loading
Loading content
loading
Scanners
Deprecated host-list wrapper for nikto. Prefer the nikto node.
overview
nikto-list feeds a file of hosts into the nikto web server scanner so each target gets the same known-issue checks in one pass. Prefer the nikto node for new work; this wrapper is deprecated.
Flags mirror nikto: -port, -ssl, -Format, -Tuning, -vhost, -useproxy, and -maxtime. Results land as a file and a folder for downstream parse or storage.
Trickest still exposes nikto-list so older workflows keep running. New builds should call nikto with a host file, since the base scanner now accepts multiple targets on its own.
source github.com/sullo/nikto
use cases
Point nikto-list at a host-list file and it runs nikto's full check catalog against every server, so one node covers an entire list instead of a node per target.
nikto flags outdated server software, dangerous default and backup files, and missing security headers across Apache, nginx, and IIS, which surfaces low-hanging web issues fast.
Set -Format to csv or xml so the combined results across every host feed a report or a queryable table for review.
Leave nikto-list where an older workflow already references it; for new builds, switch to nikto directly with a host file, since the base scanner is now multi-target.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| host-list | FILE | · | File listing the target hosts to scan. |
| port | STRING | -port | Port to use (default 80). |
| format | STRING | -Format | Output file format (csv, html, nbe, txt, xml). |
| vhost | STRING | -vhost | Virtual host for the Host header. |
| force-ssl | BOOLEAN | -ssl | Force SSL mode on the port. |
| scan-tuning | STRING | -Tuning | Limit which test categories run (scan tuning). |
| maxtime | STRING | -maxtime | Maximum testing time per host (e.g. 1h, 60m, 3600s). |
| user-agent | STRING | -useragent | Override the default user agent. |
Showing key inputs. nikto-list exposes 27 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| port | STRING | -port | Port to use (default 80). |
| proxy | STRING | -useproxy | Route through a proxy: use nikto.conf's setting or pass http://server:port. |
| until | STRING | -until | Run until the specified clock time or duration. |
| vhost | STRING | -vhost | Virtual host to send in the Host header. |
| format | STRING | -Format | Output file format: csv, html, nbe, txt, or xml. |
| mutate | STRING | -mutate | Guess additional file and directory names. |
| no-404 | BOOLEAN | -no404 | Disable nikto's guessing of the 404 page. |
| no-ssl | BOOLEAN | -nossl | Disable the use of SSL. |
| dbcheck | BOOLEAN | -dbcheck | Check the scan databases and key files for syntax errors. |
| display | STRING | -Display | Turn display outputs on or off (1, 2, 3, 4, D, E, P, S, V). |
| maxtime | STRING | -maxtime | Maximum testing time per host (e.g. 1h, 60m, 3600s). |
| timeout | STRING | -timeout | Timeout for requests (default 10 seconds). |
| userdbs | STRING | -Userdbs | Load only user databases, not the standard ones. |
| cgi-dirs | STRING | -Cgidirs | CGI directories to scan: none, all, or paths like /cgi/ /cgi-a/. |
| nolookup | BOOLEAN | -nolookup | Disable DNS lookups. |
| rsa-cert | FILE | -RSAcert | Client certificate file. |
| force-ssl | BOOLEAN | -ssl | Force SSL mode on the port. |
| host-list | FILE | · | File listing the target hosts to scan. |
| IgnoreCode | STRING | -IgnoreCode | HTTP codes to ignore and treat as negative responses. |
| use-config | FILE | -config | Use this configuration file. |
| user-agent | STRING | -useragent | Override the default user agent. |
| scan-tuning | STRING | -Tuning | Limit which test categories run (scan tuning). |
| mutate-options | STRING | -mutate-options | Extra information to guide the mutate tests. |
| root-directory | STRING | -root | Prepend a root path to all requests, format /directory. |
| client-cert-key | FILE | -key | Client certificate key file. |
| evasion-technique | STRING | -evasion | IDS evasion encoding technique to apply. |
| host-authentication | STRING | -id | Host authentication, format id:pass or id:pass:realm. |
example
# scan every host in the file, force SSL, CSV report, cap each host at 20mnikto -h hosts.txt -ssl -Format csv -Tuning 9 -maxtime 20m -o report.csv- Nikto v2.5.0+ Target IP: 198.51.100.23+ Target Hostname: example.com+ Target Port: 443+ Server: nginx/1.24.0+ /: The X-Content-Type-Options header is not set.+ /: The Strict-Transport-Security HTTP header is not defined.+ /robots.txt: Entry '/admin/' is returned, see robots.txt.+ /admin/: Admin login page/section found.+ 8071 requests: 0 error(s) and 4 item(s) reported on remote hostguidance
Use nikto-list only to keep an existing multi-target workflow running. For new builds, call nikto with a host file. The base scanner now handles multiple targets, and this wrapper is deprecated.
The base scanner, now multi-target on its own. Use it instead of nikto-list in any new workflow.
Template-driven scanner with broad CVE coverage. Prefer it for scale and current checks.
Active web vulnerability scanner that crawls and fuzzes rather than running a known-issue database.
faq
related
Reflection triage for parameter URLs during recon.
CMS detection and version fingerprinting.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Bundled web server checks for dangerous files and outdated software.
Bypass 403/40X restrictions through smart request manipulation.
YAML template scanner for live hosts; scope runs with tags and severity.
A host list is probed by httpx, then nikto-list scans every live server for known issues and writes the combined findings as a queryable output.
Facts on this page come from the live Trickest tool library.