Web application · Open source (GNU GPLv2)

Nikto

Nikto is a free, open-source web server scanner. It checks a target web server against thousands of known issues: dangerous or outdated files and scripts, outdated server software versions, insecure server configuration, default files and other common problems. It is fast to run and requires almost no setup, which makes it a popular quick first pass to enumerate obvious web server weaknesses before deeper manual testing begins.

Last updated: 6 August 2026

What Nikto is actually used for

Nikto rapidly fingerprints a web server and fires a large list of checks at it: it looks for leftover admin scripts, backup files, dangerous CGIs, verbose server banners, missing security headers and outdated components. A tester runs it early on a target to get a quick inventory of low-hanging issues, then follows up manually or with Burp/ZAP on anything interesting. It is comprehensive in breadth of checks but makes no attempt to be quiet, so it is used where stealth is not a requirement.

Platforms

Linux · Windows · macOS

Licence

Open source (GNU GPLv2)

Commands worth knowing

nikto -h https://example.com

Scan a target web server for known issues and misconfigurations.

nikto -h 10.10.10.5 -p 8080

Scan a web service running on a non-standard port.

nikto -h example.com -ssl

Force an SSL/TLS scan of an HTTPS service.

nikto -h example.com -o report.html -Format htm

Save results to an HTML report for review.

nikto -h example.com -Tuning 1

Restrict checks to a category (here, interesting/dangerous files) for a focused run.

nikto -h example.com -useproxy http://127.0.0.1:8080

Route the scan through Burp/ZAP to log requests for analysis.

The legal line

Scan only web servers you own or are explicitly authorised to test. Nikto sends thousands of requests and probes for sensitive files, which clearly constitutes active testing; doing so against a third-party site without permission can be unauthorised access under the IT Act 2000. Confirm written scope before running it.

What Nikto is bad at

Nikto is deliberately noisy and trivially detected and blocked by WAFs and IDS, so it is unsuitable for stealthy engagements. Its signature-based checks generate false positives that must be verified, and it does not perform deep application logic testing. It is a broad first-pass tool, not a complete assessment.

Alternatives, and when to pick them

Tool	Pick it when
OWASP ZAP	You want a full web app scanner and proxy rather than a server-focused checker.
Nuclei	You want fast, template-driven and easily updated vulnerability checks.
WhatWeb	You mainly need to fingerprint the technologies a site runs.
Wapiti	You want a lightweight command-line scanner that also tests app-level injection.
Nmap http-* NSE scripts	You want targeted web checks inside an existing Nmap workflow.

Where we teach it

Ethical Hacking Course (6 months) — web reconnaissance module

We are not affiliated with, endorsed by, or a reseller for the vendors of any tool on this site.

Nikto — FAQs

What is Nikto used for?

▾

Nikto is a web server scanner that quickly checks a site for known dangerous files, outdated software, misconfigurations and default content. Testers use it as a fast first pass to surface obvious issues before deeper manual testing.

Is Nikto stealthy?

▾

No. Nikto is intentionally loud, sending thousands of requests with recognisable patterns. WAFs and intrusion detection systems flag it easily, so it is used where detection is acceptable, not for covert testing.

Does Nikto exploit vulnerabilities?

▾

No. It identifies potential issues and outdated components but does not exploit them. Findings need manual verification, and exploitation, if in scope, is done separately with other tools.

Nikto scan ke results par bharosa kar sakte hain kya?

▾

Nikto broad checks karta hai lekin false positives deta hai. Har finding ko manually verify karein; ise ek quick starting point ki tarah use karein, final proof ki tarah nahi.

Learn Nikto properly, in a legal lab

Free counselling call. We will tell you honestly whether a full course is worth it for what you actually want to do.

Call +91 75175 72000