top of page

MeshForge

Nikto: The Automated Web Vulnerability Scanner That Finds the Embarrassing Stuff


Series: The Community's Red Team

Post: 04 of 17

Tags: nikto, web scanning, vulnerability scanning, web server, tools

Read time: ~8 min

Prerequisites: Post 01 — Methodology Overview, Post 03 — Gobuster


Nikto is not subtle. It doesn't pretend to be subtle. It fires thousands of checks at a web server as fast as it can and reports back everything it finds — outdated software versions, dangerous HTTP methods that shouldn't be enabled, default files that should have been deleted, security headers that are missing, and configuration mistakes that make attackers' lives considerably easier.

It will absolutely show up in logs. Any IDS worth its configuration will flag it. You run Nikto when you have authorization and when noise is acceptable, and you run it because the things it finds in five minutes would take you hours to check manually.

Gobuster finds hidden paths. Nikto finds problems with the server itself and what it's exposing. They're complementary — run both on every web target.

What Nikto Actually Checks

Nikto maintains a database of known vulnerabilities, misconfigurations, and interesting files. When you point it at a server it checks:

  • Server and software versions — is the web server, CMS, or application running an outdated version with known CVEs?

  • Default and test files — phpinfo.php, test.php, backup.php, admin consoles left over from installations

  • HTTP methods — is PUT, DELETE, or TRACE enabled? Each of these being accessible is a finding

  • Security headers — is the server missing X-Frame-Options, X-XSS-Protection, Content-Security-Policy?

  • Interesting paths — login pages, admin panels, documentation that reveals software and version

  • SSL/TLS configuration — weak ciphers, expired certs, misconfigurations

  • Common vulnerabilities — known CVEs for detected software versions

It's not a deep application-layer scanner. It won't find SQL injection or XSS in your custom code. What it finds is the infrastructure layer — the web server, the platform, the configuration. That layer has plenty of ways in on its own.


Basic Usage

Point it at a target and let it run:

nikto -h http://<target>

That's it for a basic scan. -h is the host. Nikto will fingerprint the server, run its full check database against it, and print findings as it goes.

For HTTPS:

nikto -h https://<target>

Or with the explicit SSL flag if auto-detection fails:

nikto -h <target> -ssl -p 443

Non-Standard Ports

Nikto defaults to port 80. If the web server is on another port:

nikto -h http://<target> -p 8080
nikto -h http://<target>:8080

Both work. When Nmap shows a web server on an unusual port — 8443, 8000, 8180, 10000 — always run Nikto against it specifically. Admin panels and management interfaces on non-standard ports are often less hardened than the main application.


Scanning a Specific Virtual Host

When a server runs multiple virtual hosts, you can target a specific one:

nikto -h http://<target> -vhost admin.target.htb

This tells Nikto to use that hostname in its Host: header — so it hits the right application instead of the default one.


Saving Output

Always save Nikto output. The scan takes time and you don't want to re-run it:

nikto -h http://<target> -o nikto.txt -Format txt

Other output formats: htm for HTML, csv for spreadsheet-friendly, xml for tool integration. Text is the most readable for manual review.


Tuning: Focus the Scan

Nikto's -Tuning flag lets you run only specific categories of checks. Useful when you know what you're looking for and don't want to wait for the full scan:

Flag

Category

1

Interesting files / default files

2

Misconfiguration

3

Information disclosure

4

Injection (XSS/Script/HTML)

5

Remote file retrieval

6

Denial of service

7

Remote file retrieval (server root)

8

Command execution / remote shell

9

SQL injection

0

File upload

b

Outdated software

x

All checks

# Only check for outdated software
nikto -h http://<target> -Tuning b

# Only check for SQL injection
nikto -h http://<target> -Tuning 9

# Run all checks explicitly
nikto -h http://<target> -Tuning x

For a quick first pass, -Tuning b (outdated software) combined with the default run covers most high-value findings efficiently.


Reading Nikto Output

A typical Nikto result looks something like this:

- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          10.10.10.50
+ Target Hostname:    target.htb
+ Target Port:        80
---------------------------------------------------------------------------
+ Server: Apache/2.4.41 (Ubuntu)
+ /: The anti-clickjacking X-Frame-Options header is not present.
+ /: The X-Content-Type-Options header is not set.
+ /: Server may leak inodes via ETags, header found with file /
+ /phpinfo.php: Output from the phpinfo() function was found.
+ /phpinfo.php: PHP is installed, and a test script which runs phpinfo() was found.
+ OSVDB-3092: /backup/: This might be interesting.
+ OSVDB-3268: /config/: Directory indexing found.
+ Apache/2.4.41 appears to be outdated (current is at least Apache/2.4.54).
+ OSVDB-3233: /icons/README: Apache default file found.
+ HTTP method: The server allows the HTTP TRACE method.
+ 8835 requests: 0 error(s) and 11 item(s) reported

Here's what each finding type means and how to respond:

Server version disclosure (Apache/2.4.41 (Ubuntu)) The server is announcing its version. Cross-reference with CVEs. Apache 2.4.41 has known vulnerabilities — search site:nvd.nist.gov apache 2.4.41 or check ExploitDB.

Missing security headers (X-Frame-Options, X-Content-Type-Options) These are misconfigurations, not direct exploits. Worth noting in a report but don't chase them when there are more interesting findings to pursue.

phpinfo.php found Stop what you're doing and visit this immediately. phpinfo() dumps the complete PHP configuration: version, loaded modules, environment variables, server root path, disabled functions, and sometimes file system paths. This information narrows your attack surface significantly and sometimes reveals credentials stored in environment variables.

Directory indexing (/config/: Directory indexing found) The server is listing directory contents instead of serving an index page. Navigate to that path and look at every file in it. A /config/ directory with indexing enabled almost certainly contains configuration files.

Backup directories (/backup/: This might be interesting) Check it. Backup directories contain exactly what they sound like — backups of the application, database dumps, config files from before hardening.

HTTP TRACE method enabled TRACE echoes back the full request including headers. Enables cross-site tracing (XST) attacks. Flag it.

Default files (/icons/README: Apache default file found) Default installation files that should have been removed. Their presence means this server hasn't been fully hardened — which usually means other things haven't been hardened either. The default files themselves aren't exploitable but they're a signal.

OSVDB numbers OSVDB (Open Source Vulnerability Database) references. Look these up if you want details on the specific finding. The description in the output is usually enough to understand the issue.


The Workflow: Nikto + Gobuster Together

These two tools cover different ground. Use them together:

Nmap → identifies web server on port 80
  ↓
Gobuster dir → finds hidden paths (/admin, /backup, /.git, /api)
  ↓
Nikto → identifies server vulnerabilities, misconfigs, exposed files
  ↓
Manual follow-up on findings from both

Run them in parallel when possible. While Gobuster is grinding through a medium wordlist (5-10 minutes), Nikto's scan is running simultaneously (5-15 minutes). By the time both finish you have a complete picture of the web surface.


What Nikto Won't Find

Be clear about what you're not getting from Nikto so you don't miss attack surface by assuming it covered everything:

Application logic vulnerabilities — SQL injection in custom code, IDOR (insecure direct object references), authentication bypasses specific to the application. Nikto checks for generic vulnerabilities, not application-specific logic flaws.

Hidden endpoints — Nikto doesn't brute force paths. That's Gobuster's job. Nikto scans paths it knows about from its database, not arbitrary paths.

Business logic issues — price manipulation, privilege escalation through the application, CSRF on specific forms. These require manual testing.

Modern JavaScript app vulnerabilities — Nikto was built for traditional server-rendered apps. Single-page React/Vue apps have a different attack surface that needs different tooling.

For everything Nikto misses on the application layer, you need manual testing with Burp Suite. That's a later topic.


Quick Reference

# Basic scan
nikto -h http://<target>

# HTTPS
nikto -h https://<target>

# Non-standard port
nikto -h http://<target> -p 8080

# Target specific vhost
nikto -h http://<target> -vhost <hostname>

# Save output
nikto -h http://<target> -o nikto.txt -Format txt

# Check outdated software only
nikto -h http://<target> -Tuning b

# SQL injection checks
nikto -h http://<target> -Tuning 9

# Everything
nikto -h http://<target> -Tuning x

# Run against multiple targets from file
nikto -h targets.txt

# Combine with custom port and output
nikto -h http://<target> -p 8443 -ssl -o nikto_8443.txt -Format txt

What's Next

At this point in a web engagement you've run Nmap, Gobuster, and Nikto. You have a map of the web surface, a list of hidden paths, and a report of server-level vulnerabilities. Now you follow the findings.

If Gobuster found a login page, Post 07 (Hydra) covers brute forcing credentials.

If Nikto found an outdated CMS version or specific CVE, research that CVE and check Post 12 (Metasploit) for a module.

If the Nmap scan from Post 02 also showed SMB open, don't wait on the web results — Post 05 (Enum4linux) runs the SMB enumeration path in parallel.

MeshForge — Training the Community's Red Team

They count on your ignorance. The exploit only works on the uninformed.

 
 
 

Comments

bottom of page