Nikto — Web Server Scanner
What is Nikto?
Nikto is an open-source web server scanner that checks targets for over 6,700 potentially dangerous files/programs, outdated server software, version-specific problems, and common misconfigurations. It is loud and not stealthy — use it when noise doesn’t matter.
OSCP use: Run Nikto alongside Gobuster during web enumeration. Gobuster finds hidden paths; Nikto finds misconfigurations and known-vulnerable software versions.
Install (Kali)
sudo apt update && sudo apt install -y niktoVerify: nikto -Version
Full install index → Installation - Kali Setup
Syntax
nikto -h <target> [options]📌 1) All Flags
| Flag | Description |
|---|---|
-h <host> | Target host — IP, hostname, or full URL |
-p <port> | Target port (default: 80). Comma-separate for multiple: -p 80,443,8080 |
-ssl | Force SSL/HTTPS regardless of port |
-nossl | Disable SSL |
-id <user:pass> | HTTP Basic Auth credentials |
-C all | Check all CGI directories |
-T <tuning> | Tuning options — control which tests run (see table below) |
-t <seconds> | Timeout per request (default: 10) |
-D <debug> | Debug level (1–4) |
-Display <opts> | Display options — control output verbosity (see table below) |
-o <file> | Output file path (format auto-detected from extension) |
-Format <fmt> | Output format: csv, htm, json, msf+, nbe, txt, xml |
-append | Append to output file instead of overwriting |
-config <file> | Use an alternate config file |
-update | Update the plugins database |
-list-plugins | List all available plugins |
-Plugins <list> | Specify plugins to run (comma-separated) |
-useproxy | Use proxy defined in nikto.conf |
-useagent <string> | Override User-Agent string |
-vhost <hostname> | Specify virtual host to test |
-root <path> | Prepend a root path to all requests |
-404code <code> | Response code to treat as 404 |
-404string <str> | String in response body to treat as 404 |
-Pause <seconds> | Pause between requests (rate limiting) |
-maxtime <seconds> | Max time to run scan (e.g. 300 = 5 min) |
-nolookup | Don’t perform hostname DNS lookups |
-nointeractive | Disable interactive prompts |
-until <time> | Run until a specific time |
-follow-redirects | Follow HTTP redirects |
📌 2) Tuning Options (-T)
Tuning controls which test categories run. Combine numbers/letters:
| Code | Category |
|---|---|
0 | File upload vulnerabilities |
1 | Interesting files / seen in logs |
2 | Misconfiguration / default files |
3 | Information disclosure |
4 | Injection (XSS, SSI, HTML) |
5 | Remote file retrieval (inside web root) |
6 | Denial of Service |
7 | Remote file retrieval (server-wide) |
8 | Command execution / Remote Shell |
9 | SQL injection |
a | Authentication bypass |
b | Software identification |
c | Remote source inclusion |
x | Reverse tuning — exclude selected tests |
# Only XSS and SQLi tests
nikto -h http://TARGET -T 49
# Exclude DoS tests
nikto -h http://TARGET -T x6
# Everything (default behavior)
nikto -h http://TARGET📌 3) Display Options (-Display)
| Code | Description |
|---|---|
1 | Show redirects |
2 | Show cookies |
3 | Show all 200 OK responses |
4 | Show URLs that require authentication |
D | Debug output |
E | Show HTTP errors |
P | Print progress to STDOUT |
S | Show response status codes |
V | Verbose output |
nikto -h http://TARGET -Display V
nikto -h http://TARGET -Display 1234📌 4) Common Examples
Basic scan
nikto -h http://10.10.10.10HTTPS target
nikto -h https://10.10.10.10
# or force SSL on a non-standard port
nikto -h 10.10.10.10 -p 8443 -sslScan multiple ports
nikto -h 10.10.10.10 -p 80,443,8080,8443Authenticated scan (Basic Auth)
nikto -h http://10.10.10.10 -id admin:passwordSave output
# Plain text
nikto -h http://10.10.10.10 -o nikto_out.txt
# HTML report
nikto -h http://10.10.10.10 -o nikto_report.htm -Format htm
# XML (import into other tools)
nikto -h http://10.10.10.10 -o nikto_out.xml -Format xmlScan through a proxy (Burp)
# Set proxy in nikto.conf, then:
nikto -h http://10.10.10.10 -useproxy
# or set directly:
nikto -h http://10.10.10.10 -useproxy http://127.0.0.1:8080Rate-limit to reduce noise
nikto -h http://10.10.10.10 -Pause 1Custom virtual host header
nikto -h http://10.10.10.10 -vhost admin.target.comScan from Nmap results (using Nmap XML)
# Run Nmap first and save XML
nmap -sV -p 80,443,8080 -oX nmap_out.xml 10.10.10.0/24
# Feed into Nikto
nikto -h nmap_out.xml📌 5) Quick OSCP Cheat Sheet (Copy/Paste)
# Standard first scan
nikto -h http://TARGET -o nikto_TARGET.txt
# HTTPS
nikto -h https://TARGET -o nikto_TARGET.txt
# Verbose + save HTML report
nikto -h http://TARGET -Display V -o nikto_TARGET.htm -Format htm
# Targeted: only SQLi, XSS, auth bypass
nikto -h http://TARGET -T 49a
# Scan all common web ports
nikto -h TARGET -p 80,443,8080,8443,8888📌 WebSockets — indirect checks (HTTP only)
Nikto is an HTTP scanner — it does not inject into WebSocket message frames. It may still flag HTTP-side issues around real-time apps:
| What Nikto can surface | Why it matters for WS |
|---|---|
| Outdated server / framework headers | Node, Socket.IO, Rails Action Cable versions |
| Misconfigured CORS / headers on upgrade URL | CSWSH, weak Origin checks |
| Default files, info disclosure | /socket.io/socket.io.js, debug endpoints |
| Injection tests on HTTP params | SQLi/XSS on REST APIs that share backend with WS |
# Run Nikto on ports that often host WS backends
nikto -h TARGET -p 80,443,3000,8080,8443
# If Gobuster/ffuf found /api or /ws — Nikto that path
nikto -h http://TARGET/wsNext step after Nikto: open the app in Burp Suite → WebSockets history → manual message testing → SQLMap bridge if SQLi confirmed.
Nikto vs Gobuster — When to Use Which
| Tool | Best for |
|---|---|
| Gobuster | Finding hidden files/directories via brute-force wordlist |
| CMSeeK - cmseek | Identifying CMS type + version (180+ CMSs) before targeted scans |
| Nikto | Finding known vulnerabilities, misconfigurations, outdated software headers |
Run both — they complement each other. Start with Gobuster for directory discovery, then Nikto for vulnerability context on what you find.