loading
Loading content
loading
Scanners
Bundled web server checks for dangerous files and outdated software.
overview
Point nikto at a live host after httpx confirms the port answers. It walks a bundled check database for dangerous files, outdated server versions, and common misconfigurations, then reports what responds.
Set -host and -port, force TLS with -ssl, narrow categories with -Tuning, and cap the run with -maxtime. -Format writes csv, html, xml, nbe, or txt for triage downstream.
Wire the node with -host after httpx confirms the port; output is a results file and folder for downstream triage. Prefer nuclei when you need template-driven CVE coverage across many targets.
source github.com/sullo/nikto
use cases
Scan a live host to catch dangerous files, outdated software, and misconfigurations from nikto's checks before deeper manual testing.
Set -vhost so the Host header targets the right application on a server that routes multiple sites by name behind one IP.
Write output as XML or CSV with -Format so results feed a report generator or land in a queryable table for triage.
Use -maxtime and -Pause to cap how long a single host takes and space requests, keeping a broad scan from stalling on one slow server.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| host | STRING | -host | Target host to scan. |
| port | STRING | -port | Port to use (default 80). |
| force-ssl | BOOLEAN | -ssl | Force SSL mode on the port. |
| format | STRING | -Format | Output file format (csv, html, nbe, txt, xml). |
| scan-tuning | STRING | -Tuning | Narrow the test categories run against the target. |
| plugins | STRING | -Plugins | Select which plugins to run (default: ALL). |
| maxtime | STRING | -maxtime | Maximum testing time per host (e.g. 1h, 60m, 3600s). |
| proxy | STRING | -useproxy | Route requests through a proxy (http://server:port). |
Showing key inputs. nikto exposes 32 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| host | STRING | -host | Target host. |
| port | STRING | -port | Port to use (default 80). |
| pause | STRING | -Pause | Pause between tests in seconds (integer or float). |
| proxy | STRING | -useproxy | Use the proxy defined in nikto.conf, or an http://server:port argument. |
| until | STRING | -until | Run until the specified time or duration. |
| vhost | STRING | -vhost | Virtual host to send in the Host header. |
| config | FILE | -config | Use this config file. |
| format | STRING | -Format | Output file format (csv, html, nbe, txt, xml). |
| mutate | STRING | -mutate | Guess additional file names. |
| no-404 | BOOLEAN | -no404 | Disable nikto's attempt to guess a 404 page. |
| no-ssl | BOOLEAN | -nossl | Disable the use of SSL. |
| dbcheck | BOOLEAN | -dbcheck | Check the database and other key files for syntax errors. |
| display | STRING | -Display | Turn display outputs on or off (options: 1, 2, 3, 4, D, E, P, S, V). |
| maxtime | STRING | -maxtime | Maximum testing time per host (e.g. 1h, 60m, 3600s). |
| plugins | STRING | -Plugins | List of plugins to run (default: ALL). |
| timeout | STRING | -timeout | Timeout for requests (default 10 seconds). |
| userdbs | STRING | -Userdbs | Load only user databases, not the standard databases. |
| cgi-dirs | STRING | -Cgidirs | Scan these CGI dirs: "none", "all", or values like "/cgi/ /cgi-a/". |
| no-slash | BOOLEAN | -noslash | Strip the trailing slash from a URL (e.g. '/admin/' to '/admin'). |
| nolookup | BOOLEAN | -nolookup | Disable DNS lookups. |
| rsa-cert | FILE | -RSAcert | Client certificate file. |
| force-ssl | BOOLEAN | -ssl | Force SSL mode on the port. |
| hosts-file | FILE | -host | File of target hosts to scan. |
| ignore-code | STRING | -IgnoreCode | Ignore these status codes and treat them as negative responses. |
| scan-tuning | STRING | -Tuning | Scan tuning to control which test categories run. |
| use-cookies | BOOLEAN | -usecookies | Use cookies from responses in future requests. |
| mutate-options | STRING | -mutate-options | Provide information for mutates. |
| root-directory | STRING | -root | Prepend a root value to all requests, format is /directory. |
| client-cert-key | FILE | -key | Client certificate key file. |
| follow-redirects | BOOLEAN | -followredirects | Follow 3xx redirects to the new location. |
| evasion-technique | STRING | -evasion | Encoding technique used to evade IDS filtering. |
| host-authentication | STRING | -id | Host authentication to use, format is id:pass or id:pass:realm. |
example
# scan a host over SSL, narrow the tests, and write XML for a reportnikto -host example.com -port 443 -ssl -Tuning 123b -Format xml -o scan.xml- Nikto v2.5.0---------------------------------------------------------------------------+ Target IP: 203.0.113.10+ Target Hostname: example.com+ Target Port: 443+ Start Time: 2026-06-18 14:22:07 (GMT0)---------------------------------------------------------------------------+ Server: nginx+ /: The X-Content-Type-Options header is not set.+ /: The anti-clickjacking X-Frame-Options header is not present.+ /admin/: Admin login page/section found.+ /backup/: Directory indexing found.+ 7915 requests: 0 error(s) and 6 item(s) reported on remote host+ End Time: 2026-06-18 14:39:51 (GMT0) (1064 seconds)guidance
Reach for nikto when you want a quick known-issue pass on a single live web host. Feed it hosts from httpx and bound runs with -maxtime. For current CVE templates at scale, use nuclei instead or alongside.
Template-driven scanner with a large community ruleset. Prefer it for current CVE coverage and pipeline scale.
Active web vulnerability scanner that crawls and fuzzes. nikto leans on a known-issue database instead of crawling.
Fingerprints the stack rather than testing for flaws. Run it alongside nikto to identify what you are scanning.
faq
related
Reflection triage for parameter URLs during recon.
CMS detection and version fingerprinting.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Bypass 403/40X restrictions through smart request manipulation.
YAML template scanner for live hosts; scope runs with tags and severity.
Modular multi-protocol credential brute forcer with response filtering.
A host list is probed by httpx, then nikto scans the live web servers for known issues and writes the findings as a queryable output.
Facts on this page come from the live Trickest tool library.