-plugins   # list test plugins

Key options:

• -host / -port / -ssl — target selection
• -id user:pass — HTTP Basic Auth credentials for scanning behind password-protected areas (e.g. an Apache-.htaccess-protected directory or Tomcat /manager/html); pair with -nossl when the target is plain HTTP
• -Format — output format: csv, htm, json, sql, txt, xml (comma-separate for multiple)
• -o — output file
• -Tuning — select test categories (e.g. 4 injection, x reverse-tuning)
• -evasion — IDS evasion encoding techniques (random URI encoding, /./ self-reference, fake parameters, etc.)
• -Display — toggle output verbosity (redirects, cookies, 200s, auth-required URLs, progress)
• -Plugins — run only selected plugins
• -mutate — mutation techniques for files/dirs

Running from source or Docker

git clone https://github.com/sullo/nikto && cd nikto/program
./nikto.pl -h http://www.example.com
 
# Or via the official container
docker run --rm sullo/nikto -h http://www.example.com

Full documentation lives on the project wiki.

Related

• gobuster — directory/file brute-forcing to pair with Nikto’s known-file checks
• dirbuster — older GUI brute-forcer in the same niche
• tomcat-manager-war-upload — Nikto -id scans authenticated manager surfaces; WAR upload is the exploitation follow-through
• wfuzz — general-purpose web fuzzing
• owasp-zap — open-source DAST proxy with active scanning
• nmap — NSE http-* scripts overlap some Nikto checks

Sources

• GitHub — sullo/nikto
• Nikto — cirt.net
• Nikto Documentation Wiki