# Nikto

> Use for web server misconfiguration review and broad HTTP hygiene checks during authorized pentests. Trigger on internet-facing web services, default content, risky headers, and server-side hardening gaps.

- Skill: `timsonner/nikto` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/nikto`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/nikto/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/nikto

---


# Nikto

## Purpose

Use this skill for quick web server and HTTP misconfiguration review after the web surface is confirmed.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to review default content, weak headers, and common HTTP misconfigurations.
- Need a quick breadth check before manual verification.
- Need a repeatable retest of server-side hygiene issues.

## Avoid When

- The target is highly sensitive to noisy checks.
- A reported issue would not be manually confirmed before escalation.

## Inputs

- Confirmed web targets
- Scope exclusions and rate expectations
- Output format needed for evidence handling

## Procedure

1. Run only against confirmed web assets.
2. Triage output into likely misconfigurations, informational noise, and duplicates.
3. Manually validate any material findings.
4. Tie confirmed issues to business impact and exposure.
5. Use the same scoped check set during retest.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Basic HTTP scan
nikto -h portal.contoso.com

# HTTPS scan
nikto -h portal.contoso.com -ssl

# Non-standard HTTPS port
nikto -h portal.contoso.com -port 8443 -ssl

# Output to HTML report
nikto -h portal.contoso.com -o contoso-nikto.html -Format htm

# Throttle requests to reduce noise
nikto -h portal.contoso.com -Pause 1

# Scan multiple hosts from file
nikto -h contoso-live.txt -o contoso-nikto-all.txt

# Scan through an authenticated session
nikto -h portal.contoso.com -id admin:<password>
```

## Evidence to Capture

- Confirmed web server hygiene gaps
- Default or administrative content exposed unexpectedly
- Retest deltas after remediation

## Safety Boundaries

- Treat output as a starting point, not a finished finding.
- Stop if the target shows instability or rate-sensitive behavior.