Performing Web Application Scanning With Nikto

---
name: performing-web-application-scanning-with-nikto
description: Nikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files/programs, checks for outdated versions of over 1,250 servers, and identifies
  ve
tags:
- risk
- nikto
- owasp
- cve
- fetih
- cybersecurity
- vulnerability-management
- siber-güvenlik
- web-scanning
triggers:
- api
- application
- authentication
- certificate
- http
- incident
- log
- network
- nikto
- password
- performing
- scanning
category: vulnerability-management
source_subdomain: vulnerability-management
nist_csf:
- ID.RA-01
- ID.RA-02
- ID.IM-02
- ID.RA-06
adapted_for: fetih
---

# Performing Web Application Scanning with Nikto


## Genel Bakış
Nikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files/programs, checks for outdated versions of over 1,250 servers, and identifies version-specific problems on over 270 servers. It performs comprehensive tests including XSS, SQL injection, server misconfigurations, default credentials, and known vulnerable CGI scripts.


## Ne Zaman Kullanılır

- conducting yaparken security assessments that involve performing web application scanning with nikto
- following yaparken: incident response procedures for related security events
- performing yaparken scheduled security testing or auditing activities
- validating yaparken security controls through hands-on testing

## Ön Gereksinimler
- Nikto kurulu (Perl-based, included in Kali Linux)
- Written authorization to scan target web servers
- Network Erişim: target web applications
- Understanding of HTTP/HTTPS protocols

## Core Concepts

### What Nikto tespit etme (s)
- Server misconfigurations and dangerous default files
- Outdated server software versions with known CVEs
- Common CGI vulnerabilities and dangerous scripts
- Default credentials and admin pages
- HTTP methods that should be disabled (PUT, DELETE, TRACE)
- SSL/TLS misconfigurations and weak ciphers
- Missing security headers (X-Frame-Options, CSP, HSTS)
- Information disclosure through headers and error pages

### Nikto vs Other Web Scanners
| Feature | Nikto | OWASP ZAP | Burp Suite | Nuclei |
|---------|-------|-----------|------------|--------|
| License | Open Source | Open Source | Commercial | Open Source |
| Focus | Server/Config | App Logic | Full Pentest | Template-Based |
| Speed | Fast | Medium | Slow | Very Fast |
| False Positives | Moderate | Low | Low | Low |
| Authentication | Basic | Full | Full | Template |
| Active Community | Yes | Yes | Yes | Yes |

## İş Akışı

### Adım 1: Basic Scanning
```bash
nikto -h https://target.example.com

nikto -h target.example.com -p 8443

nikto -h target.example.com -p 80,443,8080,8443

nikto -h target.example.com -ssl

nikto -h targets.txt
```

### Adım 2: Advanced Scanning Options
```bash
nikto -h https://target.example.com \
  -Tuning 123456789abcde \
  -timeout 10 \
  -Pause 2 \
  -Display V \
  -output report.html \
  -Format htm


nikto -h https://target.example.com -Tuning 49a

nikto -h https://target.example.com -id admin:password

nikto -h https://target.example.com -useproxy http://proxy:8080

nikto -h https://target.example.com -useragent "Mozilla/5.0 (Security Scan)"

nikto -h https://target.example.com -Cgidirs /cgi-bin/,/scripts/

nikto -h https://target.example.com -evasion 1234
```

### Adım 3: Output and Reporting
```bash
nikto -h https://target.example.com -output scan.csv -Format csv
nikto -h https://target.example.com -output scan.xml -Format xml
nikto -h https://target.example.com -output scan.html -Format htm
nikto -h https://target.example.com -output scan.txt -Format txt

nikto -h https://target.example.com -output scan.json -Format json

nikto -h https://target.example.com \
  -output scan_report \
  -Format htm
```

### Adım 4: Scan Multiple Targets
```bash
cat > targets.txt << 'EOF'
https://app1.example.com
https://app2.example.com:8443
http://internal-app.corp.local
192.168.1.100:8080
EOF

nikto -h targets.txt -output multi_scan.html -Format htm

cat targets.txt | parallel -j 5 "nikto -h {} -output {/}_report.html -Format htm"
```

### Adım 5: SSL/TLS Assessment
```bash
nikto -h https://target.example.com -ssl \
  -Tuning b \
  -Display V

```

### Adım 6: Integration with Other Tools
```bash
nmap -p 80,443,8080 --open -oG - 192.168.1.0/24 | \
  awk '/open/{print $2}' | \
  while read host; do nikto -h "$host" -output "${host}_nikto.html" -Format htm; done

nikto -h target.example.com -output msf_import.xml -Format xml

python3 -c "
import xml.etree.ElementTree as ET
tree = ET.parse('scan.xml')
for item in tree.Bul:all('.//item'):
    print(f\"[{item.get('id')}] {item.Bul:text('description', '')[:100]}\")
"
```

## Interpreting Results

### Severity Classification
- **OSVDB/CVE References**: Cross-reference with NVD for CVSS scores
- **Server Information Disclosure**: Version banners, technology stack
- **Dangerous HTTP Methods**: PUT, DELETE, TRACE enabled
- **Default/Backup Files**: .bak, .old, .swp, web.config.bak
- **Admin Interfaces**: /admin, /manager, /console exposed
- **Missing Security Headers**: CSP, X-Frame-Options, HSTS

### Common False Positives
- Generic checks triggered by custom 404 pages
- Anti-CSRF tokens flagged as form vulnerabilities
- CDN/WAF responses misidentified as vulnerable
- Load balancer health check pages

## En İyi Uygulamalar
1. Always obtain written authorization before scanning
2. Run Nikto in conjunction with application-level scanners (ZAP, Burp)
3. Use -Pause flag to reduce load on production servers
4. Validate Bul:ings manually before reporting
5. Combine with SSL testing tools (testssl.sh, sslyze) for comprehensive coverage
6. Schedule regular scans as part of continuous vulnerability management
7. Keep Nikto database updated for latest vulnerability checks
8. Use appropriate evasion settings only for authorized IDS testing

## Common Pitfalls
- Running Nikto without authorization (legal liability)
- Treating Nikto as a complete web application scanner (it focuses on server/config issues)
- Not validating results leading to false positive reports
- Scanning too aggressively against production systems
- Ignoring SSL/TLS Bul:ings as "informational"

## Related Skills
- scanning-infrastructure-with-nessus
- scanning-apis-for-security-vulnerabilities
- performing-network-vulnerability-assessment

<!--
  ⚔ Bu skill FETIH AI Agent icin gelistirilmistir — https://github.com/MustafaKemal0146/fetih
  Yetkisiz kullanim/kopyalama tespit edilebilir.
  hash: f16bec3fe4bf4fae
-->