root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat nikto.md
// web

Nikto

21 Jul 2026 · 5 min read
webcheatsheetsnikto
Nikto is an open-source web server scanner that looks for insecure configurations, dangerous files and scripts, outdated versions and known vulnerabilities. It is one of the first tools you run against an HTTP/HTTPS target to get a quick map of its attack surface.

Nikto is noisy by design: it fires thousands of known requests without caring about stealth, so any IDS/WAF will spot it instantly. Its value lies not in evasion but in the coverage and speed of a first sweep; its findings are leads you must always verify by hand, because it produces false positives easily.

1. Beginner level — scanning, SSL and reports

NIKTO cheat sheet — Beginner
CommandWhat it does
nikto -h <t>Basic web vulnerability scan
nikto -h <t> -p 80,443Specify the ports to scan
nikto -h <t> -o out.html -Format htmSave the output as HTML
nikto -h <t> -sslForce the use of SSL/TLS
nikto -h <t> -Tuning 1Limit the scan to a single category
nikto -h <t> -nointeractiveRun without interactive pauses
nikto -h <t> -Display VShow detailed information
nikto -updateUpdate the plugin database
nikto -h <t> -maxtime 60sLimit the total scan time
nikto -h <t> -useproxyUse the default configured proxy
nikto -h <t> -timeout 10Adjust the connection timeout
nikto -h <t> -no404Disable the 404 error check
nikto -VersionShow the installed version
nikto -h <t> -ask noDon't prompt when finding false positives

2. Advanced level — evasion, plugins and mutation

NIKTO cheat sheet — Advanced
CommandWhat it does
nikto -h <t> -Tuning 9Only tests of interest (SQLi, XSS...)
nikto -h <t> -evasion 1Apply IDS evasion techniques
nikto -h <t> -mutate 1Generate username combinations
nikto -h <t> -Cgidirs allForce the check of all CGI directories
nikto -h <t> -vhost <dominio>Specify a particular virtual host
nikto -h <t> -id user:passHTTP basic authentication
nikto -h <t> -Plugins "@@ALL"Run all available plugins
nikto -h <t> -404code 302Redefine which code means "not found"
nikto -config <file>Use your own configuration file
nikto -h <t> -T 0123456789Run all test categories
nikto -h <t> -root <path>Add a base path to the tests
nikto -h <t> -Save <dir>Save the HTTP responses received
nikto -h <t> -mutate 4Force mutation with your own dictionary
nikto -h <t> -Format msf+Export results ready for Metasploit

3. Details people miss

  • Nikto is extremely noisy: it fires thousands of requests and shows up immediately in any log, IDS or WAF. Don't use it when you need stealth.
  • Keep the database up to date with nikto -update before scanning; an old DB misses recent checks.
  • It produces plenty of false positives, especially if the server returns 200 for non-existent paths. Always verify findings by hand and tune with -no404 or -404code.
  • The -ssl flag forces TLS even when the port isn't 443; handy for HTTPS services on non-standard ports that Nikto won't detect on its own.
  • The -evasion techniques obfuscate URLs to bypass simple filters, but a modern WAF recognizes them and they can also break valid checks.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.