security enabled verified medium v1.0.0

nikto

Web server scanner that tests for dangerous files, outdated server software, and misconfigurations on web servers.

📋 Live Preview

nikto -h {target} -p {port}

🌍 target → ip 🌍 port → 80

nikto -h {target} -p {port}

Sandbox: execFile · Timeout: 900s

Capabilities

web.scan.vulnerability

web.fingerprint.server

web.discovery.path

web.scan.config

Parameters

Name	Type	Required	Default	Description	Aliases
`host`	string	Yes	-	Target hostname or IP address	`-h`
`port`	integer	No	80	Target port (default 80)	`-p`
`ssl`	boolean	No	-	Force SSL/TLS mode (port 443)	`-ssl`
`Format`	string	No	-	Output format: html, xml, csv, txt, json	`-Format`
`output`	file	No	-	Output file for scan results	`-output`
`Tuning`	string	No	-	Tuning options (1-9) to control scan scope	`-Tuning`
`idhost`	string	No	-	Hostname to use in HTTP Host header	`-idhost`
`evasion`	string	No	-	Evasion technique (1-9)	`-evasion`
`mutate`	integer	No	-	Mutate technique for more checks	`-mutate`
`root`	string	No	-	Prepend root path to all requests	`-root`
`timeout`	integer	No	-	Request timeout in seconds	`-timeout`
`no404`	boolean	No	-	Disable 404 detection heuristic	`-no404`
`useragent`	string	No	-	Custom User-Agent header value	`-useragent`
`Display`	integer	No	-	Display verbosity level (1-4)	`-Display`

Artifacts

Type	Description	MIME	Schema	Trust
`web.scan.report`	Nikto scan report	text/html	-	verified
`web.scan.text`	Nikto text output	text/plain	-	verified

Contract

Inputs

web.target.url

Target web server URL

web.target.host

Target hostname or IP

network.port

Target port number

Outputs

web.scan.report

HTML scan report

web.scan.text

Text output of findings

Side effects: network_traffic

Workflow Edges

Produces

web.scan.reportweb.scan.text

Consumes

web.target.urlweb.target.hostnetwork.port

Resource Profile

Resource	Value
CPU	low
Memory	64 MB
Network	low
Disk I/O	low

Examples

Basic scan of a web server on default port

nikto -h example.com

Scan on a non-standard port with SSL

nikto -h example.com -p 8443 -ssl

Output results to HTML report

nikto -h example.com -p 443 -ssl -Format html -output report.html

Scan with specific tuning options

nikto -h example.com -Tuning 123

Evasion technique for WAF bypass

nikto -h example.com -evasion 1

Custom virtual host scan

nikto -h 10.0.0.1 -idhost vhost.example.com

Scan with custom user agent and timeout

nikto -h example.com -useragent "Mozilla/5.0" -timeout 10

Documentation

Nikto — Web Server Scanner

Nikto is an open-source web server scanner that performs comprehensive tests against web servers for multiple items, including dangerous files/CGIs, outdated server software, and misconfigurations.

Key Features

Server Fingerprinting: Identify web server type and version
Vulnerability Checks: 6700+ potentially dangerous files/programs
Config Assessment: Check for outdated or misconfigured software
SSL/TLS Checks: Test HTTPS configurations
Multiple Output Formats: HTML, XML, CSV, TXT, JSON

Scan Tuning Options

Tuning Value	Category
1	Interesting File / Seen in logs
2	Misconfiguration / Default File
3	Information Disclosure
4	Injection (XSS/Script/HTML)
5	Remote File Retrieval

Basic Usage

# Basic scan
nikto -h example.com

# HTTPS with HTML report
nikto -h example.com -ssl -Format html -output report.html

# Custom port with evasion
nikto -h example.com -p 8080 -evasion 1