tools

Overview

Nikto is an open-source web server scanner that checks targets for over 6,700 potentially dangerous files, outdated server software, version-specific problems, and common misconfigurations. It performs both passive fingerprinting (reading headers and banners) and active probing (requesting known paths). Nikto is primarily a vulnerability assessment tool but is also widely used in the fingerprinting phase of web reconnaissance to identify server software versions, installed CMS platforms, and exposed sensitive files quickly.

Target / Context

Web servers and web applications. Useful during both fingerprinting and initial vulnerability assessment. Works against HTTP and HTTPS targets; supports virtual host scanning.

Installation

ℹ︎Installation Commands: 
# Kali / Debian (pre-packaged):
sudo apt install nikto -y

# From source:
sudo apt update && sudo apt install -y perl
git clone https://github.com/sullo/nikto
cd nikto/program
chmod +x ./nikto.pl

Basic Usage

ℹ︎Basic Usage: 
nikto -h <target>
nikto -h https://example.com
nikto -h 10.10.10.1 -p 8080

Flags & Options

ℹ︎Flags & Options:
FlagDescriptionExample
-hTarget host (IP, hostname, or URL)-h https://example.com
-pPort to scan (default 80/443)-p 8080
-sslForce SSL/HTTPS-ssl
-vhostScan a specific virtual host-vhost admin.example.com
-TuningLimit scan to specific check categories (see table below)-Tuning b
-oOutput file-o results.txt
-FormatOutput format (txt, csv, htm, xml, json)-Format json
-nointeractiveSuppress prompts (useful in scripts)-nointeractive
-evasionApply IDS/WAF evasion techniques (1–9)-evasion 1
-useproxyRoute through a proxy-useproxy http://127.0.0.1:8080
-timeoutRequest timeout in seconds-timeout 10
-updateUpdate the Nikto plugin database-update

Tuning Codes

CodeCategory
0File upload vulnerabilities
1Interesting file discovery
2Misconfiguration checks
3Information disclosure
4Injection tests (XSS, SQL, etc.)
5Remote file retrieval
6Denial of service tests
7Remote access tests
8Command execution tests
9SQL injection
aAuthentication bypass
bSoftware identification (fingerprinting only)
cRemote source inclusion
xReverse tuning — exclude the specified type

Common Use Cases

Full Scan Against a Web Server

ℹ︎Commands: 
nikto -h https://example.com

— Runs all checks; output includes identified server software, risky files, outdated software, and misconfigurations.

Fingerprinting Only (Software Identification)

ℹ︎Commands: 
nikto -h example.com -Tuning b

— Limits the scan to software identification checks only. Useful when fingerprinting without triggering noisy vulnerability probes.

HTTPS Target on Non-Standard Port

ℹ︎Commands: 
nikto -h 10.10.10.1 -p 8443 -ssl

Virtual Host Scanning

ℹ︎Commands: 
nikto -h 10.10.10.1 -vhost admin.example.com

— Sends Host: admin.example.com with all requests. Required when the target IP hosts multiple virtual hosts and you want to scan a specific one.

Save Output for Reporting

ℹ︎Commands: 
nikto -h https://example.com -o nikto-results.html -Format htm

References / Images