Nikto

What is Nikto?

Nikto is an open-source web server scanner, written in Perl, that has been a reference tool for the early stage of a web assessment for years. Its job is to automatically fire thousands of checks against an HTTP/HTTPS server to detect known problems: dangerous files and scripts, outdated software, insecure configurations, missing security headers, default files that should not be exposed and much more.

Nikto is not a stealthy tool: it makes a huge number of requests and leaves an obvious trail in the logs. That is exactly why it is ideal for auditing your own servers or labs, where you want a quick, broad sweep of obvious problems before moving on to manual analysis.

What Nikto is used for

• Quick reconnaissance of a web server: software version, technologies and interesting paths.
• Detecting insecure configurations: listable directories, dangerous HTTP methods, forgotten sample or install files.
• Checking for missing security headers (such as browser-protection ones).
• Hardening your own servers: running it periodically to find what slipped through.
• CTF challenges and labs as a first look at a web target.

Only use it against your own servers, lab machines, challenges or systems with written authorisation.

How to install Nikto

On Kali Linux and Parrot OS it comes preinstalled. On Debian/Ubuntu:

sudo apt update
sudo apt install nikto

On macOS with Homebrew:

brew install nikto

As it is a Perl project, you can also clone the official repository and run it directly:

git clone https://github.com/sullo/nikto
cd nikto/program
perl nikto.pl -Version

How to use Nikto: practical examples

Basic scan

The -h option sets the target host or URL:

nikto -h http://192.168.56.101

Nikto will print each finding with a reference (for example, an OSVDB identifier or a link) and a short description.

Specifying port and HTTPS

nikto -h 192.168.56.101 -p 443 -ssl

You can also scan several ports at once: -p 80,443,8080.

Saving the report

With -o you set the output file and with -Format the format (text, CSV, HTML, JSON or XML):

nikto -h http://192.168.56.101 -o report.html -Format htm

Tuning which tests run

The -Tuning option selects categories of checks to focus the scan. For example, 1 is interesting files and 2 is default configuration:

nikto -h http://192.168.56.101 -Tuning 12

Customising the request

You can change the User-Agent, add headers or use basic authentication:

nikto -h http://192.168.56.101 -useragent "Internal audit" -id admin:password

And route all the traffic through a proxy such as Burp Suite to review it:

nikto -h http://192.168.56.101 -useproxy http://127.0.0.1:8080

Pro tips

• Start with Nikto, do not finish with it. It is an initial sweep: every finding must be verified by hand, because it produces false positives.
• Pair it with Nmap. Scan the open web ports with Nmap first and run Nikto against each HTTP service found.
• Keep the plugins updated so the check database stays current; old signatures lose effectiveness.
• Use -Tuning to shorten the scan when you only care about one type of problem.
• Run it through a proxy to capture the interesting requests and dig deeper later with manual tools.

Pros and cons

Pros	Cons
Quick to launch and thorough in its checks	Very noisy: easy to detect and block
Free, open source and preinstalled on Kali/Parrot	Produces false positives that need verifying
Several report formats	Does not exploit vulnerabilities, only detects them

Nikto alternatives

• OWASP ZAP: a graphical, far more complete web scanner with a built-in proxy.
• Burp Suite: the standard for manual web testing and, in its Pro version, with an automated scanner.
• Nuclei: a modern template-based scanner, very fast and community-updated.
• whatweb and wapiti: command-line alternatives for reconnaissance and scanning.
• Practise on machines at Hack The Box or TryHackMe.

Frequently asked questions

Is Nikto free?

Yes, it is a free, open-source project available on GitHub and in the security distros' repositories.

Is Nikto stealthy?

No. It makes a huge number of requests and is very easy to spot in the logs and by a WAF. Use it in environments where noise is not a problem.

Does Nikto exploit the vulnerabilities it finds?

No. Nikto only detects and reports potential problems; exploitation and verification are up to you, with other tools and with authorisation.

Why does Nikto give false positives?

Some signatures are generic, and servers with custom error pages or WAFs can confuse it. Always verify each finding by hand before accepting it.

Want to learn how to audit web servers step by step? You will find it at the Hackers en Acción Academy.