Nikto
Web server vulnerability and misconfiguration scanner.
Quick Start
nikto -h http://target.com
nikto -h https://target.com -ssl
nikto -h target.com -p 8443 -o nikto.txt -Format txt
Core Flags
| Flag |
Purpose |
-h <host> |
Target host/URL |
-p <port> |
Port (default 80/443) |
-ssl |
Force SSL |
-id <user:pass> |
HTTP basic auth |
-useproxy <proxy> |
Route through proxy (e.g., 127.0.0.1:8080) |
-Tuning <n> |
Scan tuning bitmask (see below) |
-Plugins <list> |
Run specific plugins |
-evasion <n> |
IDS evasion technique (see below) |
-timeout <n> |
Timeout per request (default 10s) |
-pause <n> |
Pause between requests (stealth) |
-maxtime <n> |
Max scan time in seconds |
-o <file> |
Output file |
-Format <fmt> |
csv / txt / xml / html / json |
-C all |
Check all CGI dirs |
-nossl |
Disable SSL |
-no404 |
Disable 404 guess detection |
-followredirects |
Follow HTTP redirects |
-mutate <n> |
Guess additional file names |
-update |
Update plugins/databases |
Tuning Values
Combine with + or - to include/exclude:
| Value |
Meaning |
0 |
File upload |
1 |
Interesting files / seen in logs |
2 |
Misconfiguration / default files |
3 |
Information disclosure |
4 |
Injection (XSS/Script) |
5 |
Remote file retrieval — inside web root |
6 |
Denial of service |
7 |
Remote file retrieval — server-wide |
8 |
Command execution / remote shell |
9 |
SQL injection |
a |
Authentication bypass |
b |
Software identification |
c |
Remote source inclusion |
x |
Reverse tuning (exclude selected) |
# Most useful combo: misconfigs + info disclosure + SQLi + XSS
nikto -h http://target.com -Tuning 234489a
# Aggressive: all checks
nikto -h http://target.com -Tuning 0123456789abc
# Skip DoS (safe for production):
nikto -h http://target.com -Tuning x6
IDS Evasion Techniques
| Value |
Technique |
1 |
Random URI encoding |
2 |
Directory self-reference (/./) |
3 |
Premature URL ending |
4 |
Prepend long random string |
5 |
Fake parameter |
6 |
TAB as request spacer |
7 |
Random case sensitivity |
8 |
Use Windows directory separator () |
A |
Use carriage return as spacer |
B |
Use binary value 0x0b as spacer |
nikto -h http://target.com -evasion 1,2,3,7
Common Workflows
# Quick recon (most useful findings)
nikto -h http://target.com -Tuning 23b
# HTTPS with self-signed cert
nikto -h https://target.com -ssl -nointeractive
# Through Burp proxy (capture for manual review)
nikto -h http://target.com -useproxy http://127.0.0.1:8080
# Scan with basic auth
nikto -h http://target.com -id admin:password
# Scan with custom header (session cookie)
nikto -h http://target.com -C all \
-H "Cookie: session=abc123"
# Scan multiple hosts from file
nikto -h hosts.txt -o results.csv -Format csv
# Save HTML report
nikto -h http://target.com -o report.html -Format html
# Quiet mode for clean output
nikto -h http://target.com -Display V
# Target non-standard port
nikto -h target.com -p 8080,8443,8888
Display Options
| Value |
Output |
1 |
Show redirects |
2 |
Show cookies received |
3 |
Show all 200 responses |
4 |
Show URLs requiring auth |
D |
Debug output |
E |
Display all HTTP errors |
P |
Print progress to STDOUT |
V |
Verbose output |
nikto -h http://target.com -Display 12
Output Parsing
# Extract only findings (exclude info lines)
nikto -h http://target.com -Format csv | grep -v "^#\|^-" | column -t -s ','
# Combine with httpx for batch scanning
httpx -l hosts.txt -silent | xargs -P5 -I{} nikto -h {} -Tuning 23b -o {}_nikto.txt
Resources
| File |
When to load |
references/plugins.md |
Plugin list, authentication bypass techniques, custom checks |
AeonDave