Nikto

Run 'nikto -h http://example.com' to scan a web server. Nikto is pre-installed on Kali. Use '-h' to specify the target host, '-o output.html' to save results, and '-Tuning 123b' to enable specific tests. Always scan only systems you own or have authorization to test.

Nikto checks for over 6,700 potentially dangerous files/programs, checks for outdated versions of over 125 servers, and looks for version-specific problems on over 270 servers. It also tests for server configuration issues, missing security headers, and common misconfigurations.

Nikto focuses specifically on web server scanning and content discovery. Nmap scans network ports and services. Nessus is a comprehensive vulnerability scanner with authenticated checks. Nikto is best for quick web server audits; combine with Nmap for full network coverage.

On Kali Linux, Nikto is pre-installed. On other systems: 'git clone https://github.com/sullo/nikto.git' then run 'perl nikto.pl -h target'. Install Perl first if not present. Docker: 'docker run -it sullo/nikto -h http://example.com'.

No. Nikto sends over 7,000 requests per scan and is trivially detected by any IDS/IPS or WAF. It generates significant logs and is not designed for stealthy reconnaissance. Use Nikto for thorough authorized audits, not evasive testing.

Use '-o output.html' for HTML reports, '-o output.xml' for XML, or '-o output.csv' for CSV. The '-Format' flag specifies the format. Combine with '-Display V' for verbose output to see each test being performed during the scan.

Nikto is used for scanning web servers for vulnerabilities, misconfigurations, outdated software versions, and dangerous files/programs. It tests against over 6700 potentially dangerous files.

Nikto is a web server scanner that identifies misconfigurations, outdated software, and known vulnerabilities. It does not perform full vulnerability scanning like Nessus or OpenVAS.

Yes, Nikto can scan HTTPS sites using the -ssl flag. It handles SSL/TLS connections and can test secure web servers.

A full Nikto scan can take 10-60 minutes depending on the server speed, number of checks, and network latency. Use -maxtime to limit scan duration.

Nikto supports multiple scan types: basic HTTP scan (default), SSL scan with -ssl, tunneled proxy scan with -useproxy, and host-specific scans with -vhost for virtual hosting environments.

Yes, use the -useproxy flag to route all Nikto scan traffic through a proxy server. This is useful for scanning through corporate proxies or anonymizing your scan origin.

Use the -Tuning flag with numeric options to enable specific tests. For example, -Tuning 12 enables XSS tests, -Tuning 3 enables file upload tests, and combining numbers (e.g., -Tuning 123) runs multiple test categories.

Nikto can detect common CMS files and directories (WordPress, Joomla, Drupal) but does not perform deep CMS-specific vulnerability scanning. Use specialized tools like WPScan or CMS-specific scanners for comprehensive CMS testing.

Nikto output includes server information, OS fingerprints, discovered files/directories, and identified vulnerabilities. Pay attention to OSVDB entries which link to known vulnerabilities. Use -Format to export results in various formats for reporting.

Yes, use -h with multiple hostnames or IPs separated by commas. Nikto also supports scanning from a file using -h @targets.txt where the file contains one target per line.

Nikto specializes in web server vulnerability scanning with 6700+ tests, while Nmap's HTTP scripts (http-enum, http-vuln-*) focus on service discovery and specific CVE detection. Nikto provides more comprehensive web-specific coverage.

Create custom configuration files with -config, modify the templates directory for custom 404 page detection, use -Plugins to enable/disable specific test modules, and tune with -Tuning to focus on specific vulnerability categories.

Yes, use the -vhost flag to specify a virtual host: nikto -h http://192.168.1.1 -vhost example.com. This sends the Host header for the virtual host, allowing Nikto scan the correct website when multiple sites share an IP.

Use -maxtime to set a global timeout in seconds, -pause to add delays between requests, and -throttle to limit request rate. These options help avoid triggering IDS/IPS and reduce network noise.

Yes, Nikto supports proxy connections with -useproxy. For SOCKS proxies, use proxychains or configure the proxy in the Nikto configuration file. This allows scanning through corporate proxies or anonymizing scan origin.

Use -Format json -output report.json to export results in JSON format. JSON output is machine-readable and can be imported into SIEM tools, vulnerability management platforms, or custom reporting pipelines.

Nikto checks for some SSRF-related misconfigurations through its test database, but it is not specialized for SSRF detection. For comprehensive SSRF testing, use dedicated tools like Burp Suite or custom scripts.

Update Nikto with: cd /opt/nikto && git pull. This downloads the latest test database with new vulnerability checks. The test database is updated regularly with new misconfigurations and vulnerability signatures.

Yes, use -p to specify multiple ports: nikto -h 192.168.1.1 -p 80,443,8080. Nikto scans each port separately and reports findings for each web server found.