Nikto Web Vulnerability Scanner: Comprehensive Guide

Abdul Wahab Junaid

1 year ago

Nikto Web Vulnerability Scanner: Comprehensive Guide

Nikto is an open-source web server scanner written in Perl by Chris Sullo (CIRT.net). It performs comprehensive tests against web servers for thousands of known-dangerous files/CGIs, outdated server software versions, and other server-level misconfigurations. Nikto checks over 6,700 potentially dangerous files/programs, version-specific issues on over 1,250 servers, and version-specific problems across many server types. It is not stealthy — it is designed for speed and thoroughness rather than evasion — making it best suited for authorized assessments where noise is not a concern.

How to Install

Pre-installed on Kali Linux. To verify or reinstall:

which nikto
sudo apt update
sudo apt install nikto -y
nikto -Version

Install from source (GitHub) for the latest plugins:

git clone https://github.com/sullo/nikto.git
cd nikto/program
perl nikto.pl -h

Syntax

nikto -h <target> [options]

All Command-Line Options

Option	Description
`-h, -host <target>`	Target hostname or IP (required)
`-p, -port <port>`	Target port(s), comma-separated or range
`-ssl`	Force SSL/TLS mode
`-o, -output <file>`	Write output to file
`-Format <type>`	Output format: csv, htm, json, msf+, nbe, sql, txt, xml
`-Tuning <options>`	Restrict scan to specific test categories (0-9, a-c, x)
`-Plugins <plugin>`	Select specific plugins to run
`-evasion <technique>`	IDS evasion technique (1-8, LibWhisker-based)
`-Cgidirs <dir>`	Scan specific CGI directories
`-timeout <secs>`	Request timeout (default 10s)
`-Pause <secs>`	Pause between tests
`-id <user:pass>`	HTTP basic auth credentials
`-useproxy <url>`	Route scan through a proxy (e.g., Burp)
`-vhost <hostname>`	Specify virtual host for Host header
`-nossl`	Disable SSL even if detected
`-nolookup`	Disable DNS resolution
`-no404`	Disable auto-guessing of 404 page behavior
`-mutate <technique>`	Guess additional file names (1-6)
`-list-plugins`	List all available plugins
`-update`	Update Nikto plugins/databases
`-Version`	Show version and plugin info
`-Display <options>`	Control on-screen display (1=redirects, 2=cookies, etc.)
`-config <file>`	Use an alternate config file
`-ask <yes\|no\|auto>`	Whether to prompt about intrusive tests
`-maxtime <time>`	Maximum scan duration (e.g., `1h`, `30m`)
`-root <path>`	Prepend a base path to all requests
`-C <all\|none>`	Enable/disable CGI directory guessing

Basic Usage (Expected Output in Bash)

$ nikto -h http://testphp.vulnweb.com

Output:

- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          44.228.249.3
+ Target Hostname:    testphp.vulnweb.com
+ Target Port:        80
+ Start Time:         2026-07-19 10:15:22 (GMT+5)
---------------------------------------------------------------------------
+ Server: nginx/1.19.0
+ /: The X-Content-Type-Options header is not set.
+ /: Cookie PHPSESSID created without the httponly flag
+ Server may leak inodes via ETags
+ OPTIONS: Allowed HTTP Methods: GET, HEAD, POST, OPTIONS
+ 7864 requests: 0 error(s) and 5 item(s) reported
+ End Time:           2026-07-19 10:17:41 (GMT+5) (139 seconds)

Practical Examples with Output

Example 1 — Basic scan against HTTPS target

$ nikto -h https://example.com -ssl

Output:

+ Server: Apache/2.4.41
+ The anti-clickjacking X-Frame-Options header is not present.
+ 6544 requests: 0 error(s) and 3 item(s) reported

Example 2 — Save results as HTML report

$ nikto -h http://testphp.vulnweb.com -o nikto-report.html -Format htm

Output:

+ Writing to nikto-report.html
+ Scan completed successfully.

Example 3 — Scan multiple ports

$ nikto -h 192.168.1.10 -p 80,443,8080

Output:

+ Testing port 80
+ Testing port 443
+ Testing port 8080
+ 3 host(s) tested

Example 4 — Route scan through Burp Suite proxy

$ nikto -h http://testphp.vulnweb.com -useproxy http://127.0.0.1:8080

Output:

+ Using proxy at http://127.0.0.1:8080
+ Server: nginx/1.19.0
+ All requests routed via proxy successfully

Example 5 — Tuning scan to only check for injection issues (tuning code 4)

$ nikto -h http://testphp.vulnweb.com -Tuning 4

Output:

+ Tuning: 4 (Injection - XSS/Script/HTML)
+ /search.php?test=<script>alert(1)</script>: XSS possibly reflected
+ 412 requests: 0 error(s) and 1 item(s) reported

Example 6 — Using authentication credentials

$ nikto -h http://admin.example.com -id admin:P@ssw0rd

Output:

+ Using Basic Auth credentials: admin:P@ssw0rd
+ Server: Apache/2.4.51
+ /admin/: Directory indexing found.

Example 7 — Output as JSON for automated parsing

$ nikto -h http://testphp.vulnweb.com -Format json -o results.json
$ jq '.vulnerabilities | length' results.json

Output:

Example 8 — Update plugin database before scanning

$ nikto -update

Output:

+ Retrieving 'main.db' (7 / 7)
+ Done. All plugin databases updated.

Example 9 — Scan with IDS evasion technique

$ nikto -h http://192.168.1.10 -evasion 1

Output:

+ Evasion technique: Random URI encoding
+ Server: Microsoft-IIS/10.0
+ 4382 requests: 0 error(s) and 2 item(s) reported

Example 10 — Limit scan runtime to 5 minutes

$ nikto -h http://testphp.vulnweb.com -maxtime 5m

Output:

+ Maximum test time set to 5m
+ Scan terminated early due to time limit — partial results below

Common Use Cases

Quick server-level vulnerability triage at the start of a web application engagement.
Identifying outdated server software (Apache, nginx, IIS) with known CVEs.
Discovering dangerous default files, backup files, and admin interfaces.
Checking for missing security headers (X-Frame-Options, HSTS, X-Content-Type-Options).
Feeding a proxy (Burp/ZAP) to correlate Nikto findings with manually observed traffic.

Automation with Bash

#!/bin/bash
# nikto-bulk-scan.sh — scan a list of hosts and consolidate reports

TARGETS_FILE="targets.txt"
OUTDIR="nikto-reports"
mkdir -p "$OUTDIR"

while IFS= read -r target; do
    [ -z "$target" ] && continue
    safe_name=$(echo "$target" | sed 's/[^a-zA-Z0-9]/_/g')
    echo "[*] Scanning $target..."
    nikto -h "$target" -Format json -o "$OUTDIR/${safe_name}.json" -maxtime 10m
    echo "[+] Completed: $target -> $OUTDIR/${safe_name}.json"
done < "$TARGETS_FILE"

echo "[*] All scans complete. Reports in $OUTDIR/"

Tips and Best Practices

Always run -update before major engagements to ensure the plugin database is current.
Use -Tuning to scope scans and reduce noise/time when only specific vulnerability classes are relevant.
Nikto generates a lot of traffic and log entries — expect it to be detected by any IDS/WAF; it is not a stealth tool.
Pair Nikto’s findings with a manual review; it reports many false positives, especially around header checks.
Use -o with -Format json or xml for easy integration into reporting pipelines.

Troubleshooting

Issue	Cause	Fix
`ERROR: Invalid SSL options`	SSL negotiation failure	Add `-nossl` or explicitly specify `-ssl`
Scan hangs indefinitely	High `-timeout` or unresponsive host	Lower `-timeout` value and retry
Extremely high false positives	Default tuning too broad	Use `-Tuning` to restrict test categories
`Connection refused` errors	Wrong port or firewall blocking	Verify port with `nmap` first
Outdated CVE detection	Plugin DB stale	Run `nikto -update`

References

Official GitHub repository: https://github.com/sullo/nikto
CIRT.net project page: https://cirt.net/Nikto2
Kali tool page: https://www.kali.org/tools/nikto/
Nikto documentation wiki: https://github.com/sullo/nikto/wiki