By Davy Rogers. Use these techniques only in environments you own or have explicit permission to test.

Active Reconnaissance: Web Server Scanning with Nikto

Nikto is an open-source web server scanner that tests for thousands of potentially dangerous files, outdated server versions, server misconfigurations, and known vulnerabilities. It's loud (not stealthy) but incredibly thorough for web application security assessment. Nikto is essential for discovering low-hanging fruit in web servers.

What You'll Learn

  • What Nikto is and how it works
  • Basic and advanced Nikto usage
  • Understanding Nikto scan results
  • Testing for specific vulnerabilities
  • Custom scan configurations
  • Combining Nikto with other tools
  • Defensive measures against scans
  • Alternative web scanners

What Is Nikto?

Overview:

Nikto = Open-source web server scanner

Purpose:
- Identify dangerous files (scripts, admin pages)
- Detect outdated software versions
- Find server misconfigurations
- Check for known vulnerabilities
- Test for default files
- Discover web server info

Created by: Chris Sullo
Language: Perl
License: GPL

What Nikto Checks:

✓ 6,700+ potentially dangerous files/programs
✓ Outdated versions of 1,250+ servers
✓ Version-specific problems on 270+ servers
✓ Server configuration issues
✓ Default files and directories
✓ Insecure files and scripts
✓ SSL/TLS issues
✓ XSS vulnerabilities (limited)
✓ SQL injection (limited)
✓ And much more!

Important Note:

⚠️ Nikto is LOUD!
- Sends thousands of requests
- Easy to detect
- Will appear in logs
- May trigger IDS/IPS

Use only on:
✓ Systems you own
✓ Authorized penetration tests
✗ Never on production without permission

Installation

Linux:

# Debian/Ubuntu
sudo apt update
sudo apt install nikto

# From GitHub (latest version)
git clone https://github.com/sullo/nikto
cd nikto/program
perl nikto.pl -h

macOS:

# Homebrew
brew install nikto

# Or from source
git clone https://github.com/sullo/nikto
cd nikto/program
perl nikto.pl -h

Windows:

# Install Perl first (Strawberry Perl or ActivePerl)
# Then clone from GitHub
git clone https://github.com/sullo/nikto
cd nikto\program
perl nikto.pl -h

# Or use WSL

Verify Installation:

nikto -Version

Basic Nikto Usage

Scan a Host:

nikto -h http://example.com

What happens:

1. Nikto connects to target
2. Identifies server type and version
3. Runs 6,700+ tests
4. Reports findings

⏱️ Duration: 5-15 minutes (depending on server)

Scan HTTPS:

nikto -h https://example.com

Scan Specific Port:

nikto -h example.com -p 8080

# Multiple ports
nikto -h example.com -p 80,443,8080

Scan Multiple Hosts:

# From file
nikto -h hosts.txt

# hosts.txt:
# http://example.com
# https://test.com
# http://192.168.1.100

Understanding Nikto Output

Sample Output:

- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          93.184.216.34
+ Target Hostname:    example.com
+ Target Port:        80
+ Start Time:         2024-01-01 12:00:00
---------------------------------------------------------------------------
+ Server: Apache/2.4.41 (Ubuntu)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-Content-Type-Options header is not set.
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Apache/2.4.41 appears to be outdated; verify against vendor and distribution advisories
+ Server may leak inodes via ETags, header found with file /, inode: 29cd, size: 5e8cf
+ Allowed HTTP Methods: GET, POST, OPTIONS, HEAD
+ /icons/README: Apache default file found.
+ /phpmyadmin/: phpMyAdmin directory found
+ 7863 requests: 0 error(s) and 8 item(s) reported on remote host
+ End Time:           2024-01-01 12:12:34 (754 seconds)
---------------------------------------------------------------------------

Interpreting Results:

Legacy Vulnerability References:

Older Nikto output and write-ups may mention OSVDB identifiers.
OSVDB is no longer the place to verify findings.

Example:
/icons/README: Apache default file

Use the finding text, CVEs, vendor advisories, the NVD, and the Nikto
database entry to validate whether the issue still matters.

Severity Levels:

Nikto doesn't explicitly rate severity, but look for:

Critical:
- Default credentials
- Known exploits
- SQL injection
- RCE vulnerabilities

High:
- Outdated software
- Admin interfaces
- Backup files

Medium:
- Missing security headers
- Information disclosure

Low:
- Default files
- Server version disclosure

Advanced Nikto Options

Tuning (Select Specific Tests):

# Tune options:
# 1 - Interesting Files
# 2 - Misconfiguration
# 3 - Information Disclosure
# 4 - Injection (XSS/Script/HTML)
# 5 - Remote File Retrieval
# 6 - Denial of Service
# 7 - Remote File Upload
# 8 - Command Execution
# 9 - SQL Injection
# 0 - File Upload
# a - Authentication Bypass
# b - Software Identification
# c - Remote Source Inclusion
# x - Reverse Tuning (exclude)

# Run specific tests
nikto -h example.com -Tuning 9  # SQL Injection only

# Multiple tests
nikto -h example.com -Tuning 1,2,3

# All except DOS
nikto -h example.com -Tuning x6

Authentication:

# Basic auth
nikto -h example.com -id username:password

# Form-based (limited support)
nikto -h example.com -id username:password -evasion 1

Custom Headers:

# Add custom header
nikto -h example.com -useragent "Custom User Agent"

# Multiple headers
nikto -h example.com -header "Authorization: Bearer TOKEN"

SSL/TLS Testing:

# Test HTTPS with all SSL checks
nikto -h https://example.com -ssl

# Ignore SSL certificate errors
nikto -h https://example.com -nossl

Evasion Techniques:

# Evasion options (limited effectiveness):
# 1 - Random URI encoding
# 2 - Directory self-reference (/./)
# 3 - Premature URL ending
# 4 - Prepend long random string
# 5 - Fake parameter
# 6 - TAB as request spacer
# 7 - Change case (URL)
# 8 - Use Windows directory separator (\)

nikto -h example.com -evasion 1,2,3

Save Output:

# Text format
nikto -h example.com -o report.txt

# HTML format
nikto -h example.com -o report.html -Format html

# CSV format
nikto -h example.com -o report.csv -Format csv

# XML format
nikto -h example.com -o report.xml -Format xml

Specific Vulnerability Tests

Test for Shellshock:

nikto -h example.com -Tuning 8

Test for XSS:

nikto -h example.com -Tuning 4

Test for SQL Injection:

nikto -h example.com -Tuning 9

Test for File Upload:

nikto -h example.com -Tuning 0,7

Test for Default Credentials:

nikto -h example.com -Tuning a

Combining Nikto with Other Tools

Workflow: Nmap → Nikto

# Step 1: Nmap finds web servers
nmap -p 80,443,8080,8443 192.168.1.0/24 -oG web_servers.txt

# Step 2: Extract IPs with open web ports
grep "80/open\|443/open" web_servers.txt | cut -d' ' -f2 > targets.txt

# Step 3: Nikto scans each
while read ip; do
    nikto -h http://$ip -o nikto_$ip.html -Format html
done < targets.txt

Nikto + Metasploit:

# Run Nikto
nikto -h example.com -o nikto_results.xml -Format xml

# Import into Metasploit
msfconsole
msf> db_import nikto_results.xml
msf> hosts
msf> vulns

Nikto + Burp Suite:

# Configure Nikto to use Burp as proxy
nikto -h example.com -useproxy http://127.0.0.1:8080

# All Nikto requests go through Burp
# Review in Burp's HTTP history
# Further test interesting findings manually

Common Findings and How to Fix

1. Missing Security Headers:

Finding:

+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-Content-Type-Options header is not set.

Fix (Apache):

# .htaccess or httpd.conf
Header always set X-Frame-Options "DENY"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Content-Security-Policy "default-src 'self'; frame-ancestors 'none'"
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

Fix (Nginx):

add_header X-Frame-Options "DENY";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none'";
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()";

2. Outdated Server Version:

Finding:

+ Apache/2.4.41 appears to be outdated

Fix:

# Update server software using the supported package channel
sudo apt update
sudo apt upgrade apache2

Then verify the result against the vendor release notes, distro security advisories, and any backported patches. Distribution packages may keep an older-looking version string while still carrying security fixes.

# Or hide version
# Apache:
ServerTokens Prod
ServerSignature Off

# Nginx:
server_tokens off;

3. Default Files Found:

Finding:

+ /icons/README: Apache default file found.

Fix:

# Remove default files
sudo rm /var/www/html/icons/README

# Disable directory listing
# Apache:
Options -Indexes

# Nginx:
autoindex off;

4. Admin Interface Exposed:

Finding:

+ /phpmyadmin/: phpMyAdmin directory found
+ /admin/: Admin login page found

Fix:

1. Move to non-standard URL
2. Require authentication
3. IP whitelist
4. Use VPN
5. Don't expose publicly!

# Apache IP restriction:
<Directory "/var/www/html/admin">
    Require ip 192.168.1.0/24
</Directory>

5. Methods Allowed:

Finding:

+ Allowed HTTP Methods: GET, POST, OPTIONS, HEAD, PUT, DELETE, TRACE

Fix:

# Apache: Limit methods
<Directory "/var/www/html">
    <LimitExcept GET POST HEAD>
        Require all denied
    </LimitExcept>
</Directory>

# Nginx: Limit methods
if ($request_method !~ ^(GET|POST|HEAD)$ ) {
    return 405;
}

Defensive Measures

Detecting Nikto Scans:

1. Web Application Firewall (WAF):

ModSecurity (Apache/Nginx):
- Detects common Nikto patterns
- Blocks suspicious requests
- Rate limiting

Rules:
SecRule REQUEST_URI "@contains /cgi-bin/" "deny,status:403"
SecRule HTTP_USER_AGENT "@contains nikto" "deny,status:403"

2. Intrusion Detection System (IDS):

Snort/Suricata rules:
- Detect Nikto user agent
- Many requests to non-existent files
- Pattern matching

alert tcp any any -> $HTTP_SERVERS $HTTP_PORTS (msg:"Nikto Scan Detected"; content:"Nikto"; http_user_agent; sid:1000001;)

3. Log Monitoring:

# Look for Nikto in logs
grep -i "nikto" /var/log/apache2/access.log

# Many 404s in short time
awk '$9 == 404' /var/log/apache2/access.log | wc -l

# Unusual user agents
grep -oP 'Mozilla.*' /var/log/apache2/access.log | sort | uniq -c | sort -rn

4. Rate Limiting:

# Apache mod_evasive
<IfModule mod_evasive20.c>
    DOSHashTableSize 3097
    DOSPageCount 5
    DOSSiteCount 100
    DOSPageInterval 1
    DOSSiteInterval 1
    DOSBlockingPeriod 60
</IfModule>

# Nginx rate limiting
limit_req_zone $binary_remote_addr zone=one:10m rate=5r/s;

server {
    location / {
        limit_req zone=one burst=10;
    }
}

Alternative Web Scanners

Similar Tools:

1. WhatWeb:

# Identify web technologies
whatweb example.com

# More aggressive
whatweb -a 3 example.com

2. WPScan (WordPress):

# WordPress-specific scanner
wpscan --url http://example.com --enumerate u,p,t

# With API token (more features)
wpscan --url http://example.com --api-token YOUR_TOKEN

3. Nmap HTTP Scripts:

# HTTP enumeration
nmap -p 80,443 --script=http-enum example.com

# HTTP vulnerabilities
nmap -p 80,443 --script=http-vuln-* example.com

4. Burp Suite (Commercial):

Professional web scanner
Manual + automated testing
Better than Nikto for serious pentesting

5. OWASP ZAP:

Free, open-source
GUI-based
Active + passive scanning
Good for beginners

Try It Yourself

Exercise 1: Basic Scan

# Scan official test site
nikto -h http://scanme.nmap.org

# Review findings

Exercise 2: Targeted Testing

# Test for SQL injection only
nikto -h http://testphp.vulnweb.com -Tuning 9

# Test for XSS
nikto -h http://testphp.vulnweb.com -Tuning 4

Exercise 3: Save Report

# Scan and save HTML report
nikto -h http://example.com -o report.html -Format html

# Open in browser
firefox report.html

Exercise 4: Custom Configuration

# Scan with custom user agent and save
nikto -h http://example.com -useragent "MyScanner/1.0" -o custom_scan.txt

Quick Reference

Basic Scans:
nikto -h <URL>                          # Basic scan
nikto -h <URL> -p 8080                  # Specific port
nikto -h <URL> -ssl                     # HTTPS scan

Tuning:
nikto -h <URL> -Tuning 1                # Interesting files
nikto -h <URL> -Tuning 9                # SQL injection
nikto -h <URL> -Tuning 1,2,3            # Multiple tests
nikto -h <URL> -Tuning x6               # All except DOS

Authentication:
nikto -h <URL> -id user:pass            # Basic auth

Output:
nikto -h <URL> -o report.txt            # Text
nikto -h <URL> -o report.html -Format html  # HTML
nikto -h <URL> -o report.xml -Format xml    # XML

Other:
nikto -h <URL> -useproxy http://proxy:8080  # Through proxy
nikto -h <URL> -evasion 1,2,3           # Evasion techniques
nikto -h <URL> -useragent "Custom"      # Custom user agent

Resources

Official:

Documentation:

  • Man Page: man nikto
  • Help: nikto -H

Practice Sites:

  • scanme.nmap.org: Official Nmap test site
  • testphp.vulnweb.com: Vulnerable PHP site (Acunetix)
  • testaspnet.vulnweb.com: Vulnerable ASP.NET site

Application Security:

Reading:

Next Steps

  1. Run basic scans on practice targets
  2. Learn tuning options for focused testing
  3. Integrate with other tools (nmap, Burp, Metasploit)
  4. Understand findings and remediation
  5. Practice on intentionally vulnerable apps (DVWA, WebGoat)

Nikto is loud but effective for quick web server assessment. Use it as a first pass, then follow up with manual testing!

Up next

Active Recon - Visual Recon

Screenshot and triage web targets at scale using modern visual reconnaissance workflows.