Nikto

Web server vulnerability & misconfiguration scanner

Nikto Cheat Sheet

Nikto is an open-source web server scanner that checks for thousands of dangerous files/CGIs, outdated server software, misconfigurations, and common vulnerabilities. For authorized testing only.

1. Basic usage

nikto -h https://target.com
nikto -h target.com                  # defaults to http on port 80
nikto -h 10.10.10.10 -p 8080         # explicit port
nikto -h target.com -p 80,443,8080   # multiple ports
nikto -h target.com -ssl             # force SSL/TLS

2. Common flags

Flag	Purpose
-h	Target host (URL, hostname, IP, or file of hosts)
-p	Port(s): 80,443,8080
-ssl	Force SSL on the connection
-nossl	Disable SSL
-Tuning	Limit which test categories run (see §4)
-o	Output file
-Format	Output format: csv, json, htm, xml, txt, nbe
-useproxy	Use proxy from config (or http://host:port)
-vhost	Set the Host header (virtual host)
-id	HTTP basic auth user:pass
-Display	Adjust live output (e.g. V verbose, 1 show redirects)
-timeout	Per-request timeout (s)
-Pause	Seconds to wait between tests
-maxtime	Stop the whole scan after N seconds/minutes
-update	Update plugin/database files

3. Authentication, proxy & headers

nikto -h https://target.com -id admin:password
nikto -h https://target.com -useproxy http://127.0.0.1:8080     # through Burp
nikto -h 10.10.10.10 -vhost app.target.com                       # vhost scan

4. Tuning (choose test categories)

-Tuning <ids> runs only the selected categories (combine the digits):

ID	Category
0	File upload
1	Interesting files / seen in logs
2	Misconfiguration / default files
3	Information disclosure
4	Injection (XSS/script/HTML)
5	Remote file retrieval (within web root)
6	Denial of service
7	Remote file retrieval (server-wide)
8	Command execution / remote shell
9	SQL injection
a	Authentication bypass
b	Software identification
c	Remote source inclusion
x	Reverse tuning (run everything EXCEPT the listed IDs)

nikto -h https://target.com -Tuning 1234       # only those categories
nikto -h https://target.com -Tuning x6         # everything except DoS

5. Output formats

nikto -h https://target.com -o report.html -Format htm
nikto -h https://target.com -o report.csv  -Format csv
nikto -h https://target.com -o report.json -Format json
nikto -h https://target.com -o report.xml  -Format xml
# Format is inferred from the extension; -Format makes it explicit.

6. Scanning multiple targets

nikto -h hosts.txt                      # one host per line
nikto -h target.com -p 80,443,8000,8080,8443

7. Evasion & tuning the connection

nikto -h https://target.com -useragent "AYSEC-scan"
nikto -h https://target.com -evasion 1       # IDS evasion technique (1–8)
nikto -h https://target.com -Pause 2         # 2s between requests (rate limit)
nikto -h https://target.com -maxtime 5m      # cap total scan time

-evasion techniques (combine digits): 1 random URI encoding, 2 self-reference dirs (/./), 3 premature URL ending, 4 prepend long random string, 5 fake parameter, 6 TAB separator, 7 change case, 8 use \ as path separator.

8. Real-world examples

# Full default scan over HTTPS, HTML report
nikto -h https://target.com -ssl -o nikto.html -Format htm

# Through Burp, only info-disclosure + misconfig + injection tests
nikto -h https://target.com -useproxy http://127.0.0.1:8080 -Tuning 234

# Throttled scan of a fragile box, capped at 10 minutes
nikto -h 10.10.10.10 -p 80,443 -Pause 1 -maxtime 10m -o scan.txt

9. Updating

nikto -update

10. Tips

• Nikto is loud and signature-heavy — it's a recon/audit tool, not stealthy. Expect IDS alerts; use -Pause/-evasion only to be polite or avoid rate limits, not to evade detection seriously.
• Narrow scans with -Tuning so you're not running DoS (6) tests on production.
• Run it through Burp (-useproxy) to log everything it touches and manually verify findings.
• Findings are checks, not confirmed exploits — validate each interesting hit before reporting.
• Combine with nmap first to know which ports/services are open, then point Nikto at the web ones.

Authorized testing only. Practice on the AYSEC challenges. Related: nmap