Nikto is an open-source web server scanner that is used to identify potential security vulnerabilities in web servers and web applications. It is also included in the Kali Linux OS and is widely used by security professionals and penetration testers for web application security assessments. As such I have listed it under both scanners and vulnerability assessment tools. Nikto is designed to perform comprehensive scans of web servers, providing valuable information about potential weaknesses that could be exploited by attackers. If your are a bug bounty hunter, you could also make good use of this tool. Its not just for penetration testers and ethical hackers.
sudo apt install nikto
The tool should come pre-installed with kali but if not you can install it as shown above.
I scanned my local webserver on my network using the command shown below. You can replace the IP address with your domain namme. As you can see it is able to find vulnerabilities in a lot of things from the configiruation information to the version information, directories on the server and much more.
nikto -h 192.168.43.141
To save the output, you can use the -Format and specify a format. In this case, I went with CSV but the following are also supported
nikto -h 192.168.43.141 -Format csv -output nikto.csvt
We can also use nikto to check for specific issues on the web server. By default it outputs all the problems that it finds but we can filter for specific issues. We do this using the tuning options. Number 4 is for cross site scripts/injections.
nikto -h 192.168.43.141 -Tuning 4
There are other tunining options and scan options. The command below will show the options that you can use.
nikto -H
Here are some additional examples of using nikto
Scanning multiple target ports instead of only using port 80 which is the default
nikto -h 192.168.43.141 -port 80,443,8080
Ignore status codes 404
nikto -h 192.168.43.141 -no 404