NIKTO.PL(1)

NAME
nikto.pl - Scan web server for known vulnerabilities

SYNOPSIS

nikto.pl [options...]

DESCRIPTION

Nikto is an Open Source web server scanner which performs comprehensive tests against web servers for multiple items that are generally considered dangerous. It checks for:

    • Server and software misconfigurations

    • Default files and programs

    • Insecure files and programs

    • Outdated servers and programs

    • Dangerous files

    • Other problems

Nikto is built on LibWhisker2 (LW2) and can run on any platform which has a Perl environment. It supports SSL, proxies, host authentication, attack encoding and more. It can be updated automatically from the command-line, and supports the optional submission of updated version data back to the maintainers.

OPTIONS

-ask yes|no|auto
    Whether to ask about submitting updates. Options: yes (ask about each), no (don't ask, don't send), auto (don't ask, just send).

-Add-header header:value
    Add HTTP headers (can be used multiple times, one per header pair).

-check6
    Check if IPv6 is working (connects to ipv6.google.com or value set in nikto.conf).

-Cgidirs dirs
    Scan these CGI directories. Special words "none" or "all" may be used. A literal value for a CGI directory such as "/cgi-test/" may be specified (must include trailing slash).

-config file
    Use this config file instead of the default nikto.conf.

-dbcheck
    Check database and other key files for syntax errors.

-Display options
    Turn on/off display outputs: 1 (Show redirects), 2 (Show cookies received), 3 (Show all 200/OK responses), 4 (Show URLs which require authentication), D (Debug output), E (Display all HTTP errors), P (Print progress to STDOUT), S (Scrub output of IPs and hostnames), V (Verbose output).

-evasion technique
    Encoding technique: 1 (Random URI encoding), 2 (Directory self-reference), 3 (Premature URL ending), 4 (Prepend long random string), 5 (Fake parameter), 6 (TAB as request spacer), 7 (Change the case of the URL), 8 (Use Windows directory separator), A (Use carriage return as request spacer), B (Use binary value 0x0b as request spacer), R (Random User-Agent from database; default is first entry; ignored when -useragent is set; note the suggested-headers check always uses the first entry regardless).

-followredirects
    Follow 3xx redirects to new location.

-Format format
    Save file format: csv (Comma-separated-value), json (JSON Format), htm (HTML Format), sql (Generic SQL, see docs for schema), sqld (SQL Direct, directly inserts into MySQL/PostgreSQL database), txt (Plain text), xml (XML Format). Multiple formats can be specified as a comma-separated list. If not specified, the format will be taken from the file extension passed to -output. Note: sqld format requires DB_TYPE, DB_HOST, DB_PORT, DB_NAME in nikto.conf and NIKTO_DB_USER, NIKTO_DB_PASS environment variables.

-Help
    Display extended help information.

-host target
    Host(s) to target. Can be an IP address, hostname or text file of hosts. A single dash (-) maybe used for stdout. Can also parse nmap -oG style output.

-id id:pass[:realm]
    ID and password to use for host Basic host authentication. Format is "id:password" or "id:password:realm".

-ipv4
    IPv4 Only.

-ipv6
    IPv6 Only.

-key file
    Client certificate key file.

-list-plugins
    List all available plugins, perform no testing.

-maxtime time
    Maximum testing time per host (e.g., 1h, 60m, 3600s).

-mutate options
    Guess additional file names: 1 (Test all files with all root directories), 2 (Guess for password file names), 3 (Enumerate user names via Apache), 4 (Enumerate user names via cgiwrap).

-mutate-options options
    Provide information for mutates.

-nocheck
    Do not check for updates on startup. Successful version checks are otherwise cached for 6 hours in EXECDIR/.last_update_check; delete that file to force a fresh check.

-nocookies
    Do not use cookies from responses in requests.

-nointeractive
    Disable interactive features.

-nolookup
    Do not perform name lookups on IP addresses.

-noslash
    Strip trailing slash from URL (e.g., '/admin/' to '/admin').

-nossl
    Do not use SSL to connect to the server.

-nosslkeepalive
    Disable TLS connection reuse (keep-alive is on by default). Useful for servers that misbehave with reused TLS sessions.

-Option name=value
    Over-ride an option in nikto.conf, can be issued multiple times.

-output file
    Write output to the file specified ('.' for auto-name). The format used will be taken from the file extension. This can be over-ridden by using the -Format option.

-Pause seconds
    Seconds (integer or floating point) to delay between each test.

-Platform platform
    Platform of target: nix (Unix/Linux), win (Windows), or all (both).

-Plugins list
    List of plugins to run (default: ALL).

-port ports
    TCP port(s) to target. To test more than one port on the same host, specify the list of ports. Ports can be specified as a range (i.e., 80-90), or as a comma-delimited list, (i.e., 80,88,90). If not specified, port 80 is used.

-RSAcert file
    Client certificate file.

-root path
    Prepend root value to all requests, format is /directory.

-Save directory
    Save positive responses to this directory ('.' for auto-name).

-ssl
    Only test SSL on the ports specified. Using this option will dramatically speed up requests to HTTPS ports, since otherwise the HTTP request will have to timeout first.

-timeout seconds
    Seconds to wait before timing out a request. Default timeout is 10 seconds.

-Tuning options
    Tuning options will control the test that Nikto will use against a target. By default, if any options are specified, only those tests will be performed. If the "x" option is used, it will reverse the logic and exclude only those tests. Use the reference number or letter to specify the type, multiple may be used:

        • 0 - File Upload

        • 1 - Interesting File / Seen in logs

        • 2 - Misconfiguration / Default File

        • 3 - Information Disclosure

        • 4 - Injection (XSS/Script/HTML)

        • 5 - Remote File Retrieval - Inside Web Root

        • 6 - Denial of Service

        • 7 - Remote File Retrieval - Server Wide

        • 8 - Command Execution / Remote Shell

        • 9 - SQL Injection

        • a - Authentication Bypass

        • b - Software Identification

        • c - Remote Source Inclusion

        • d - WebService

        • e - Administrative Console

        • x - Reverse Tuning Options (i.e., include all except specified)

-url target
    Target host/URL (alias of -host).

-Userdbs type
    Load only user databases, not the standard databases. Options: all (Disable standard dbs and load only user dbs), tests (Disable only db_tests and load udb_tests).

-useragent string
    Forces a specific User-Agent string, overriding the database entirely.

-useproxy proxy
    Use the HTTP proxy defined in the configuration file, or given as argument in the format http://server:port.

-Version
    Display the Nikto software, plugin and database versions.

-vhost hostname
    Specify the Host header to be sent to the target.

-404code codes
    Ignore these HTTP codes as negative responses (always). Format is "302,301".

-404string string
    Ignore this string in response body content as negative response (always). Can be a regular expression.

DSL MATCHERS

Nikto's test database supports a mini-DSL for matching responses. The following matchers are supported:

    • BODY: and !BODY: — Match or exclude content in the response body.

    • HEADER: and !HEADER: — Match or exclude content in HTTP headers.

    • COOKIE: and !COOKIE: — Match or exclude content in HTTP cookies. (NEW)

    • CODE: and !CODE: — Match or exclude HTTP status codes.

            BODY:login&&!BODY:logout&&HEADER:X-Powered-By&&COOKIE:sessionid

FILES

nikto.conf
    The Nikto configuration file. This sets Nikto's global options. Several nikto.conf files may exist and are parsed in the below order. As each configuration file is loaded is supersedes any previously set configuration:

        • System wide (e.g. /etc/nikto.conf)

        • Home directory (e.g. $HOME/nikto.conf)

        • Current directory (e.g. ./nikto.conf)

${NIKTO_DIR}/databases/db*
    Database files that nikto uses to check for vulnerabilities and issues within the web server.

${NIKTO_DIR}/plugins/*.plugin
    All nikto's plugins exist here. Nikto itself is just a wrapper script to manage CLI and pass through to the plugins.

${NIKTO_DIR}/templates
    Contains the templates for nikto's output formats.

BUGS

The current features are not supported:

    • SOCKS Proxies

AUTHORS

Nikto is written and maintained by Chris Sullo and David Lodge. See the main documentation for other contributors.

All code is Copyright CIRT, Inc., except LibWhisker which is Copyright (c) 2009, Jeff Forristal (wiretrip.net). Other portions of code may be (C) as specified.

SEE ALSO

Nikto Homepage[1]

NOTES

1.  Nikto Homepage
    http://www.cirt.net/