Nikto Cheat Sheet

Nikto — web server scanner: outdated software, misconfigurations, dangerous files, vulnerabilities. Fast, but noisy (log it). Run after nmap confirms web ports.

Basic Scan

• Scan a host nikto -h http://target
• Scan with port nikto -h http://target -p 8080
• Scan HTTPS nikto -h https://target
• Output to a file nikto -h http://target -o nikto-out.txt
• Output format: txt/html/xml/csv/msf -Format html

Caching / Speed

• Tune scan speed -Tuning 1 (see below) — reduce noise/time
• Skip unneeded tests: -Tuning x codes:
  • 1 interesting file/seen in logs
  • 2 misconfiguration / default files
  • 3 information disclosure
  • 4 injection (XSS/Script/HTML)
  • 5 remote file retrieve (WebServer)
  • 6 denial of service
  • 7 remote file retrieve (Open Source)
  • 8 command execution / remote shell
  • 9 SQL injection
  • 0 file upload
  • x exit on first match
• Only run specific checks: e.g. -Tuning 123 = interesting files + misconfig + info disclosure (common safe default)

Evasion Options

• Random delays between requests -evasion 7 (bitmask: 1 URI encoding, 2 random URI, 3 self-referential, 4 premature session ending, 5 trailing space, 6 directory self reference, 7 file fuzzing)
• Use a proxy -useproxy http://127.0.0.1:8080
• Set User-Agent / Cookie -useragent "UA" -Cookie "x=1"
• Only do HEAD/GET? -method

Authentication

• Basic auth -id user:pass
• Form-based auth: hackish — pass -form plus note; use Burp for complex sessions and feed to nikto via -cookie

Banner & Fingerprint focus

• -banner banner grabbing
• Check CGI dirs /cgi-bin/, /vhost/, /docs/

Integration

• Output to Metasploit db -Format msf+ then import
• Feed host list nikto -h 10.0.0.0/24 (from -h file.txt too)

Remember

• Nikto finds known issues & files — always follow with gobuster/ffuf (content discovery) and manual headers review (curl -I, server headers).
• Results are a checklist, not a verdict — verify everything manually afterwards.