Vulnerability Analysis · Module 05
Nikto
Scan web servers for known vulnerabilities and misconfigurations.
Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.
Definition
Nikto is an open-source command-line web server scanner.
Identify known vulnerable files/CGIs, outdated server software, misconfigurations, and other common web server issues.
Web server reconnaissance and vulnerability scanning during authorized web and infrastructure assessments.
Key features
Tests against a large database of known vulnerable files and banners.
Can scan HTTPS services and report certificate/protocol issues.
Narrow the scan to specific vulnerability categories.
Text, HTML, CSV and XML reports.
Can route scans through an HTTP proxy.
Important commands
nikto -h <target>Default scan against the target host.
nikto -h <target> -p <port>Scan a specific port.
nikto -h <target> -sslForce an SSL/TLS scan.
nikto -h <target> -o report.html -Format htmSave output as an HTML report.
nikto -h <target> -Tuning xRestrict the scan to specific test categories.
Practical examples
nikto -h http://192.168.1.50
Purpose Runs a standard scan for common web server issues.
nikto -h https://192.168.1.50 -ssl -o report.html -Format htm
Purpose Scans an HTTPS service and saves an HTML report.
nikto -h 192.168.1.50 -Tuning 1,2,3
Purpose Limits testing to selected categories to reduce time and noise.
Important points
- Noisy by design: Nikto is not stealthy — it is easily logged and detected by WAFs/IDS.
- False positives: Signature checks can flag issues that are not exploitable — verify manually.
- Not an exploitation tool: It identifies potential issues but does not exploit them.
- Authorization required: Scanning without permission can be disruptive and is often illegal.
Common use cases
Identify outdated software and default/insecure files.
Early-stage scanning before manual testing.
Check for missing headers, exposed directories and risky defaults.
Validate that known web server issues were fixed.
This tool is taught in Module 05
Read the full written notes, with diagrams, defense and detection.