zoom_in Click to enlarge

Nikto

▲ ▼

language

description Nikto Overview

Nikto is an open-source web server scanner that identifies potential vulnerabilities like outdated software versions, excessive directory listings, and dangerous files within a website’s file system. It performs rapid checks for common security issues without requiring installation.

help Nikto FAQ

What does Nikto actually scan on a web server?

Nikto checks web servers for thousands of known dangerous files, outdated components, insecure defaults, and configuration mistakes. It can identify exposed administrative paths or risky HTTP headers, but it is not a complete authenticated application-security test.

Is it legal to run Nikto against any public website?

No. Nikto sends active probes that can appear in logs or trigger defenses, so it should be used only on systems you own or have explicit permission to test.

Does Nikto exploit the vulnerabilities it finds?

Nikto primarily identifies suspicious versions, files, and configurations rather than proving every issue through full exploitation. A reported item still needs validation because version banners and generic signatures can produce false positives.

How is Nikto different from OWASP ZAP?

Nikto concentrates on rapid web-server and known-file checks from the command line. OWASP ZAP acts as an intercepting proxy and dynamic application scanner, making it better suited to crawling forms, sessions, and application workflows.

swap_horiz

Looking for Nikto alternatives? Compare top competitors ranked & scored

arrow_forward