GO KALI FREE
BeginnerTools

Nikto Guide: Web Server Security Scanner

A complete guide to Nikto for web server vulnerability scanning, covering CGI scanning, server misconfiguration detection, and security assessment.

#nikto#web server#vulnerability scanner#CGI#security assessment

Why You Need Nikto

You need a comprehensive security audit of a web server — Nikto checks for dangerous files, outdated software, misconfigurations, and CGI issues in one pass. It has been a mainstay of web server scanning for over two decades, providing a thorough (if noisy) overview of a server's security posture.

Prerequisites

  • Basic understanding of web servers and HTTP
  • Familiarity with CGI and server-side technologies
  • A target web server for testing
  • Written authorization to test the target

    • Installation

    Nikto comes pre-installed on Kali Linux:

    # Debian/Ubuntu
sudo apt install nikto

# From source
git clone https://github.com/sullo/nikto.git
cd nikto/program
perl nikto.pl -h

# Docker
docker pull sullo/nikto

    Basic Usage

    nikto -h http://target.com

    Essential Options

    | Option | Description |

    |--------|-------------|

    | -h HOST | Target host |

    | -p PORT | Port number |

    | -ssl | Force SSL mode |

    | -output FILE | Save results |

    | -Format FORMAT | csv, html, txt, xml |

    | -Tuning X | Test categories |

    | -evasion TECH | Evasion technique |

    Scan Examples

    nikto -h https://target.com -ssl
nikto -h http://target.com -p 8080
nikto -h http://target.com -o scan-results.html -Format html

    Tuning Options

    nikto -h http://target.com -Tuning 0 3 5

    Tuning codes: 0 (file upload), 1 (interesting files), 3 (info disclosure), 4 (injection), 8 (command execution), 9 (SQL injection), e (admin consoles).

    Evasion Techniques

    nikto -h http://target.com -evasion 1

    Types: random URI encoding, directory self-reference, premature URL ending, fake parameter, change URL case.

    Real-World Example: Comprehensive Scan

    nikto -h https://target.com -ssl -o nikto-report.html -Format html -Tuning 12345b -evasion 1
nikto -h https://target.com -ssl -Tuning e -o admin-panels.txt

    Common Mistakes

    Not using SSL flag for HTTPS targets. Ignoring output — always use -o. Running without tuning produces overwhelming results.

    Best Practices

    Always save output. Use tuning parameters. Run multiple passes. Combine with manual testing. Update databases with nikto -update.

    Related Tools

  • **Nmap with NSE**: Targeted vulnerability testing
  • **WhatWeb**: Web technology fingerprinting
  • **WPScan**: WordPress vulnerability scanning
  • **Nuclei**: Template-based scanning

    • Related Articles

  • [Nmap Beginner Tutorial](/articles/nmap-beginner-tutorial)
  • [WPScan Guide](/articles/wpscan-guide)
  • [WhatWeb Guide](/articles/whatweb-guide)
  • [Nuclei Guide](/articles/nuclei-guide)

    • Summary

    Nikto is a comprehensive web server scanner that identifies configuration issues, outdated software, and dangerous files. Effective use requires understanding tuning parameters, saving output, and combining with manual verification.

    Knowledge Check

  • What does the `-ssl` flag do?
  • How do tuning parameters help focus a scan?
  • Why is Nikto considered noisy?
  • What format options are available for output?
  • How do you update Nikto's database?

    • Frequently Asked Questions

    What is Nikto and what does it scan for?

    Nikto is an open-source web server scanner that tests for dangerous files, outdated software, misconfigurations, CGI vulnerabilities, and other security issues. It performs comprehensive tests against web servers but is not stealthy — it generates significant network traffic.

    Why is Nikto considered a noisy scanner?

    Nikto sends a large volume of requests to enumerate thousands of potential vulnerabilities, making it easily detected by intrusion detection systems (IDS) and web application firewalls (WAF). It is useful for thorough assessments but not for stealthy reconnaissance.

    What does the `-ssl` flag do in Nikto?

    The `-ssl` flag forces Nikto to use SSL/TLS when scanning HTTPS targets. Without it, Nikto may attempt plain HTTP connections to HTTPS servers, resulting in connection failures and missed vulnerabilities on encrypted services.

    How do tuning parameters help focus a Nikto scan?

    The `-Tuning` flag narrows scan categories: 0 (file upload), 1 (interesting files), 3 (info disclosure), 4 (injection), 8 (command execution), 9 (SQL injection), e (admin consoles). This reduces scan time and output noise by focusing on specific vulnerability types.

    What output format options does Nikto support?

    Nikto supports CSV, HTML, plain text, and XML output formats using the `-Format` flag. HTML reports are best for sharing with stakeholders; CSV for data analysis; XML for integration with other security tools and SIEM platforms.

    How do you update Nikto's vulnerability database?

    Run `nikto -update` to pull the latest vulnerability checks from the GitHub repository. Regular updates ensure Nikto detects newly discovered web server vulnerabilities and misconfigurations.

    What are Nikto's tuning codes and when should you use them?

    Tuning codes filter scan categories: try `-Tuning 0 3 5` for file upload, info disclosure, and remote file retrieval. Use `-Tuning e` to focus on admin consoles. Specific tuning reduces output noise and scan duration significantly.

    How do Nikto's evasion techniques work?

    The `-evasion` flag applies techniques like random URI encoding, directory self-reference, premature URL ending, fake parameters, and case changes to bypass basic WAF/IDS filters that detect known Nikto scan patterns.

    Should Nikto be combined with other scanning tools?

    Yes, Nikto works best as part of a toolkit. Use Nmap for port/service discovery, WhatWeb for technology fingerprinting, then Nikto for vulnerability scanning. Combine with manual testing for thorough web server assessments.

    What types of vulnerabilities does Nikto detect?

    Nikto detects outdated server software, dangerous files (backup files, default pages), server misconfigurations (directory listing, unsafe HTTP methods), CGI vulnerabilities, missing security headers, and potentially harmful programs accessible on the web server.