Nikto is one of the oldest and most widely known open-source web server vulnerability scanners. Despite its age, it remains relevant in modern security programs due to its speed, transparency, and ability to uncover misconfigurations, outdated software, and dangerous defaults in web environments.
Unlike stealthy commercial scanners, Nikto is loud by design—making it ideal for internal testing, blue-team validation, and audit preparation rather than covert penetration testing.
This article explains what Nikto is, how it works, what it can and cannot detect, and how security teams should use it responsibly.
Nikto is an open-source web server scanner written in Perl that performs comprehensive checks against HTTP/HTTPS services.
It focuses on:
Nikto does not exploit vulnerabilities—it identifies exposure, leaving exploitation decisions to humans.
Think of Nikto as a misconfiguration and hygiene scanner, not an exploitation framework.
Nikto performs signature-based testing by sending thousands of HTTP requests and comparing responses against a large vulnerability database.
Core techniques include:
Because Nikto sends requests sequentially and without evasion, it is easily detected by WAFs, IDS, and SIEM tools.
Nikto is available by default on most security-focused Linux distributions.
sudo apt update
sudo apt install niktobrew install niktonikto -Versionnikto -h https://example.comThis performs:
Nikto frequently reports issues such as:
Apache/2.4.49 appears to be outdatedRisk: Known vulnerabilities may exist Mitigation: Patch or upgrade the server
Allowed HTTP Methods: GET, POST, PUT, DELETERisk: Unauthorized file upload or deletion Mitigation: Restrict methods at the web server or reverse proxy
X-Frame-Options header is not presentRisk: Clickjacking attacks Mitigation: Add headers via web server or application configuration
/config.php found and accessibleRisk: Credential leakage Mitigation: Remove files or enforce access controls
nikto -h example.com -p 80,443,8080Useful when:
nikto -h https://example.com -sslNikto can identify:
⚠ Nikto is not a replacement for dedicated TLS tools like
testssl.sh.
nikto -h example.com -o nikto-report.txtnikto -h example.com -Format html -o nikto-report.htmlThis is particularly useful for:
nikto -h example.com -Tuning xbTuning options allow you to:
Nikto is powerful—but not sufficient on its own.
Modern web applications require dynamic scanners (DAST) and manual testing in addition to Nikto.
Nikto is best used as:
For ISO 27001-aligned programs, Nikto supports:
⚠ Never run Nikto against systems you do not own or have permission to test.
Nikto scans are:
Always ensure:
Nikto remains a reliable and transparent web security scanner for identifying exposed risks that attackers frequently exploit.
While it cannot replace modern DAST tools or manual testing, it excels at:
For security teams focused on visibility, compliance, and hygiene, Nikto still earns its place in the toolkit.
Security starts with visibility—and Nikto provides plenty of it.
Love it? Share this article:
Content Security PolicyContent Security Policy (CSP): The Definitive Guide to Web Application Hardening
An in-depth exploration of Content Security Policy (CSP), how it enforces browser-level security, common bypass techniques used by hackers, and best practices for robust implementation.
May 23, 2026XSS
AppSecHTTP Header Injection: Unpacking CRLF Vulnerabilities and Response Splitting
A comprehensive deep dive into HTTP Header Injection (CRLF Injection), its mechanisms, real-world impact such as Response Splitting and Cache Poisoning, along with code examples and protection strategies.
Mar 6, 2026OWASP
LaravelHardening Your Laravel Application: A Comprehensive Guide
An in-depth guide on securing and hardening Laravel applications, exploring common threats, and providing practical code samples and actionable steps to protect your data.
Feb 28, 2026OWASP
Web SecurityiFrame Injection vs DOM Injection: Understanding Two Common Web-Based Attack Techniques
Learn the cybersecurity differences between iFrame injection and DOM injection, including real-world attack scenarios, code samples, detection strategies, and mitigation techniques.
Feb 4, 2026OWASP
MongoDBMongoBleed (CVE-2025-14847): How a Single Metadata Bug Leaked MongoDB Memory at Internet Scale
A deep technical and executive-level analysis of MongoBleed (CVE-2025-14847), explaining the root cause, attacker workflow, real-world impact, and how organizations should patch and respond.
Jan 2, 2026CISO
Agentic AIAgentic AI Security: What CISOs Must Govern Before Autonomous Systems Govern You
A CISO-focused guide to governing agentic AI systems before autonomous decision-making introduces security, compliance, and operational risk.
Dec 23, 2025Autonomous Systems
Quantum SecurityQuantum Risk Is No Longer Theoretical: A CISO Playbook for Crypto-Agility
Quantum computing is turning long-term encryption into a present-day risk. This CISO playbook explains why crypto-agility is essential and how organizations can prepare for post-quantum threats today.
Dec 23, 2025Crypto-Agility
Zero TrustZero Trust Has Failed (and What CISOs Are Doing Differently in 2026)
Zero Trust was supposed to eliminate implicit trust—but in practice, it often became another checkbox framework. This article examines why Zero Trust failed and how CISOs are redefining security strategies in 2026.
Dec 22, 2025Risk Management