Nikto is a web server scanner used to identify vulnerabilities, misconfigurations, and outdated software. Here are some examples of its usage :
Basic Examples
- Scan a Target Host :
nikto -h http://example.com
Performs a basic scan on the specified host to identify vulnerabilities.
- Scan a Specific Port :
nikto -h http://example.com -p 8080
Targets a specific port (e.g., 8080) for scanning.
- Save Results to a File :
nikto -h http://example.com -o results.txt
Saves the scan results to a file named results.txt
- Scan an HTTPS Website :
nikto -h https://example.com
Scans a secure website using HTTPS.
- Use a Proxy :
nikto -h http://example.com -useproxy http://proxyserver:port
Routes the scan through a specified proxy server.
Advanced Examples
- Custom User-Agent :
nikto -h http://example.com -useragent "CustomUserAgent"
Uses a custom User-Agent string for the scan.
- Tuning Options :
nikto -h http://example.com -Tuning 123
Specifies tuning options to focus on specific types of tests (e.g., file uploads, injection flaws).
- Scan Multiple Hosts :
nikto -h hosts.txt
Scans multiple hosts listed in a file (hosts.txt)
- Output in Different Formats :
nikto -h http://example.com -Format html -o report.html
Saves the results in HTML format for easier viewing.
- Evade IDS/IPS :
nikto -h http://example.com -evasion 1
Uses evasion techniques to bypass intrusion detection/prevention systems.
Practical Applications
- Web Server Security : Identify vulnerabilities like outdated software, misconfigurations, and dangerous files.
- Compliance Testing : Ensure web servers meet security standards.
- Penetration Testing : Assess the security posture of web applications.
