Nikto Cheat Sheet

Nikto is a web server scanner that checks a target against a large, regularly updated database of known-dangerous files, outdated software versions, and common misconfigurations in a single automated pass.

Red Team / Offensive Use

Nikto is a breadth tool, not a depth one — it's what you run early against a web target to surface the obvious, already-known issues (outdated server software, default files left in place, missing security headers) before you spend time on manual testing. It's loud and easily logged, so it's a poor choice for anything requiring stealth, but on an authorized engagement where noise isn't a concern, it's a fast way to rule out the low-hanging fruit before moving to tools like ffuf or manual review with Burp Suite.

Established Cheatsheet

sullo/nikto — the official repository, with the full option list and plugin documentation.

PWNMI's Top 5 Use Cases

• nikto -h http://10.10.10.5 — default scan against a single target; the standard first pass
• nikto -h 10.10.10.5 -p 80,443,8080 — scan specific ports rather than relying on the default, useful once Nmap has told you what's actually open
• nikto -h 10.10.10.5 -ssl — force SSL/TLS mode, needed when scanning an HTTPS service on a nonstandard port that Nikto doesn't auto-detect
• nikto -h 10.10.10.5 -o results.html -Format htm — save output to a readable HTML report instead of scrolling terminal output
• nikto -h 10.10.10.5 -Tuning 1,2,3 — restrict the scan to specific check categories (file upload, misconfiguration, information disclosure) rather than running everything, useful for cutting scan time on a large scope

Next step

Nikto tells you what's already known to be wrong — for what it can't find, ffuf and gobuster cover directory and content discovery instead. New to web app testing generally? Start with Burp Suite Fundamentals.