Nikto: Web Server Vulnerability Scanner Guide

Overview

Nikto is a Perl-based open-source web server scanner originally created by Chris Sullo. It performs thorough tests against web servers, checking for over 6,700 potentially dangerous files and programs, outdated server versions, and version-specific problems across more than 1,250 servers. Nikto also checks for server configuration issues such as the presence of multiple index files and various HTTP server options.

Key capabilities of Nikto include:

• Detection of outdated server software and components
• Identification of dangerous files and CGIs on the server
• SSL/TLS certificate and cipher analysis
• Checking for server misconfigurations and default installations
• HTTP method testing (PUT, DELETE, TRACE, etc.)
• Subdomain guessing via DNS and virtual host enumeration
• Plugin-based architecture for extensibility
• Multiple output format support for reporting and integration

Unlike stealthier tools, Nikto is designed for speed and thoroughness rather than evasion. It generates significant traffic and log entries on the target server, making it straightforward for administrators to detect. This is intentional -- Nikto is meant for authorized security assessments where stealth is not a concern.

Installation

Nikto is available through most package managers and can also be installed from source. It requires Perl (5.8 or later) and several Perl modules. On Kali Linux and other security-focused distributions, Nikto is often pre-installed.

Install on Debian/Ubuntu

# Install from the default repository
sudo apt update
sudo apt install nikto

# Verify installation
nikto -Version

# Update the vulnerability database
nikto -update

Install on macOS

# Install via Homebrew
brew install nikto

# Verify installation
nikto -Version

Install from Source

# Clone the repository
git clone https://github.com/sullo/nikto.git

# Navigate to the program directory
cd nikto/program

# Run Nikto directly
perl nikto.pl -h localhost

# Optionally create a symlink for system-wide access
sudo ln -s $(pwd)/nikto.pl /usr/local/bin/nikto

Basic Scanning

Nikto scanning begins with a target host. The scanner will automatically enumerate web server details, check for common vulnerabilities, and report its findings. Even a basic scan provides valuable information about the target web server.

Simple Host Scan

The most basic usage targets a single host on the default HTTP port (80):

# Scan a target host on the default port
nikto -h http://192.168.1.100

# Scan using a hostname
nikto -h www.example.com

# Scan with increased verbosity
nikto -h www.example.com -Display V

Nikto will automatically identify the web server software, test for common vulnerabilities, and check for dangerous files. A typical scan output includes the server banner, detected technologies, and a list of findings with OSVDB references.

SSL/TLS Scanning

For HTTPS-enabled servers, Nikto can perform SSL/TLS analysis alongside vulnerability scanning:

# Scan an HTTPS host
nikto -h https://www.example.com

# Force SSL mode on a specific port
nikto -h 192.168.1.100 -p 443 -ssl

# Scan HTTPS and check SSL certificate details
nikto -h https://www.example.com -ssl

SSL scanning checks for weak ciphers, expired certificates, and known SSL/TLS vulnerabilities such as POODLE, BEAST, and Heartbleed. This is critical for assessing the transport-layer security posture of web applications.

Scanning Specific Ports

Web servers often run on non-standard ports. Nikto can target any port or scan multiple ports:

# Scan a specific port
nikto -h 192.168.1.100 -p 8080

# Scan multiple ports
nikto -h 192.168.1.100 -p 80,443,8080,8443

# Scan a range of ports
nikto -h 192.168.1.100 -p 8000-8100

Scanning Multiple Hosts

You can scan multiple targets by providing a file containing host addresses:

# Create a hosts file (one host per line)
# hosts.txt:
# 192.168.1.100
# 192.168.1.101:8080
# https://www.example.com

# Scan all hosts from the file
nikto -h hosts.txt

# You can also pipe Nmap results into Nikto
nmap -p80,443 192.168.1.0/24 -oG - | nikto -h -

Advanced Scanning

Nikto provides extensive options for customizing scans. Tuning parameters, authentication support, proxy configuration, and evasion techniques allow you to tailor scans to specific testing scenarios.

Tuning Options

Tuning options control which types of tests Nikto performs. You can focus on specific vulnerability categories to reduce scan time or target particular areas of concern:

# Scan for XSS and SQL injection only
nikto -h http://192.168.1.100 -Tuning 49

# Scan for everything except denial of service
nikto -h http://192.168.1.100 -Tuning x6

# Scan for misconfigurations and information disclosure
nikto -h http://192.168.1.100 -Tuning 23

# Focus on authentication bypass and command execution
nikto -h http://192.168.1.100 -Tuning a8

Authentication

Many web applications require authentication. Nikto supports Basic and NTLM authentication, as well as cookie-based session management:

# Basic authentication
nikto -h http://192.168.1.100 -id admin:password123

# NTLM authentication (domain\user:password)
nikto -h http://192.168.1.100 -id "DOMAIN\\user:password"

# Use a session cookie for authenticated scanning
nikto -h http://192.168.1.100 -cookie "PHPSESSID=abc123; auth=true"

# Scan a specific path requiring authentication
nikto -h http://192.168.1.100/admin -id admin:password123

Proxy Usage

Routing Nikto traffic through a proxy is useful for traffic inspection or when testing through a network boundary:

# Route traffic through an HTTP proxy
nikto -h http://192.168.1.100 -useproxy http://127.0.0.1:8080

# Use a proxy with authentication
nikto -h http://192.168.1.100 -useproxy http://proxyuser:proxypass@proxy.example.com:3128

# Route through Burp Suite for detailed request analysis
nikto -h http://192.168.1.100 -useproxy http://127.0.0.1:8080

Routing Nikto through Burp Suite or OWASP ZAP is a common workflow. This lets you inspect each request and response in detail, modify and replay requests, and use the proxy tool for further manual testing on any interesting findings.

Evasion Techniques

Nikto includes several IDS evasion techniques that modify requests to bypass simple signature-based detection systems. Note that these are primarily useful for testing IDS/IPS effectiveness rather than for hiding your scans:

# Use random URI encoding
nikto -h http://192.168.1.100 -evasion 1

# Combine multiple evasion techniques
nikto -h http://192.168.1.100 -evasion 1234

# Combine evasion with tuning for a targeted scan
nikto -h http://192.168.1.100 -evasion 17 -Tuning 49

Output Formats

Nikto supports several output formats for different use cases. Reports can be generated during the scan and are essential for documentation, compliance, and integration with other tools.

HTML Report

HTML reports are ideal for sharing findings with stakeholders and management:

# Generate an HTML report
nikto -h http://192.168.1.100 -o report.html -Format htm

# HTML report with full details
nikto -h http://192.168.1.100 -o report.html -Format htm -Display V

CSV Output

CSV output is useful for importing results into spreadsheets or databases for further analysis:

# Generate a CSV report
nikto -h http://192.168.1.100 -o findings.csv -Format csv

XML Output

XML output integrates well with other security tools and automated processing pipelines:

# Generate an XML report
nikto -h http://192.168.1.100 -o results.xml -Format xml

JSON Output

JSON output is the most flexible format for programmatic consumption and modern toolchains:

# Generate a JSON report
nikto -h http://192.168.1.100 -o results.json -Format json

# Combine JSON output with jq for filtering
nikto -h http://192.168.1.100 -o results.json -Format json && \
  cat results.json | jq '.vulnerabilities[] | select(.severity == "High")'

Practical Examples

The following examples demonstrate real-world usage patterns for common security assessment scenarios.

CMS Vulnerability Scanning

Content management systems like WordPress, Joomla, and Drupal have known vulnerability patterns. Nikto can identify CMS installations and check for common weaknesses:

# Scan a WordPress site for known issues
nikto -h http://192.168.1.100/wordpress -Tuning 12349 -Plugins "apache;cgi;outdated"

# Check for default CMS files and admin panels
nikto -h http://192.168.1.100 -Tuning 2b

# Comprehensive CMS scan with HTML report
nikto -h http://192.168.1.100 \
  -Tuning 1234ab \
  -o cms-report.html -Format htm \
  -Display V

# Use mutations to discover hidden CMS paths
nikto -h http://192.168.1.100 -mutate 1 -mutate 3

API Endpoint Testing

While Nikto is primarily a web server scanner, it can be used to test API servers for common misconfigurations and security issues:

# Scan an API server on a non-standard port
nikto -h http://api.example.com:3000 -Tuning 2389

# Test with custom headers (e.g., API versioning)
nikto -h http://api.example.com \
  -Tuning 389 \
  -cookie "Authorization: Bearer eyJhbGciOi..."

# Scan an API behind a reverse proxy
nikto -h http://api.example.com \
  -vhost api.internal.example.com \
  -Tuning 238

# Check for exposed API documentation and debug endpoints
nikto -h http://api.example.com -Tuning 13 -mutate 1

CI/CD Integration

Nikto can be integrated into continuous integration pipelines to automatically scan deployments for security regressions. Below is an example using a Bash wrapper script and a GitHub Actions workflow:

#!/bin/bash
# nikto-ci-scan.sh - CI/CD integration script for Nikto
set -euo pipefail

TARGET_URL="${1:?Usage: $0 <target-url>}"
REPORT_DIR="./security-reports"
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
REPORT_FILE="${REPORT_DIR}/nikto-${TIMESTAMP}.json"

mkdir -p "${REPORT_DIR}"

echo "Starting Nikto scan against ${TARGET_URL}..."
nikto -h "${TARGET_URL}" \
  -Tuning 1234589ab \
  -o "${REPORT_FILE}" -Format json \
  -maxtime 600 \
  -nointeractive \
  -Display P

# Check for critical findings
CRITICAL_COUNT=$(cat "${REPORT_FILE}" | grep -c '"OSVDB-' || true)

echo "Scan complete. Found ${CRITICAL_COUNT} potential issues."
echo "Report saved to ${REPORT_FILE}"

# Fail the pipeline if critical issues are found
if [ "${CRITICAL_COUNT}" -gt 0 ]; then
  echo "WARNING: Security issues detected. Review the report."
  exit 1
fi

# Example GitHub Actions workflow step
# .github/workflows/security-scan.yml
#
# - name: Run Nikto scan
#   run: |
#     docker run --rm \
#       -v ${{ github.workspace }}/reports:/reports \
#       secfigo/nikto:latest \
#       -h https://staging.example.com \
#       -Tuning 12349 \
#       -o /reports/nikto-results.json -Format json \
#       -maxtime 300
#
# - name: Upload scan results
#   uses: actions/upload-artifact@v4
#   with:
#     name: nikto-report
#     path: reports/nikto-results.json

Options Reference

The following table summarizes the most commonly used Nikto command-line options:

Tips & Best Practices

Follow these guidelines to get the most effective and responsible results from Nikto scanning:

• Always update before scanning -- Run nikto -update before starting any assessment to ensure you have the latest vulnerability signatures and plugins.
• Use tuning to reduce noise -- Running all tests against every target generates excessive output. Use -Tuning to focus on relevant vulnerability categories for the specific application under test.
• Set time limits -- Use -maxtime to prevent scans from running indefinitely, especially in automated pipelines or when scanning large applications.
• Combine with other tools -- Nikto excels at known vulnerability detection but should be part of a broader testing methodology. Use it alongside Nmap for discovery, Burp Suite for manual testing, and sqlmap for SQL injection validation.
• Save reports in multiple formats -- Generate both human-readable (HTML) and machine-parseable (JSON/XML) reports. HTML reports are useful for stakeholder communication, while JSON/XML integrates with vulnerability management platforms.
• Use the Pause option for stability -- When scanning production-adjacent environments, use -Pause to add delays between requests and reduce the load on the target server.
• Verify findings manually -- Nikto can produce false positives. Always verify critical findings manually before including them in a final report. Use a proxy like Burp Suite to replay and inspect individual requests.
• Check for custom 404 pages -- Sites with custom error pages may cause false positives. Use -no404 to disable 404 guessing if you encounter excessive false results, or review the 404 detection behavior at the start of the scan.
• Scan authenticated and unauthenticated -- Run scans both with and without credentials to understand the attack surface from different perspectives. Authenticated scans reveal vulnerabilities that are only accessible after login.
• Document your scope -- Before starting any scan, clearly document the scope, targets, timing, and authorization. This protects both you and the organization being tested.

Related Tools

Nikto works well alongside other security tools in a comprehensive assessment workflow:

• Nmap -- Use Nmap for initial network discovery and port scanning before running Nikto against discovered web servers. Nmap can directly feed targets to Nikto.
• Burp Suite -- Route Nikto traffic through Burp Suite for detailed request/response analysis. Use Burp for manual testing of findings discovered by Nikto.
• sqlmap -- When Nikto identifies potential SQL injection points, use sqlmap for thorough SQL injection testing and exploitation.
• OWASP ZAP -- An alternative web application scanner that provides both automated and manual testing capabilities. ZAP offers a more modern interface and active community support.
• WPScan -- For WordPress-specific vulnerability scanning, WPScan provides deeper coverage than Nikto for WordPress themes, plugins, and core vulnerabilities.
• Metasploit -- After identifying vulnerabilities with Nikto, use Metasploit to validate exploitability and demonstrate impact during penetration testing engagements.