aeondave/nikto

Nikto

Web server vulnerability and misconfiguration scanner.

Quick Start

nikto -h http://target.com
nikto -h https://target.com -ssl
nikto -h target.com -p 8443 -o nikto.txt -Format txt

Core Flags

| Flag | Purpose | |------|---------| | -h <host> | Target host/URL | | -p <port> | Port (default 80/443) | | -ssl | Force SSL | | -id <user:pass> | HTTP basic auth | | -useproxy <proxy> | Route through proxy (e.g., 127.0.0.1:8080) | | -Tuning <n> | Scan tuning bitmask (see below) | | -Plugins <list> | Run specific plugins | | -evasion <n> | IDS evasion technique (see below) | | -timeout <n> | Timeout per request (default 10s) | | -pause <n> | Pause between requests (stealth) | | -maxtime <n> | Max scan time in seconds | | -o <file> | Output file | | -Format <fmt> | csv / txt / xml / html / json | | -C all | Check all CGI dirs | | -nossl | Disable SSL | | -no404 | Disable 404 guess detection | | -followredirects | Follow HTTP redirects | | -mutate <n> | Guess additional file names | | -update | Update plugins/databases |

Tuning Values

Combine with + or - to include/exclude:

| Value | Meaning | |-------|---------| | 0 | File upload | | 1 | Interesting files / seen in logs | | 2 | Misconfiguration / default files | | 3 | Information disclosure | | 4 | Injection (XSS/Script) | | 5 | Remote file retrieval — inside web root | | 6 | Denial of service | | 7 | Remote file retrieval — server-wide | | 8 | Command execution / remote shell | | 9 | SQL injection | | a | Authentication bypass | | b | Software identification | | c | Remote source inclusion | | x | Reverse tuning (exclude selected) |

# Most useful combo: misconfigs + info disclosure + SQLi + XSS
nikto -h http://target.com -Tuning 234489a

# Aggressive: all checks
nikto -h http://target.com -Tuning 0123456789abc

# Skip DoS (safe for production):
nikto -h http://target.com -Tuning x6

IDS Evasion Techniques

| Value | Technique | |-------|-----------| | 1 | Random URI encoding | | 2 | Directory self-reference (/./) | | 3 | Premature URL ending | | 4 | Prepend long random string | | 5 | Fake parameter | | 6 | TAB as request spacer | | 7 | Random case sensitivity | | 8 | Use Windows directory separator () | | A | Use carriage return as spacer | | B | Use binary value 0x0b as spacer |

nikto -h http://target.com -evasion 1,2,3,7

Common Workflows

# Quick recon (most useful findings)
nikto -h http://target.com -Tuning 23b

# HTTPS with self-signed cert
nikto -h https://target.com -ssl -nointeractive

# Through Burp proxy (capture for manual review)
nikto -h http://target.com -useproxy http://127.0.0.1:8080

# Scan with basic auth
nikto -h http://target.com -id admin:password

# Scan with custom header (session cookie)
nikto -h http://target.com -C all \
    -H "Cookie: session=abc123"

# Scan multiple hosts from file
nikto -h hosts.txt -o results.csv -Format csv

# Save HTML report
nikto -h http://target.com -o report.html -Format html

# Quiet mode for clean output
nikto -h http://target.com -Display V

# Target non-standard port
nikto -h target.com -p 8080,8443,8888

Display Options

| Value | Output | |-------|--------| | 1 | Show redirects | | 2 | Show cookies received | | 3 | Show all 200 responses | | 4 | Show URLs requiring auth | | D | Debug output | | E | Display all HTTP errors | | P | Print progress to STDOUT | | V | Verbose output |

nikto -h http://target.com -Display 12

Output Parsing

# Extract only findings (exclude info lines)
nikto -h http://target.com -Format csv | grep -v "^#\|^-" | column -t -s ','

# Combine with httpx for batch scanning
httpx -l hosts.txt -silent | xargs -P5 -I{} nikto -h {} -Tuning 23b -o {}_nikto.txt

Resources

| File | When to load | |------|--------------| | references/plugins.md | Plugin list, authentication bypass techniques, custom checks |