How do I write parseable nikto output?

Set -Format to csv, html, nbe, xml, or txt. The node writes the results file and folder for downstream reads.

How is nikto different from nuclei?

nikto runs a fixed bundled database of web server checks against one host. nuclei matches YAML templates and tracks current CVEs across many targets. Many workflows run nikto for a broad first pass, then nuclei for template coverage.

How do I keep a scan from running too long?

Set -maxtime to cap testing per host (1h, 60m, or 3600s) and use -Pause to space requests. -Tuning narrows test categories to shorten the run further.

How do I scan a named virtual host?

Set -vhost so the Host header targets the right site on a server that routes multiple names behind one IP. Combine it with -host for the address and -port for the service.

Updated Jul 14, 2026

Scanners

Probe a live web server for known dangerous paths

Bundled web server checks for dangerous files and outdated software.

Surface known web server issues Scan a named virtual host Export structured findings

overview

What nikto does

Point nikto at a live host after httpx confirms the port answers. It walks a bundled check database for dangerous files, outdated server versions, and common misconfigurations, then reports what responds.

Set -host and -port, force TLS with -ssl, narrow categories with -Tuning, and cap the run with -maxtime. -Format writes csv, html, xml, nbe, or txt for triage downstream.

Wire the node with -host after httpx confirms the port; output is a results file and folder for downstream triage. Prefer nuclei when you need template-driven CVE coverage across many targets.

source github.com/sullo/nikto

use cases

Where nikto fits

Surface known web server issues

Scan a live host to catch dangerous files, outdated software, and misconfigurations from nikto's checks before deeper manual testing.

Scan a named virtual host

Set -vhost so the Host header targets the right application on a server that routes multiple sites by name behind one IP.

Export structured findings

Write output as XML or CSV with -Format so results feed a report generator or land in a queryable table for triage.

Bound long scans

Use -maxtime and -Pause to cap how long a single host takes and space requests, keeping a broad scan from stalling on one slow server.

reference

nikto inputs and flags

32 inputs

Name	Type	Flag	Description
host	STRING	-host	Target host to scan.
port	STRING	-port	Port to use (default 80).
force-ssl	BOOLEAN	-ssl	Force SSL mode on the port.
format	STRING	-Format	Output file format (csv, html, nbe, txt, xml).
scan-tuning	STRING	-Tuning	Narrow the test categories run against the target.
plugins	STRING	-Plugins	Select which plugins to run (default: ALL).
maxtime	STRING	-maxtime	Maximum testing time per host (e.g. 1h, 60m, 3600s).
proxy	STRING	-useproxy	Route requests through a proxy (http://server:port).

Showing key inputs. nikto exposes 32 inputs in total.

Full flag reference (32 inputs)

Name	Type	Flag	Description
host	STRING	-host	Target host.
port	STRING	-port	Port to use (default 80).
pause	STRING	-Pause	Pause between tests in seconds (integer or float).
proxy	STRING	-useproxy	Use the proxy defined in nikto.conf, or an http://server:port argument.
until	STRING	-until	Run until the specified time or duration.
vhost	STRING	-vhost	Virtual host to send in the Host header.
config	FILE	-config	Use this config file.
format	STRING	-Format	Output file format (csv, html, nbe, txt, xml).
mutate	STRING	-mutate	Guess additional file names.
no-404	BOOLEAN	-no404	Disable nikto's attempt to guess a 404 page.
no-ssl	BOOLEAN	-nossl	Disable the use of SSL.
dbcheck	BOOLEAN	-dbcheck	Check the database and other key files for syntax errors.
display	STRING	-Display	Turn display outputs on or off (options: 1, 2, 3, 4, D, E, P, S, V).
maxtime	STRING	-maxtime	Maximum testing time per host (e.g. 1h, 60m, 3600s).
plugins	STRING	-Plugins	List of plugins to run (default: ALL).
timeout	STRING	-timeout	Timeout for requests (default 10 seconds).
userdbs	STRING	-Userdbs	Load only user databases, not the standard databases.
cgi-dirs	STRING	-Cgidirs	Scan these CGI dirs: "none", "all", or values like "/cgi/ /cgi-a/".
no-slash	BOOLEAN	-noslash	Strip the trailing slash from a URL (e.g. '/admin/' to '/admin').
nolookup	BOOLEAN	-nolookup	Disable DNS lookups.
rsa-cert	FILE	-RSAcert	Client certificate file.
force-ssl	BOOLEAN	-ssl	Force SSL mode on the port.
hosts-file	FILE	-host	File of target hosts to scan.
ignore-code	STRING	-IgnoreCode	Ignore these status codes and treat them as negative responses.
scan-tuning	STRING	-Tuning	Scan tuning to control which test categories run.
use-cookies	BOOLEAN	-usecookies	Use cookies from responses in future requests.
mutate-options	STRING	-mutate-options	Provide information for mutates.
root-directory	STRING	-root	Prepend a root value to all requests, format is /directory.
client-cert-key	FILE	-key	Client certificate key file.
follow-redirects	BOOLEAN	-followredirects	Follow 3xx redirects to the new location.
evasion-technique	STRING	-evasion	Encoding technique used to evade IDS filtering.
host-authentication	STRING	-id	Host authentication to use, format is id:pass or id:pass:realm.

example

Run nikto

nikto · command

# scan a host over SSL, narrow the tests, and write XML for a reportnikto -host example.com -port 443 -ssl -Tuning 123b -Format xml -o scan.xml

sample output

- Nikto v2.5.0---------------------------------------------------------------------------+ Target IP:          203.0.113.10+ Target Hostname:    example.com+ Target Port:        443+ Start Time:         2026-06-18 14:22:07 (GMT0)---------------------------------------------------------------------------+ Server: nginx+ /: The X-Content-Type-Options header is not set.+ /: The anti-clickjacking X-Frame-Options header is not present.+ /admin/: Admin login page/section found.+ /backup/: Directory indexing found.+ 7915 requests: 0 error(s) and 6 item(s) reported on remote host+ End Time:           2026-06-18 14:39:51 (GMT0) (1064 seconds)

guidance

Choosing nikto

Reach for nikto when you want a quick known-issue pass on a single live web host. Feed it hosts from httpx and bound runs with -maxtime. For current CVE templates at scale, use nuclei instead or alongside.

nuclei

Template-driven scanner with a large community ruleset. Prefer it for current CVE coverage and pipeline scale.

wapiti

Active web vulnerability scanner that crawls and fuzzes. nikto leans on a known-issue database instead of crawling.

whatweb

Fingerprints the stack rather than testing for flaws. Run it alongside nikto to identify what you are scanning.

faq

nikto questions

Set -host to the target, for example `nikto -host example.com`. Add -port and -ssl for HTTPS. On the node, map the target to the host input instead of typing the flag.

Run nikto yourself

A host list is probed by httpx, then nikto scans the live web servers for known issues and writes the findings as a queryable output.

Open nikto in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.

Probe a live web server for known dangerous paths

What nikto does

Where nikto fits

Surface known web server issues

Scan a named virtual host

Export structured findings

Bound long scans

nikto inputs and flags

Run nikto

Choosing nikto

nuclei

wapiti

whatweb

nikto questions

More Scanners tools

ac-scanner

airixss

bedrock-keys-security

cmseek

jaeles

joomscan

Run nikto yourself