Sweshi's Tutorials

Scanning Tool Tutorials



Vulnerability Analysis Tools Tutorials

nikto tutorial

Share to Facebook
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
nikto introduction

Nikto is an open-source web server scanner that is used to identify potential security vulnerabilities in web servers and web applications. It is also included in the Kali Linux OS and is widely used by security professionals and penetration testers for web application security assessments. As such I have listed it under both scanners and vulnerability assessment tools. Nikto is designed to perform comprehensive scans of web servers, providing valuable information about potential weaknesses that could be exploited by attackers. If your are a bug bounty hunter, you could also make good use of this tool. Its not just for penetration testers and ethical hackers.

nikto installation
sudo apt install nikto

The tool should come pre-installed with kali but if not you can install it as shown above.

nikto usage example: scanning a web server

I scanned my local webserver on my network using the command shown below. You can replace the IP address with your domain namme. As you can see it is able to find vulnerabilities in a lot of things from the configiruation information to the version information, directories on the server and much more.

nikto -h 192.168.43.141 nikto tutorial: scanning my local webserver.
nikto usage example: saving the output

To save the output, you can use the -Format and specify a format. In this case, I went with CSV but the following are also supported

  • text
  • XML
  • NBE
  • CSV
nikto -h 192.168.43.141 -Format csv -output nikto.csvt nikto tutorial:
nikto usage example: checking for cross site scripts

We can also use nikto to check for specific issues on the web server. By default it outputs all the problems that it finds but we can filter for specific issues. We do this using the tuning options. Number 4 is for cross site scripts/injections.

nikto -h 192.168.43.141 -Tuning 4 nikto tutorial:tuning for cross site scripts.
nikto usage example: checking options

There are other tunining options and scan options. The command below will show the options that you can use.

nikto -H nikto tutorial: tuning options.
nikto usage examples

Here are some additional examples of using nikto

Scanning multiple target ports instead of only using port 80 which is the default

nikto -h 192.168.43.141 -port 80,443,8080

Ignore status codes 404

nikto -h 192.168.43.141 -no 404