Scanners
Scan many web servers from one host-list file
Deprecated host-list wrapper for nikto. Prefer the nikto node.
overview
What nikto-list does
nikto-list feeds a file of hosts into the nikto web server scanner so each target gets the same known-issue checks in one pass. Prefer the nikto node for new work; this wrapper is deprecated.
Flags mirror nikto: -port, -ssl, -Format, -Tuning, -vhost, -useproxy, and -maxtime. Results land as a file and a folder for downstream parse or storage.
Trickest still exposes nikto-list so older workflows keep running. New builds should call nikto with a host file, since the base scanner now accepts multiple targets on its own.
source github.com/sullo/nikto
use cases
Where nikto-list fits
Scan a fleet of web servers in one run
Point nikto-list at a host-list file and it runs nikto's full check catalog against every server, so one node covers an entire list instead of a node per target.
Fingerprint outdated and misconfigured servers
nikto flags outdated server software, dangerous default and backup files, and missing security headers across Apache, nginx, and IIS, which surfaces low-hanging web issues fast.
Export findings for triage
Set -Format to csv or xml so the combined results across every host feed a report or a queryable table for review.
Keep a legacy workflow running, then migrate
Leave nikto-list where an older workflow already references it; for new builds, switch to nikto directly with a host file, since the base scanner is now multi-target.
reference
nikto-list inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| host-list | FILE | · | File listing the target hosts to scan. |
| port | STRING | -port | Port to use (default 80). |
| format | STRING | -Format | Output file format (csv, html, nbe, txt, xml). |
| vhost | STRING | -vhost | Virtual host for the Host header. |
| force-ssl | BOOLEAN | -ssl | Force SSL mode on the port. |
| scan-tuning | STRING | -Tuning | Limit which test categories run (scan tuning). |
| maxtime | STRING | -maxtime | Maximum testing time per host (e.g. 1h, 60m, 3600s). |
| user-agent | STRING | -useragent | Override the default user agent. |
Showing key inputs. nikto-list exposes 27 inputs in total.
Full flag reference (27 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| port | STRING | -port | Port to use (default 80). |
| proxy | STRING | -useproxy | Route through a proxy: use nikto.conf's setting or pass http://server:port. |
| until | STRING | -until | Run until the specified clock time or duration. |
| vhost | STRING | -vhost | Virtual host to send in the Host header. |
| format | STRING | -Format | Output file format: csv, html, nbe, txt, or xml. |
| mutate | STRING | -mutate | Guess additional file and directory names. |
| no-404 | BOOLEAN | -no404 | Disable nikto's guessing of the 404 page. |
| no-ssl | BOOLEAN | -nossl | Disable the use of SSL. |
| dbcheck | BOOLEAN | -dbcheck | Check the scan databases and key files for syntax errors. |
| display | STRING | -Display | Turn display outputs on or off (1, 2, 3, 4, D, E, P, S, V). |
| maxtime | STRING | -maxtime | Maximum testing time per host (e.g. 1h, 60m, 3600s). |
| timeout | STRING | -timeout | Timeout for requests (default 10 seconds). |
| userdbs | STRING | -Userdbs | Load only user databases, not the standard ones. |
| cgi-dirs | STRING | -Cgidirs | CGI directories to scan: none, all, or paths like /cgi/ /cgi-a/. |
| nolookup | BOOLEAN | -nolookup | Disable DNS lookups. |
| rsa-cert | FILE | -RSAcert | Client certificate file. |
| force-ssl | BOOLEAN | -ssl | Force SSL mode on the port. |
| host-list | FILE | · | File listing the target hosts to scan. |
| IgnoreCode | STRING | -IgnoreCode | HTTP codes to ignore and treat as negative responses. |
| use-config | FILE | -config | Use this configuration file. |
| user-agent | STRING | -useragent | Override the default user agent. |
| scan-tuning | STRING | -Tuning | Limit which test categories run (scan tuning). |
| mutate-options | STRING | -mutate-options | Extra information to guide the mutate tests. |
| root-directory | STRING | -root | Prepend a root path to all requests, format /directory. |
| client-cert-key | FILE | -key | Client certificate key file. |
| evasion-technique | STRING | -evasion | IDS evasion encoding technique to apply. |
| host-authentication | STRING | -id | Host authentication, format id:pass or id:pass:realm. |
example
Run nikto-list
# scan every host in the file, force SSL, CSV report, cap each host at 20mnikto -h hosts.txt -ssl -Format csv -Tuning 9 -maxtime 20m -o report.csv- Nikto v2.5.0+ Target IP: 198.51.100.23+ Target Hostname: example.com+ Target Port: 443+ Server: nginx/1.24.0+ /: The X-Content-Type-Options header is not set.+ /: The Strict-Transport-Security HTTP header is not defined.+ /robots.txt: Entry '/admin/' is returned, see robots.txt.+ /admin/: Admin login page/section found.+ 8071 requests: 0 error(s) and 4 item(s) reported on remote hostguidance
Choosing nikto-list
Use nikto-list only to keep an existing multi-target workflow running. For new builds, call nikto with a host file. The base scanner now handles multiple targets, and this wrapper is deprecated.
nikto
The base scanner, now multi-target on its own. Use it instead of nikto-list in any new workflow.
nuclei
Template-driven scanner with broad CVE coverage. Prefer it for scale and current checks.
wapiti
Active web vulnerability scanner that crawls and fuzzes rather than running a known-issue database.
faq
nikto-list questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Run nikto-list yourself
A host list is probed by httpx, then nikto-list scans every live server for known issues and writes the combined findings as a queryable output.
Facts on this page come from the live Trickest tool library.