Nikto Web Vulnerability Scanner: Comprehensive Guide

Nikto is an open-source web server scanner written in Perl by Chris Sullo (CIRT.net). It performs comprehensive tests against web servers for thousands of known-dangerous files/CGIs, outdated server software versions, and other server-level misconfigurations. Nikto checks over 6,700 potentially dangerous files/programs, version-specific issues on over 1,250 servers, and version-specific problems across many server types. It is not stealthy — it is designed for speed and thoroughness rather than evasion — making it best suited for authorized assessments where noise is not a concern.

How to Install

Pre-installed on Kali Linux. To verify or reinstall:

which nikto
sudo apt update
sudo apt install nikto -y
nikto -Version

Install from source (GitHub) for the latest plugins:

git clone https://github.com/sullo/nikto.git
cd nikto/program
perl nikto.pl -h

Syntax

nikto -h <target> [options]

All Command-Line Options

Option	Description
-h, -host <target>	Target hostname or IP (required)
-p, -port <port>	Target port(s), comma-separated or range
-ssl	Force SSL/TLS mode
-o, -output <file>	Write output to file
-Format <type>	Output format: csv, htm, json, msf+, nbe, sql, txt, xml
-Tuning <options>	Restrict scan to specific test categories (0-9, a-c, x)
-Plugins <plugin>	Select specific plugins to run
-evasion <technique>	IDS evasion technique (1-8, LibWhisker-based)
-Cgidirs <dir>	Scan specific CGI directories
-timeout <secs>	Request timeout (default 10s)
-Pause <secs>	Pause between tests
-id <user:pass>	HTTP basic auth credentials
-useproxy <url>	Route scan through a proxy (e.g., Burp)
-vhost <hostname>	Specify virtual host for Host header
-nossl	Disable SSL even if detected
-nolookup	Disable DNS resolution
-no404	Disable auto-guessing of 404 page behavior
-mutate <technique>	Guess additional file names (1-6)
-list-plugins	List all available plugins
-update	Update Nikto plugins/databases
-Version	Show version and plugin info
-Display <options>	Control on-screen display (1=redirects, 2=cookies, etc.)
-config <file>	Use an alternate config file
-ask <yes|no|auto>	Whether to prompt about intrusive tests
-maxtime <time>	Maximum scan duration (e.g., 1h, 30m)
-root <path>	Prepend a base path to all requests
-C <all|none>	Enable/disable CGI directory guessing

Basic Usage (Expected Output in Bash)

$ nikto -h http://testphp.vulnweb.com

Output:

- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          44.228.249.3
+ Target Hostname:    testphp.vulnweb.com
+ Target Port:        80
+ Start Time:         2026-07-19 10:15:22 (GMT+5)
---------------------------------------------------------------------------
+ Server: nginx/1.19.0
+ /: The X-Content-Type-Options header is not set.
+ /: Cookie PHPSESSID created without the httponly flag
+ Server may leak inodes via ETags
+ OPTIONS: Allowed HTTP Methods: GET, HEAD, POST, OPTIONS
+ 7864 requests: 0 error(s) and 5 item(s) reported
+ End Time:           2026-07-19 10:17:41 (GMT+5) (139 seconds)

Practical Examples with Output

Example 1 — Basic scan against HTTPS target

$ nikto -h https://example.com -ssl

Output:

+ Server: Apache/2.4.41
+ The anti-clickjacking X-Frame-Options header is not present.
+ 6544 requests: 0 error(s) and 3 item(s) reported

Example 2 — Save results as HTML report

$ nikto -h http://testphp.vulnweb.com -o nikto-report.html -Format htm

Output:

+ Writing to nikto-report.html
+ Scan completed successfully.

Example 3 — Scan multiple ports

$ nikto -h 192.168.1.10 -p 80,443,8080

Output:

+ Testing port 80
+ Testing port 443
+ Testing port 8080
+ 3 host(s) tested

Example 4 — Route scan through Burp Suite proxy

$ nikto -h http://testphp.vulnweb.com -useproxy http://127.0.0.1:8080

Output:

+ Using proxy at http://127.0.0.1:8080
+ Server: nginx/1.19.0
+ All requests routed via proxy successfully

Example 5 — Tuning scan to only check for injection issues (tuning code 4)

$ nikto -h http://testphp.vulnweb.com -Tuning 4

Output:

+ Tuning: 4 (Injection - XSS/Script/HTML)
+ /search.php?test=<script>alert(1)</script>: XSS possibly reflected
+ 412 requests: 0 error(s) and 1 item(s) reported

Example 6 — Using authentication credentials

$ nikto -h http://admin.example.com -id admin:P@ssw0rd

Output:

+ Using Basic Auth credentials: admin:P@ssw0rd
+ Server: Apache/2.4.51
+ /admin/: Directory indexing found.

Example 7 — Output as JSON for automated parsing

$ nikto -h http://testphp.vulnweb.com -Format json -o results.json
$ jq '.vulnerabilities | length' results.json

Output:

6

Example 8 — Update plugin database before scanning

$ nikto -update

Output:

+ Retrieving 'main.db' (7 / 7)
+ Done. All plugin databases updated.

Example 9 — Scan with IDS evasion technique

$ nikto -h http://192.168.1.10 -evasion 1

Output:

+ Evasion technique: Random URI encoding
+ Server: Microsoft-IIS/10.0
+ 4382 requests: 0 error(s) and 2 item(s) reported

Example 10 — Limit scan runtime to 5 minutes

$ nikto -h http://testphp.vulnweb.com -maxtime 5m

Output:

+ Maximum test time set to 5m
+ Scan terminated early due to time limit — partial results below

Common Use Cases

• Quick server-level vulnerability triage at the start of a web application engagement.
• Identifying outdated server software (Apache, nginx, IIS) with known CVEs.
• Discovering dangerous default files, backup files, and admin interfaces.
• Checking for missing security headers (X-Frame-Options, HSTS, X-Content-Type-Options).
• Feeding a proxy (Burp/ZAP) to correlate Nikto findings with manually observed traffic.

Automation with Bash

#!/bin/bash
# nikto-bulk-scan.sh — scan a list of hosts and consolidate reports

TARGETS_FILE="targets.txt"
OUTDIR="nikto-reports"
mkdir -p "$OUTDIR"

while IFS= read -r target; do
    [ -z "$target" ] && continue
    safe_name=$(echo "$target" | sed 's/[^a-zA-Z0-9]/_/g')
    echo "[*] Scanning $target..."
    nikto -h "$target" -Format json -o "$OUTDIR/${safe_name}.json" -maxtime 10m
    echo "[+] Completed: $target -> $OUTDIR/${safe_name}.json"
done < "$TARGETS_FILE"

echo "[*] All scans complete. Reports in $OUTDIR/"

Tips and Best Practices

• Always run -update before major engagements to ensure the plugin database is current.
• Use -Tuning to scope scans and reduce noise/time when only specific vulnerability classes are relevant.
• Nikto generates a lot of traffic and log entries — expect it to be detected by any IDS/WAF; it is not a stealth tool.
• Pair Nikto’s findings with a manual review; it reports many false positives, especially around header checks.
• Use -o with -Format json or xml for easy integration into reporting pipelines.

Troubleshooting

Issue	Cause	Fix
ERROR: Invalid SSL options	SSL negotiation failure	Add -nossl or explicitly specify -ssl
Scan hangs indefinitely	High -timeout or unresponsive host	Lower -timeout value and retry
Extremely high false positives	Default tuning too broad	Use -Tuning to restrict test categories
Connection refused errors	Wrong port or firewall blocking	Verify port with nmap first
Outdated CVE detection	Plugin DB stale	Run nikto -update

References

• Official GitHub repository: https://github.com/sullo/nikto
• CIRT.net project page: https://cirt.net/Nikto2
• Kali tool page: https://www.kali.org/tools/nikto/
• Nikto documentation wiki: https://github.com/sullo/nikto/wiki