Nikto Web Scanner Tutorial: Scan and Interpret Results

Nikto is a web-server and configuration exposure scanner—not a full web-application vulnerability scanner. It probes for known dangerous files, default pages, header misconfigurations, and version clues on HTTP services.

The skill that separates a useful Nikto pass from noise is interpretation: knowing what the scanner observed, whether the line is informational or actionable, and when an incomplete run does not mean the rest of the site is clean.

This tutorial runs Nikto 2.6.0 on Kali against Metasploitable 2 from the pentest lab guide. Every command below was executed on that host-only segment.

What Nikto finds — and what it does not

Nikto answers: “Does this web server expose known risky files, defaults, or configuration clues?” It does not comprehensively test business logic, SQL injection, XSS, or authenticated multi-step workflows.

Treat Nikto output as leads for manual validation—especially on modern sites where missing security headers are common and not always reportable findings.

Run your first Nikto scan

Confirm Nikto is installed and note the version you will document:

nikto -Version

Nikto 2.6.0 (LW 2.5)

Set the lab web target once per shell. Metasploitable 2 serves Apache on port 80 in this walkthrough:

TARGET=192.168.56.127
WEB_URL="http://${TARGET}/"

Cap runtime on lab sweeps so a single host does not run for an hour:

nikto -h "$WEB_URL" -maxtime 45s

Sample output (trimmed):

- Nikto v2.6.0
---------------------------------------------------------------------------
+ Target IP:          192.168.56.127
+ Target Hostname:    192.168.56.127
+ Target Port:        80
+ Server: Apache/2.2.8 (Ubuntu) DAV/2
+ [999986] /: Retrieved x-powered-by header: PHP/5.2.4-2ubuntu5.10.
+ [750500] /icons/: Directory indexing found.
+ [600050] Apache/2.2.8 appears to be outdated (current is at least 2.4.66).
+ [600625] PHP/5.2.4-2ubuntu5.10 appears to be outdated (current is at least 8.5.1).
+ [013587] /: Suggested security header missing: x-content-type-options.
+ [000434] /: HTTP TRACE method is active and replies which suggests the host is vulnerable to XST.
+ [750510] /phpinfo.php: Output from the phpinfo() function was found.
+ ERROR: Host maximum execution time of 45 seconds reached
+ Scan terminated: 0 errors and 14 items reported on the remote host
+ 1 host(s) tested

Read the banner block before the finding lines:

• Target IP / Hostname / Port — which socket Nikto actually probed.
• Server — banner from the HTTP response (compare with banner grabbing if you need a second source).
• Bracketed IDs — plugin identifiers; useful when you tune or suppress categories later.
• Scan terminated — whether the run finished or hit a time/error limit (see the incomplete-scan section below).

A -maxtime stop after 45 seconds is normal on Metasploitable. It does not mean the fourteenth line was the only risk on the host—it means Nikto stopped early.

Choose the correct target

Nikto results change when you alter the host, scheme, port, path, or virtual host. Pick the target that matches what the engagement cares about.

Hostname versus IP often returns different virtual-host content on shared hosting. HTTP versus HTTPS may redirect or expose different headers. Scan the URL your RoE lists—not an arbitrary variant.

In this lab, port 443 on Metasploitable is closed, so HTTPS syntax is shown for engagement targets that actually speak TLS:

nmap -Pn -p 80,443 "$TARGET"

80/tcp   open   http
443/tcp  closed https

When 443 is open on your target, add -ssl (or use an https:// URL form your Nikto build accepts) so plugins negotiate TLS instead of plain HTTP on the wrong port.

Scan HTTPS and non-standard ports

Use host plus port flags when you are not passing a full URI:

nikto -h "$TARGET" -p 80 -maxtime 30s

The opening banner should show Target Port: 80 and Server: from Apache.

For TLS services, enable SSL mode explicitly:

nikto -h "$TARGET" -p 443 -ssl -maxtime 30s

On a host with HTTPS disabled, Nikto fails quickly— that is useful evidence too, not a broken install.

Alternate application ports follow the same pattern:

nikto -h "$TARGET" -p 8080 -maxtime 30s

If a site redirects HTTP to HTTPS, consider -followredirects so plugins test the final location. Redirect chains and certificate mismatches are common reasons HTTPS scans look “empty” or stop early.

Read and validate Nikto findings

This section is the core of the tutorial. For each class of line, ask what Nikto saw, why it flagged it, how serious it is, and how you would confirm it manually.

Missing security header (informational to low)

A typical header warning looks like this:

+ [013587] /: Suggested security header missing: x-content-type-options.

Missing Strict-Transport-Security on plain HTTP is expected—Nikto still lists it. Do not call every header warning a vulnerability in your report.

Exposed phpinfo.php (actionable)

Nikto flags real phpinfo() pages with a disclosure plugin:

+ [750510] /phpinfo.php: Output from the phpinfo() function was found.

Outdated Apache/PHP banner (lead—validate)

Version heuristics compare banners to Nikto's local database:

+ [600050] Apache/2.2.8 appears to be outdated (current is at least 2.4.66).

Directory indexing (actionable in context)

Directory listing detection produces a short, specific line:

+ [750500] /icons/: Directory indexing found.

HTTP TRACE / XST (validate exploitability)

Method probes surface enabled verbs such as TRACE:

+ [000434] /: HTTP TRACE method is active and replies which suggests the host is vulnerable to XST.

Nikto's own false-positive warning

Nikto sometimes warns that the server confuses its plugins:

+ [999967] /: Web Server returns a valid response with junk HTTP methods which may cause false positives.

When Nikto tells you its plugins may over-report, narrow tuning or manually confirm each subsequent file-based hit. This meta-line is a signal to slow down—not ignore.

Path-root scans and CGI noise

Scanning a deep path without tuning can produce dozens of duplicate “phpinfo” lines under fabricated CGI directories:

nikto -h "http://${TARGET}/phpinfo.php" -maxtime 25s

Sample lines:

+ [750510] /phpinfo.php/: Output from the phpinfo() function was found.
+ [750510] /phpinfo.php/cgi-bin/: Output from the phpinfo() function was found.
+ [750510] /phpinfo.php/cgi-915/: Output from the phpinfo() function was found.

The first hit may be real; many appended /cgi-* paths are plugin fuzzing against a server that echoes the same error page. Validate one URI with curl before you paste fifty lines into a report.

Recognize an incomplete or noisy scan

A scan that stops at 2% of plugins does not prove the remaining checks were clean. Read the footer every time.

Time limit reached

Repeat the scan with an aggressive five-second cap to see an early stop in the footer:

nikto -h "$WEB_URL" -maxtime 5s

+ ERROR: Host maximum execution time of 5 seconds reached
+ Scan terminated: 0 errors and 4 items reported on the remote host

Only four items printed, but thousands of checks may never have run. Increase -maxtime, reduce scope with tuning, or scan specific paths when RoE allows.

SSL and connectivity errors

Closed ports, certificate name mismatches, and TLS version blocks produce errors instead of findings. Fix the target (-ssl, correct port, trusted cert) before you interpret an empty result as “secure.”

WAF, CDN, and rate limiting

Reverse proxies may return the same custom 403 or challenge page for every probe. Nikto can misread that as interesting content. Compare response bodies manually on a few flagged paths.

Wildcard 404 and custom error pages

If every unknown path returns HTTP 200 with a soft-404 body, file-existence plugins fire constantly. Use -no404 tuning when you have confirmed that behavior.

Update-check noise

Startup may print an update-channel error that is unrelated to your target:

+ ERROR: Failed to check for updates: 403

That line is about Nikto's update channel—not your target. It does not affect local plugin results.

Tune Nikto without memorizing every option

You do not need the entire man page. These controls cover most authorized lab and light production sweeps.

Category 1 maps to interesting files; 2 to misconfiguration/defaults; 3 to information disclosure; 4 to injection (XSS/SQLi-style) probes. Injection plugins are why Nikto is not a replacement for Burp—use tuning when you only want server posture.

Official option syntax evolves between releases. For exhaustive flags, use nikto -Help and the Nikto wiki rather than copying every switch into this page.

Save Nikto results

Redirect stdout during interactive runs, or write a report file for evidence.

Save terminal output to a text file:

nikto -h "$TARGET" -p 80 -maxtime 30s -o /tmp/nikto-lab-report -Format txt

Nikto appends the format extension, so the file on disk is /tmp/nikto-lab-report.txt.

XML excerpt from a completed lab run:

<item id="750510" method="GET">
  <description><![CDATA[/phpinfo.php: Output from the phpinfo() function was found.]]></description>
  <uri><![CDATA[/phpinfo.php]]></uri>
</item>

Store the command line, target URL, Nikto version, and scan duration with the artifact so reviewers know whether the run finished or hit -maxtime.

Nikto vs Nmap, Nuclei, ZAP, and Burp Suite

These tools answer different questions. Nikto belongs after you know a web port is open—usually from network reconnaissance with Nmap.

Nikto is still useful in 2026 for fast web-server posture passes on authorized targets—especially CTF labs, legacy Apache/IIS exposures, and header/file checklist work. It is not a substitute for ZAP or Burp on modern single-page applications with heavy authentication.

WordPress-specific coverage belongs in WPScan, not a generic Nikto sweep.

Common Nikto problems

Summary

Nikto is a web-server and configuration exposure scanner—not a full application DAST platform. You installed Nikto 2.6.0 on Kali, aimed it at Metasploitable 2 with a time cap, and read the banner block plus plugin lines for server version, missing headers, dangerous files, and method issues.

The differentiator is validation: missing headers are often informational, phpinfo.php is actionable, version strings are leads, and CGI-suffixed duplicates are frequently noise. Incomplete scans that hit -maxtime or SSL errors do not prove the remaining site is clean—read the termination footer before you close the ticket.

Pick targets deliberately (scheme, port, path, vhost), save txt or xml for evidence, and reach for Nmap, Nuclei, ZAP, or Burp when the engagement question shifts from server posture to application logic. On WordPress, switch to WPScan; on broad vulnerability scanning strategy, keep Nikto in the lightweight external web check role.

References

• Nikto project (GitHub)
• Nikto documentation wiki
• Kali Linux — Nikto tool page
• OWASP — Cross-Site Tracing