DEV Community

Abhinav Singwal
Abhinav Singwal

Posted on

Top 20 Nikto Commands Every Security Professional Should Know

#nikto #niktocommands #cybersecurity

Top 20 Nikto Commands Every Security Professional Should Know

Nikto is an open-source web server scanner that performs comprehensive tests against web servers for dangerous files, outdated software, misconfigurations, and other security issues . Written in Perl and built on LibWhisker2, Nikto supports SSL, proxies, host authentication, and attack encoding . Unlike application scanners such as Wapiti, Nikto focuses specifically on server-level reconnaissance and known dangerous paths rather than crawling application logic . This third entry in our series covers the twenty most practical Nikto commands, complete with explanations of when and why to use each one.

Top 20 Commands Nikto

1. Basic Scan Against a Target 

nikto -h http://example.com
Enter fullscreen mode Exit fullscreen mode

The -h flag specifies the target host or URL. This is the simplest invocation and performs a full scan using all default plugins against the specified target. Nikto will probe for dangerous files, CGI scripts, outdated server versions, and common misconfigurations automatically .

2. Scan a Specific Port 

nikto -h 192.168.1.1 -p 8080
Enter fullscreen mode Exit fullscreen mode

The -p flag lets you target non-standard ports where web servers commonly listen. Default is port 80, but many production applications run on 8080, 8443, or custom ports. You can specify multiple ports separated by commas .

3. Scan HTTPS Targets 

nikto -h https://example.com -ssl
Enter fullscreen mode Exit fullscreen mode

The -ssl flag forces Nikto to use SSL/TLS when connecting. This is required for HTTPS targets, especially those using self-signed certificates that would otherwise cause connection failures. The flag tells Nikto to ignore certificate errors and proceed with the scan .

4. Save Output to HTML Report 

nikto -h http://example.com -o scan.html -Format html
Enter fullscreen mode Exit fullscreen mode

The -o flag specifies the output file, and -Format controls the report format. HTML reports are ideal for sharing findings with stakeholders who need a readable summary with severity ratings and descriptions .

5. Save Output in JSON Format 

nikto -h http://example.com -o scan.json -Format json
Enter fullscreen mode Exit fullscreen mode

JSON output is machine-readable and integrates well with CI/CD pipelines, custom dashboards, and vulnerability management platforms. Use this format when you need to parse results programmatically or feed them into other tools .

6. Scan Multiple Ports on One Host 

nikto -h 192.168.0.1 -p 80,443,8080
Enter fullscreen mode Exit fullscreen mode

Nikto accepts a comma-separated list of ports. This is efficient when you need to check several common web ports on a single target without running separate scans .

7. Scan Multiple Hosts from a File 

nikto -h targets.txt
Enter fullscreen mode Exit fullscreen mode

The -h flag accepts a file containing a list of hosts when the argument is not a URL or IP address. This is essential for large-scale assessments where you need to scan dozens or hundreds of targets in a single run .

8. Use Authentication Credentials 

nikto -h http://example.com -id admin:password
Enter fullscreen mode Exit fullscreen mode

The -id flag supplies HTTP Basic authentication credentials in the format username:password. Many web applications require authentication before exposing administrative interfaces or sensitive content .

9. Route Traffic Through a Proxy 

nikto -h http://example.com -useproxy http://127.0.0.1:8080
Enter fullscreen mode Exit fullscreen mode

The -useproxy flag routes all Nikto traffic through an HTTP proxy such as Burp Suite or OWASP ZAP. This lets you inspect, modify, and log every request in real time, which is invaluable for understanding exactly what Nikto is testing .

10. Set a Custom User-Agent 

nikto -h http://example.com -useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
Enter fullscreen mode Exit fullscreen mode

The -useragent flag sets a custom User-Agent string. Some applications serve different content or block requests from default scanner User-Agents. Spoofing a browser string can help bypass basic filtering .

11. Use Tuning to Select Test Categories 

nikto -h http://example.com -Tuning 1234
Enter fullscreen mode Exit fullscreen mode

The -Tuning flag filters which categories of tests Nikto runs. The characters map to test types: 1 (Interesting File), 2 (Misconfiguration), 3 (Information Disclosure), 4 (Injection), 5 (Remote File Retrieval), 6 (DoS), 7 (Server-wide File Retrieval), 8 (Command Execution), 9 (SQL Injection), 0 (File Upload), a (Authentication Bypass), b (Software Identification) .

12. Scan Only Specific Categories 

nikto -h http://example.com -Tuning 34
Enter fullscreen mode Exit fullscreen mode

This example runs only Information Disclosure (3) and Injection (4) tests. Tuning is useful when you want to focus on particular vulnerability classes or reduce scan time on large targets .

13. Use Reverse Tuning (Exclude Categories) 

nikto -h http://example.com -Tuning x6
Enter fullscreen mode Exit fullscreen mode

The x character reverses the tuning logic, running all tests except those specified. In this example, all tests run except Denial of Service (6). This is useful when you want comprehensive coverage but need to exclude potentially disruptive tests .

14. Scan with IDS Evasion Techniques 

nikto -h http://example.com -evasion 1
Enter fullscreen mode Exit fullscreen mode

The -evasion flag applies LibWhisker IDS evasion techniques. Options include: 1 (Random URI encoding), 2 (Directory self-reference), 3 (Premature URL ending), 4 (Prepend long random string), 5 (Fake parameter), 6 (TAB as request spacer), 7 (Change case of URL), 8 (Windows directory separator) .

15. Combine Multiple Evasion Techniques 

nikto -h http://example.com -evasion 123
Enter fullscreen mode Exit fullscreen mode

Multiple evasion techniques can be combined by listing their reference numbers consecutively. This layers multiple obfuscation methods, making detection by IDS/IPS more difficult .

16. List Available Plugins 

nikto -list-plugins
Enter fullscreen mode Exit fullscreen mode

The -list-plugins flag lists all plugins that Nikto can run and then exits without performing a scan. This helps you understand the full scope of available tests and construct precise plugin selections for targeted scans .

17. Run Specific Plugins Only 

nikto -h http://example.com -Plugins "apacheusers"
Enter fullscreen mode Exit fullscreen mode

The -Plugins flag selects which plugins to run. A comma-separated list specifies the plugin names. Special entries include ALL (run all plugins, the default) and NONE (run no plugins). This is useful for focused testing on specific server components .

18. Scan with All CGI Directories 

nikto -h http://example.com -Cgidirs all
Enter fullscreen mode Exit fullscreen mode

The -Cgidirs flag controls which CGI directories are tested. Special values include "none" (skip CGI testing) and "all" (test all known CGI directories). Specific directories can also be provided, such as "/cgi/ /cgi-a/" .

19. Limit Maximum Testing Time 

nikto -h http://example.com -maxtime 1h
Enter fullscreen mode Exit fullscreen mode

The -maxtime flag sets a maximum duration for testing each host. Durations can be specified in hours, minutes, or seconds (e.g., 1h, 60m, 3600s). This prevents scans from stalling indefinitely on slow or unresponsive targets .

20. Update Nikto's Database 

nikto -update
Enter fullscreen mode Exit fullscreen mode

The -update flag updates Nikto's plugins and databases directly from cirt.net. Running this before critical scans ensures you have the latest checks for newly discovered dangerous files and server vulnerabilities .

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Top comments (0)