nikto
A fast web server scanner that checks for thousands of known misconfigurations, dangerous files, and outdated software in one pass.
Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.
01The quick first look at a web server
nikto is a broad, noisy, fast checklist against a web server. It throws thousands of known tests at a target: dangerous default files, outdated server software, revealing headers, directory listing, common misconfigurations. It is not subtle and it is not stealthy; it is the tool you run early to catch the obvious problems quickly, before you move to focused tools. Think of it as a smoke alarm, not a surgeon.
02Install
$ sudo emerge net-analyzer/nikto # Gentoo
$ sudo apt install nikto # Debian / Ubuntu / Kali
$ sudo dnf install nikto # Fedora / RHEL (EPEL)
03A basic scan
Point it at a host with -h. It fingerprints the server and runs its checks, printing findings as it goes. On HTTPS it figures out the port, or you give it -ssl and a port.
$ nikto -h https://target
04Tuning what it checks
The full test set is loud. -Tuning narrows it to categories you care about, which cuts both time and noise. Use -T followed by category numbers, for instance injection and file-upload tests only.
$ nikto -h https://target -Tuning 1234
$ nikto -h https://target -Tuning x6
05Saving reports
For anything you will act on, write a report. nikto emits HTML, CSV, and XML, which is better than scrolling the terminal for a scan with many findings.
$ nikto -h https://target -o report.html -Format htm
06Things to know
» nikto is deliberately noisy; it will light up any IDS instantly, so it is a poor choice when stealth matters.
» Many findings are informational, not vulnerabilities; read them, do not just count them.
» -useproxy routes it through Burp or ZAP so you can see and replay what it sent.
» It tests the server and known files, not your application logic; pair it with ffuf, sqlmap, and a proxy for real coverage.
07Clearing a nikto report on your own server
Run nikto against your own site and work the list top to bottom; most findings have a one-line fix. Missing security headers, directory indexing, leftover default files, and an outdated server version are the usual haul, and all are quick wins that measurably shrink your exposure.
» Set the security headers it flags: X-Content-Type-Options, a Content-Security-Policy, HSTS on HTTPS.
» Turn off directory indexing so folders without an index page do not list their contents.
» Remove default, sample, and backup files from the web root.
» Keep the server software current; an outdated nginx or Apache banner is both a finding and a real risk.
Authorized use only
The tools and techniques in these guides are for defending, testing, and understanding systems you own or have explicit written permission to assess. Unauthorized access to computers, networks, accounts, or data is a criminal offense in nearly every jurisdiction, and the penalties are real.
A few of the laws that apply, by way of example:
- Philippines: Cybercrime Prevention Act of 2012 (Republic Act No. 10175)
- United States: Computer Fraud and Abuse Act (18 U.S.C. § 1030)
- United Kingdom: Computer Misuse Act 1990
- European Union: Directive 2013/40/EU on attacks against information systems, as implemented by each member state
- Most other countries have equivalent computer-misuse laws
Wherever you are, the rule is the same: get authorization in writing, stay within the agreed scope, and never touch a system that is not yours to test. If you are unsure whether something is permitted, treat it as not permitted until you have clear authorization.
This is general information, not legal advice.