Nikto — the long-running open-source web server scanner by Chris Sullo (CIRT.net) — has been the first command many administrators run against a web server since 2001. Written in Perl, it works from a plain text test database and a set of plugins rather than from a compiled signature engine: it requests over 8,000 potentially dangerous or interesting files and programs, identifies outdated versions of thousands of servers and components from headers, favicons and file analysis, and reports the misconfigurations that quietly accumulate on real deployments — multiple index files, dangerous HTTP methods, directory indexing, exposed backup and configuration files. It is deliberately aimed at coverage and accuracy rather than raw speed, and leans on several false-positive reduction techniques so that what it prints is worth reading. The current release is 2.6.1 (July 2026), the code is GPL-3.0, and the repository carries roughly 10,700 stars on GitHub.

Key Features

• A plain-text test database instead of a signature blob — scan items live in editable database files (files, directories, headers, 404 strings, outdated versions), so checks can be reviewed, diffed and version-pinned like any other text. Custom checks are equally low-friction: a CSV file can add your own paths and expected responses without writing code.
• Around thirty plugins — checks are grouped into loadable plugins, among them discovery of admin consoles and login pages, robots.txt analysis, path brute-forcing, outdated-software comparison, TLS and certificate inspection, Spring Boot Actuator endpoints, shellshock, OPTIONSBLEED (CVE-2017-9798), PUT/DELETE method tests and parked-domain detection. -list-plugins prints what is available and -Plugins selects a subset.
• Tuning that maps to a real workload — -Tuning 123b selects classes of check (interesting files, misconfiguration, information disclosure, injection, remote file retrieval, DoS, command execution, SQL injection, file upload, authentication bypass, software identification, remote source inclusion, WebService, administrative console), the x prefix inverts the selection, and -mutate adds filename guessing, password-file names, user enumeration and sub-domain brute forcing.
• Malformed and evasive requests when you need them — eleven -evasion techniques (random URI encoding, /./ self-references, premature URL endings, TAB or CR request spacers, case mixing, Windows separators) let you see whether a WAF or front-end proxy is doing what it claims.
• Multiple report formats from one scan — plain text, CSV, JSON, HTML, XML, generic SQL, and — new in 2.6.1 — SQL Direct, which inserts findings straight into MySQL or PostgreSQL via -Format sqld. Several formats can be requested for a single run, which makes the same scan usable by a human, a ticket queue and a dashboard.
• A small matching DSL for custom checks — database entries can combine BODY:, HEADER:, COOKIE: and CODE: matchers with &&, e.g. BODY:login&&!BODY:logout&&HEADER:X-Powered-By&&COOKIE:sessionid, so a bespoke internal finding can be encoded in one line without touching the engine.
• False-positive reduction built in — response hashing, header and content analysis, 404-page guessing (-no404, or pin the negative response with -404code/-404string) and multiple-index detection keep the output short enough to read.
• TLS inspection without extra tooling — certificate checks and TLS fingerprinting through Net::SSLeay, with a static Chrome User-Agent by default since 2.6.1 and keep-alive session reuse that the project measured at roughly an 18% scan-speed gain (-nosslkeepalive if a server misbehaves).
• Authentication-aware scanning — host authentication with Basic and NTLM (-id user:pass[:realm]), optional guessing of default credentials for Basic/NTLM/Digest realms, and automatic cookie handling that can be switched off with -nocookies.
• Fits real networks — IPv4 and IPv6, HTTP proxies (-useproxy), virtual hosts (-vhost), custom ports and roots, an input file of targets including nmap output, -maxtime to bound a scan, and -Save to keep the full request and response of every positive test so a finding can be replayed later with the bundled replay.pl.
• Trivial to run and to schedule — a Perl script with Perl and OpenSSL as its dependencies, cloned from GitHub or pulled as a container from Docker Hub (hackllc/nikto) or ghcr.io, plus a bash wrapper for running several scans in parallel under screen.

Why Use Nikto?

Nikto’s value is that it stays a scanner you can read. The test database is text, the findings reference the exact request that produced them, and the whole tool is one Perl program with no agent to install on the target — you point it at a host from anywhere that can reach it. That makes it an excellent first pass: a quick, broad check for the files, versions and settings that should not be exposed, before you move on to a scanner that reasons about application logic. It is also unusually easy to extend, because adding a check means adding a line to a CSV or a database file rather than writing a plugin in a compiled language. Its deliberate bias toward coverage and accuracy over speed cuts the other way for very large estates, where a template-driven scanner such as Nuclei will finish sooner, and Nikto does not attempt exploitation — it reports and stops. One licensing nuance is worth knowing up front: the program code is GPL-3.0, but the database files are licensed separately and may only be distributed with the Nikto package, so if you intend to ship Nikto’s databases inside another product you need the commercial terms described on the project’s licensing page. And as with any active scanner, only point it at systems you are authorised to test.

Use Cases

• First look at a new host or a freshly provisioned server: confirm no admin console, backup archive, .env file or directory listing is exposed, and that the advertised server version is current.
• Periodic baseline check of your own estate — run the same command on a schedule and diff the report, so a newly exposed path or a reverted security header shows up as a change rather than a surprise.
• Verify a WAF, CDN or reverse proxy with -evasion and see whether obfuscated requests still reach the origin server.
• Inspect TLS quickly — certificate chains, SNI and protocol support — without reaching for a separate tool.
• Audit a shared-hosting or appliance web interface where you cannot install anything, because the scan is entirely external.
• Feed results straight into change management with json output for a pipeline, or sqld to write findings into an existing MySQL/PostgreSQL asset-tracking database.
• Teach or demonstrate web hardening: the findings are one line each and point at the request that caused them, which makes a good before/after exercise during hardening work.

Similar

• OWASP ZAP — an interactive proxy and scanner that reasons about application traffic; Nikto is the fast, fire-and-forget sweep that runs before and after it.
• OpenVAS and Nmap — network and host-level discovery; Nikto stays at the HTTP layer, on the services Nmap finds.
• Nuclei — template-driven scanning with a very large community library; a better fit when you want one detection you can pin to a CVE and re-run in CI.
• Lynis and rkhunter — audits of the host itself, from inside; Nikto only sees what the web server answers.
• Snort, Suricata and CrowdSec — runtime detection and blocking of the traffic itself, where Nikto is the periodic external check.

Platform

Cross-platform with Perl and OpenSSL — Linux, macOS and Windows · Docker (Docker Hub and ghcr.io) · distributed in security-focused distributions such as Kali Linux · no agent or server-side component; scans run entirely from your side

Licence

GPL-3.0 — the Nikto program code (Copyright © 2001–2026 Chris Sullo) is free software under the GNU General Public License, version 3. The bundled test database files are licensed separately: they may only be distributed with, and for use in, the Nikto program or package, and using them in another product requires a commercial licence from the project. LibWhisker, the HTTP library Nikto is built on, carries its own licence.

Website

cirt.net/Nikto2 · source on GitHub · documentation wiki · releases · also see the Security & Privacy category for more tools that keep systems in check.