1NIKTO(1) NIKTO(1)
2
6 nikto - Scan web server for known vulnerabilities
7
9 /usr/local/bin/nikto [options...]
10
12 Examine a web server to find potential problems and security
13 vulnerabilities, including:
14 · Server and software misconfigurations
16 · Default files and programs
18 · Insecure files and programs
20 · Outdated servers and programs
22 Nikto is built on LibWhisker (by RFP) and can run on any platform which
24 has a Perl environment. It supports SSL, proxies, host authentication,
25 IDS evasion and more. It can be updated automatically from the
26 command-line, and supports the optional submission of updated version
27 data back to the maintainers.
28
30 Below are all of the Nikto command line options and explanations. A
31 brief version of this text is available by running Nikto with the -h
32 (-help) option.
33 -Cgidirs
35 Scan these CGI directories. Special words "none" or "all" may be
36 used to scan all CGI directories or none, (respectively). A literal
37 value for a CGI directory such as "/cgi-test/" may be specified
38 (must include trailing slash). If this is option is not specified,
39 all CGI directories listed in config.txt will be tested.
40 -config
42 Specify an alternative config file to use instead of the config.txt
43 located in the install directory.
44 -dbcheck
46 Check the scan databases for syntax errors.
47 -Display
49 Control the output that Nikto shows. See Chapter 5 for detailed
50 information on these options. Use the reference number or letter to
51 specify the type, multiple may be used:
52 1 - Show redirects
54 2 - Show cookies received
56 3 - Show all 200/OK responses
58 4 - Show URLs which require authentication
60 D - Debug Output
62 V - Verbose Output
64 -evasion
66 Specify the LibWhisker IDS evasion technique to use (see the
67 LibWhisker docs for detailed information on these). Use the
68 reference number to specify the type, multiple may be used:
69 1 - Random URI encoding (non-UTF8)
71 2 - Directory self-reference (/./)
73 3 - Premature URL ending
75 4 - Prepend long random string
77 5 - Fake parameter
79 6 - TAB as request spacer
81 7 - Change the case of the URL
83 8 - Use Windows directory separator (\)
85 -findonly
87 Only discover the HTTP(S) ports, do not perform a security scan.
88 This will attempt to connect with HTTP or HTTPS, and report the
89 Server header.
90 -Format
92 Save the output file specified with -o (-output) option in this
93 format. If not specified, the default will be taken from the file
94 extension specified in the -output option. Valid formats are:
95 csv - a comma-seperated list
97 htm - an HTML report
99 txt - a text report
101 xml - an XML report
103 -host
105 Host(s) to target. Can be an IP address, hostname or text file of
106 hosts. A single dash (-) maybe used for stdout. Can also parse nmap
107 -oG style output
108 -Help
110 Display extended help information.
111 -id
113 ID and password to use for host Basic host authentication. Format
114 is "id:password".
115 -list-plugins
117 Will list all plugins that Nikto can run against targets and then
118 will exit without performing a scan. These can be tuned for a
119 session using the -plugins option.
120 The output format is:
122 Plugin name
124 full name - description
126 Written by author, Copyright (C) copyright
128 -mutate
130 Specify mutation technique. A mutation will cause Nikto to combine
131 tests or attempt to guess values. These techniques may cause a
132 tremendous amount of tests to be launched against the target. Use
133 the reference number to specify the type, multiple may be used:
134 1 - Test all files with all root directories
136 2 - Guess for password file names
138 3 - Enumerate user names via Apache (/~user type requests)
140 4 - Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type
142 requests)
143 5 - Attempt to brute force sub-domain names, assume that the host
145 name is the parent domain
146 6 - Attempt to guess directory names from the supplied dictionary
148 file
149 -mutate-options
151 Provide extra information for mutates, e.g. a dictionary file
152 -nolookup
154 Do not perform name lookups on IP addresses.
155 -nossl
157 Do not use SSL to connect to the server.
158 -no404
160 Disable 404 (file not found) checking. This will reduce the total
161 number of requests made to the webserver and may be preferable when
162 checking a server over a slow link, or an embedded device. This
163 will generally lead to more false positives being discovered.
164 -output
166 Write output to the file specified. The format used will be taken
167 from the file extension. This can be over-riden by using the
168 -Format option (e.g. to write text files with a different
169 extenstion. Existing files will have new information appended.
170 -plugins
172 Select which plugins will be run on the specified targets. A comma
173 separated list should be provided which lists the names of the
174 plugins. The names can be found by using -list-plugins.
175 There are two special entries: ALL, which specifies all plugins
177 shall be run and NONE, which specifies no plugins shall be run. The
178 default is ALL
179 -port
181 TCP port(s) to target. To test more than one port on the same host,
182 specify the list of ports in the -p (-port) option. Ports can be
183 specified as a range (i.e., 80-90), or as a comma-delimited list,
184 (i.e., 80,88,90). If not specified, port 80 is used.
185 -Pause
187 Seconds to delay between each test.
188 -root
190 Prepend the value specified to the beginning of every request. This
191 is useful to test applications or web servers which have all of
192 their files under a certain directory.
193 -ssl
195 Only test SSL on the ports specified. Using this option will
196 dramatically speed up requests to HTTPS ports, since otherwise the
197 HTTP request will have to timeout first.
198 -Single
200 Perform a single request to a target server. Nikto will prompt for
201 all options which can be specified, and then report the detailed
202 output. See Chapter 5 for detailed information.
203 -timeout
205 Seconds to wait before timing out a request. Default timeout is 10
206 seconds.
207 -Tuning
209 Tuning options will control the test that Nikto will use against a
210 target. By default, if any options are specified, only those tests
211 will be performed. If the "x" option is used, it will reverse the
212 logic and exclude only those tests. Use the reference number or
213 letter to specify the type, multiple may be used:
214 0 - File Upload
216 1 - Interesting File / Seen in logs
218 2 - Misconfiguration / Default File
220 3 - Information Disclosure
222 4 - Injection (XSS/Script/HTML)
224 5 - Remote File Retrieval - Inside Web Root
226 6 - Denial of Service
228 7 - Remote File Retrieval - Server Wide
230 8 - Command Execution / Remote Shell
232 9 - SQL Injection
234 a - Authentication Bypass
236 b - Software Identification
238 c - Remote Source Inclusion
240 x - Reverse Tuning Options (i.e., include all except specified)
242 The given string will be parsed from left to right, any x
244 characters will apply to all characters to the right of the
245 character.
246 -useproxy
248 Use the HTTP proxy defined in the configuration file.
249 -update
251 Update the plugins and databases directly from cirt.net.
252 -Version
254 Display the Nikto software, plugin and database versions.
255 -vhost
257 Specify the Host header to be sent to the target.
258
260 nikto.conf
261 The Nikto configuration file. This sets Nikto´s global options.
262 Several nikto.conf files may exist and are parsed in the below
263 order. As each configuration file is loaded is supersedes any
264 previously set configuration:
265 · System wide (e.g. /etc/nikto.conf)
267 · Home directory (e.g. $HOME/nikto.conf)
269 · Current directory (e.g. ./nikto.conf)
271 ${NIKTO_DIR}/plugins/db*
273 db files are the databases that nikto uses to check for
274 vulnerabilities and issues within the web server.
275 ${NIKTO_DIR}/plugins/*.plugin
277 All nikto´s plugins exist here. Nikto itself is just a wrapper
278 script to manage CLI and pass through to the plugins.
279 ${NIKTO_DIR}/templates
281 Contains the templates for nikto´s output formats.
282
284 The current features are not supported:
285 · SOCKS Proxies
287
289 Nikto was originally written and maintained by Sullo, CIRT, Inc. It is
290 currently maintained by David Lodge. See the main documentation for
291 other contributors.
292 All code is (C) CIRT, Inc., except LibWhisker which is (C) rfp.labs
294 (wiretrip.net). Other portions of code may be (C) as specified.
295
297 Nikto Homepage[1]
298
300 1. Nikto Homepage
301 http://www.cirt.net/
302 01/19/2010 NIKTO(1)