NIKTO.PL(1)

📦
version 2.6.1 · 4 versions
, in arch rolling, nixpkgs unstable

💅 NIKTO.PL(1) — Vulnerability Scanner 💅

okay bestie, welcome to nikto.pl, the manual page that's about to make you a web-server-scanning icon ✨ (yes, the manpage name is literally that — nikto.pl, section 1, and now you know 🫶)

🌸 SYNOPSIS 🌸

nikto.pl [options...]

that's it. that's the whole vibe. options go in, magic comes out 💫

✨ DESCRIPTION ✨

Nikto is an Open Source web server scanner, and she is thorough, okay? She runs comprehensive tests against web servers for a whole bunch of things that are, generally speaking, considered dangerous. Like, red-flag energy. Here's what she checks for 👇

  • Server and software misconfigurations
  • Default files and programs
  • Insecure files and programs
  • Outdated servers and programs
  • Dangerous files
  • Other problems

Nikto is built on LibWhisker2 (LW2) and can run on any platform that has a Perl environment. No cap, any platform. She's also fluent in SSL, proxies, host authentication, attack encoding, and more 🦋 She can be updated automatically straight from the command-line, and she supports the optional submission of updated version data back to the maintainers (we love a girl who gives back 💖).

💅 OPTIONS 💅

  • -ask yes|no|auto — whether she should ask you about submitting updates. Options: yes (ask about each one), no (don't ask, don't send), auto (don't ask, just send). pick your level of chattiness 🗣️
  • -Add-header header:value — adds HTTP headers. can be used multiple times, one per header pair. stack 'em like bracelets 🎀
  • -check6 — checks if IPv6 is actually working (connects to ipv6.google.com, or whatever value is set in nikto.conf).
  • -Cgidirs dirs — scan these CGI directories. the special words none or all may be used. you can also hand her a literal value for a CGI directory like /cgi-test/ — but bestie, it must include the trailing slash, don't embarrass me 💀
  • -config file — use this config file instead of the default nikto.conf.
  • -dbcheck — check the database and other key files for syntax errors. like a vibe check but for files 🔍
  • -Display options — turn display outputs on/off: 1 (show redirects), 2 (show cookies received), 3 (show all 200/OK responses), 4 (show URLs which require authentication), D (debug output), E (display all HTTP errors), P (print progress to STDOUT), S (scrub output of IPs and hostnames), V (verbose output).
  • -evasion technique — the encoding technique, pick your fighter: 1 (random URI encoding), 2 (directory self-reference), 3 (premature URL ending), 4 (prepend long random string), 5 (fake parameter), 6 (TAB as request spacer), 7 (change the case of the URL), 8 (use Windows directory separator), A (use carriage return as request spacer), B (use binary value 0x0b as request spacer), R (random User-Agent from database; default is the first entry; ignored when -useragent is set; note the suggested-headers check always uses the first entry regardless). yeah that last bit is a lot, i know 😭
  • -followredirects — follow 3xx redirects to the new location. she'll chase it down 🏃‍♀️
  • -Format format — the save file format: csv (Comma-separated-value), json (JSON Format), htm (HTML Format), sql (Generic SQL, see docs for schema), sqld (SQL Direct, directly inserts into MySQL/PostgreSQL database), txt (Plain text), xml (XML Format). multiple formats can be specified as a comma-separated list. if you don't specify one, the format gets taken from the file extension you passed to -output.
⚠️ heads up: sqld format requires DB_TYPE, DB_HOST, DB_PORT, DB_NAME in nikto.conf and the NIKTO_DB_USER, NIKTO_DB_PASS environment variables. no shortcuts, she needs all of it 🔥
  • -Help — display extended help information. the extended cut, director's edition ✨
  • -host target — the host(s) to target. can be an IP address, hostname or text file of hosts. a single dash (-) may be used for stdout. she can also parse nmap -oG style output 👑 versatile queen.
  • -id id:pass[:realm] — ID and password to use for host Basic host authentication. format is "id:password" or "id:password:realm".
  • -ipv4 — IPv4 only.
  • -ipv6 — IPv6 only.
  • -key file — client certificate key file.
  • -list-plugins — list all available plugins and perform no testing. just a lil show-and-tell 🎀
  • -maxtime time — maximum testing time per host (e.g., 1h, 60m, 3600s).
  • -mutate options — guess additional file names: 1 (test all files with all root directories), 2 (guess for password file names), 3 (enumerate user names via Apache), 4 (enumerate user names via cgiwrap).
  • -mutate-options options — provide information for mutates.
  • -nocheck — do not check for updates on startup. successful version checks are otherwise cached for 6 hours in EXECDIR/.last_update_check — delete that file to force a fresh check 🗑️
  • -nocookies — do not use cookies from responses in requests.
  • -nointeractive — disable interactive features. she'll stop asking, she'll just go 💅
  • -nolookup — do not perform name lookups on IP addresses.
  • -noslash — strip the trailing slash from the URL (e.g., /admin/ to /admin).
  • -nossl — do not use SSL to connect to the server.
  • -nosslkeepalive — disable TLS connection reuse (keep-alive is on by default). useful for servers that misbehave with reused TLS sessions. some servers simply cannot handle the reconnection arc 😭
  • -Option name=value — override an option in nikto.conf. can be issued multiple times.
  • -output file — write output to the file specified ('.' for auto-name). the format used will be taken from the file extension. this can be over-ridden by using the -Format option.
  • -Pause seconds — seconds (integer or floating point) to delay between each test. hydrate between reps bestie 💧
  • -Platform platform — platform of target: nix (Unix/Linux), win (Windows), or all (both).
  • -Plugins list — list of plugins to run (default: ALL).
  • -port ports — TCP port(s) to target. to test more than one port on the same host, specify the list of ports. ports can be specified as a range (i.e., 80-90), or as a comma-delimited list (i.e., 80,88,90). if not specified, port 80 is used.
  • -RSAcert file — client certificate file.
  • -root path — prepend root value to all requests, format is /directory.
  • -Save directory — save positive responses to this directory ('.' for auto-name).
  • -ssl — only test SSL on the ports specified. using this option will dramatically speed up requests to HTTPS ports, since otherwise the HTTP request will have to timeout first. literally a glow-up for your runtime 🔥
  • -timeout seconds — seconds to wait before timing out a request. default timeout is 10 seconds.
  • -Tuning options — tuning options will control the test that Nikto will use against a target. by default, if any options are specified, only those tests will be performed. if the x option is used, it reverses the logic and excludes only those tests. use the reference number or letter to specify the type, multiple may be used:
    • 0 — File Upload
    • 1 — Interesting File / Seen in logs
    • 2 — Misconfiguration / Default File
    • 3 — Information Disclosure
    • 4 — Injection (XSS/Script/HTML)
    • 5 — Remote File Retrieval - Inside Web Root
    • 6 — Denial of Service
    • 7 — Remote File Retrieval - Server Wide
    • 8 — Command Execution / Remote Shell
    • 9 — SQL Injection
    • a — Authentication Bypass
    • b — Software Identification
    • c — Remote Source Inclusion
    • d — WebService
    • e — Administrative Console
    • x — Reverse Tuning Options (i.e., include all except specified)
  • -url target — target host/URL (alias of -host).
  • -Userdbs type — load only user databases, not the standard databases. options: all (disable standard dbs and load only user dbs), tests (disable only db_tests and load udb_tests).
  • -useragent string — forces a specific User-Agent string, overriding the database entirely. she said "i'll be whoever i want" 💅
  • -useproxy proxy — use the HTTP proxy defined in the configuration file, or given as an argument in the format http://server:port.
  • -Version — display the Nikto software, plugin and database versions.
  • -vhost hostname — specify the Host header to be sent to the target.
  • -404code codes — ignore these HTTP codes as negative responses (always). format is "302,301".
  • -404string string — ignore this string in response body content as negative response (always). can be a regular expression.

🦋 DSL MATCHERS 🦋

Nikto's test database supports a mini-DSL for matching responses, and honestly? it's giving tiny-language-that-could ✨ The following matchers are supported:

  • BODY: and !BODY: — match or exclude content in the response body.
  • HEADER: and !HEADER: — match or exclude content in HTTP headers.
  • COOKIE: and !COOKIE: — match or exclude content in HTTP cookies. (NEW 🎉)
  • CODE: and !CODE: — match or exclude HTTP status codes.
BODY:login&&!BODY:logout&&HEADER:X-Powered-By&&COOKIE:sessionid

look at her go 😭 that one line is doing so much.

🎀 FILES 🎀

  • nikto.conf — the Nikto configuration file. this sets Nikto's global options. several nikto.conf files may exist and are parsed in the below order. as each configuration file is loaded it supersedes any previously set configuration:
    • System wide (e.g. /etc/nikto.conf)
    • Home directory (e.g. $HOME/nikto.conf)
    • Current directory (e.g. ./nikto.conf)

bottom of the list wins, so the closest one to you is the main character 👑

  • ${NIKTO_DIR}/databases/db* — database files that nikto uses to check for vulnerabilities and issues within the web server.
  • ${NIKTO_DIR}/plugins/*.plugin — all nikto's plugins exist here. nikto itself is just a wrapper script to manage the CLI and pass through to the plugins. she's the manager, the plugins do the performing 💅
  • ${NIKTO_DIR}/templates — contains the templates for nikto's output formats.

💀 BUGS 💀

the current features are not supported:

  • SOCKS Proxies

that's it, that's the whole list. socks proxies just aren't invited to the party 🙈

🌈 AUTHORS 🌈

Nikto is written and maintained by Chris Sullo and David Lodge. see the main documentation for other contributors 🫶

All code is Copyright CIRT, Inc., except LibWhisker which is Copyright (c) 2009, Jeff Forristal (wiretrip.net). Other portions of code may be (C) as specified.

⭐ SEE ALSO ⭐

  • Nikto Homepage[1]

📝 NOTES 📝

  1. Nikto Homepage http://www.cirt.net/

okay that's the whole page bestie, you're officially certified 📜✨ she's version 2.5, dated 07/30/2026, and she lives at http://www.cirt.net/ — go scan something responsibly, ily, bye 💖🦋🎀

📦 where this page comes from