Table of Contents
Below are all of the Nikto command line options and explanations. A brief version of this text is available by running Nikto with the -h (-help) option.
-CgidirsScan these CGI directories. Special words "none" or "all" may be used to scan all CGI directories or none, (respectively). A literal value for a CGI directory such as "/cgi-test/" may be specified (must include trailing slash). If this is option is not specified, all CGI directories listed in config.txt will be tested.
-configSpecify an alternative config file to use instead of the config.txt located in the install directory.
-dbcheckCheck the scan databases for syntax errors.
-DisplayControl the output that Nikto shows. See Chapter 5 for detailed information on these options. Use the reference number or letter to specify the type, multiple may be used:
1 - Show redirects
2 - Show cookies received
3 - Show all 200/OK responses
4 - Show URLs which require authentication
D - Debug Output
V - Verbose Output
-evasionSpecify the LibWhisker IDS evasion technique to use (see the LibWhisker docs for detailed information on these). Use the reference number to specify the type, multiple may be used:
1 - Random URI encoding (non-UTF8)
2 - Directory self-reference (/./)
3 - Premature URL ending
4 - Prepend long random string
5 - Fake parameter
6 - TAB as request spacer
7 - Change the case of the URL
8 - Use Windows directory separator (\)
A - Use a carriage return (0x0d) as a request spacer
B - Use binary value 0x0b as a request spacer
-findonlyOnly discover the HTTP(S) ports, do not perform a security scan. This will attempt to connect with HTTP or HTTPS, and report the Server header.
-FormatSave the output file specified with -o (-output) option in this format. If not specified, the default will be taken from the file extension specified in the -output option. Valid formats are:
csv - a comma-seperated list
htm - an HTML report
txt - a text report
xml - an XML report
-hostHost(s) to target. Can be an IP address, hostname or text file of hosts. A single dash (-) maybe used for stdout. Can also parse nmap -oG style output
-HelpDisplay extended help information.
-idID and password to use for host Basic host authentication. Format is "id:password".
-list-pluginsWill list all plugins that Nikto can run against targets and then will exit without performing a scan. These can be tuned for a session using the -plugins option.
The output format is:
Plugin name
full name - description
Written by author, Copyright (C)
copyright
-mutateSpecify mutation technique. A mutation will cause Nikto to combine tests or attempt to guess values. These techniques may cause a tremendous amount of tests to be launched against the target. Use the reference number to specify the type, multiple may be used:
1 - Test all files with all root directories
2 - Guess for password file names
3 - Enumerate user names via Apache (/~user type requests)
4 - Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type requests)
5 - Attempt to brute force sub-domain names, assume that the host name is the parent domain
6 - Attempt to guess directory names from the supplied dictionary file
-mutate-optionsProvide extra information for mutates, e.g. a dictionary file
-nolookupDo not perform name lookups on IP addresses.
-nosslDo not use SSL to connect to the server.
-no404Disable 404 (file not found) checking. This will reduce the total number of requests made to the webserver and may be preferable when checking a server over a slow link, or an embedded device. This will generally lead to more false positives being discovered.
-outputWrite output to the file specified. The format used will be taken from the file extension. This can be over-riden by using the -Format option (e.g. to write text files with a different extenstion. Existing files will have new information appended.
-pluginsSelect which plugins will be run on the specified targets. A comma separated list should be provided which lists the names of the plugins. The names can be found by using -list-plugins.
There are two special entries: ALL, which specifies all plugins shall be run and NONE, which specifies no plugins shall be run. The default is ALL
-portTCP port(s) to target. To test more than one port on the same host, specify the list of ports in the -p (-port) option. Ports can be specified as a range (i.e., 80-90), or as a comma-delimited list, (i.e., 80,88,90). If not specified, port 80 is used.
-PauseSeconds to delay between each test.
-rootPrepend the value specified to the beginning of every request. This is useful to test applications or web servers which have all of their files under a certain directory.
-sslOnly test SSL on the ports specified. Using this option will dramatically speed up requests to HTTPS ports, since otherwise the HTTP request will have to timeout first.
-SinglePerform a single request to a target server. Nikto will prompt for all options which can be specified, and then report the detailed output. See Chapter 5 for detailed information.
-timeoutSeconds to wait before timing out a request. Default timeout is 10 seconds.
-TuningTuning options will control the test that Nikto will use against a target. By default, if any options are specified, only those tests will be performed. If the "x" option is used, it will reverse the logic and exclude only those tests. Use the reference number or letter to specify the type, multiple may be used:
0 - File Upload
1 - Interesting File / Seen in logs
2 - Misconfiguration / Default File
3 - Information Disclosure
4 - Injection (XSS/Script/HTML)
5 - Remote File Retrieval - Inside Web Root
6 - Denial of Service
7 - Remote File Retrieval - Server Wide
8 - Command Execution / Remote Shell
9 - SQL Injection
a - Authentication Bypass
b - Software Identification
c - Remote Source Inclusion
x - Reverse Tuning Options (i.e., include all except specified)
The given string will be parsed from left to right, any x characters will apply to all characters to the right of the character.
-useproxyUse the HTTP proxy defined in the configuration file.
-updateUpdate the plugins and databases directly from cirt.net.
-VersionDisplay the Nikto software, plugin and database versions.
-vhostSpecify the Host header to be sent to the target.
A mutation will cause Nikto to combine tests or attempt to guess values. These techniques may cause a tremendous amount of tests to be launched against the target. Use the reference number to specify the type, multiple may be combined.
Test all files with all root directories. This takes each test and splits it into a list of files and directories. A scan list is then created by combining each file with each directory.
Guess for password file names. Takes a list of common password file names (such as "passwd", "pass", "password") and file extensions ("txt", "pwd", "bak", etc.) and builds a list of files to check for.
Enumerate user names via Apache (/~user type requests).
Exploit a misconfiguration with Apache UserDir setups which allows
valid user names to be discovered. This will attempt to brute-force
guess user names. A file of known users can also be supplied by
supplying the file name in the
-mutate-options parameter.
Enumerate user names via cgiwrap (/cgi-bin/cgiwrap/~user type
requests). Exploit a flaw in cgiwrap which allows valid user names
to be discovered. This will attempt to brute-force guess user names.
A file of known users can also be supplied by supplying the file
name in the -mutate-options parameter.
Attempt to brute force sub-domain names. This will attempt to brute force know domain names, it will assume the given host (without a www) is the parent domain.
Attempt to brute directory names. This is the only mutate
option that requires a file to be passed in the
-mutate-options parameter. It will use the
given file to attempt to guess directory names. Lists of common
directories may be found in the OWASP DirBuster project.
By default only some basic information about the target and
vulnerabilities is shown. Using the -Display parameter can produce more information for debugging issues.
1 - Show redirects. This will display all requests which elicit a "redirect" response from the server.
2 - Show cookies received. This will display all cookies that were sent by the remote host.
3 - Show all 200/OK responses. This will show all responses which elicit an "okay" (200) response from the server. This could be useful for debugging.
4 - Show URLs which require authentication. This will show all responses which elicit an "authorization required" header.
D - Debug Output. Show debug output, which shows the verbose output and extra information such as variable content.
V - Verbose Output. Show verbose output, which typically shows where Nikto is during program execution.
Scan tuning can be used to decrease the number of tests performed against a target. By specifying the type of test to include or exclude, faster, focused testing can be completed. This is useful in situations where the presence of certain file types are undesired -- such as XSS or simply "interesting" files.
Test types can be controlled at an individual level by specifying
their identifier to the -T (-Tuning) option. In the default mode, if
-T is invoked only the test type(s) specified
will be executed. For example, only the tests for "Remote file
retrieval" and "Command execution" can performed against the
target:
perl nikto.pl -h 192.168.0.1 -T 58
If an "x" is passed to -T then this will
negate all tests of types following the x. This is useful where a test
may check several different types of exploit. For example:
perl nikto.pl -h 192.168.0.1 -T 58xb
The valid tuning options are:
0 - File Upload. Exploits which allow a file to be uploaded to the target server.
1 - Interesting File / Seen in logs. An unknown but suspicious file or attack that has been seen in web server logs (note: if you have information regarding any of these attacks, please contact CIRT, Inc.).
2 - Misconfiguration / Default File. Default files or files which have been misconfigured in some manner. This could be documentation, or a resource which should be password protected.
3 - Information Disclosure. A resource which reveals information about the target. This could be a file system path or account name.
4 - Injection (XSS/Script/HTML). Any manner of injection, including cross site scripting (XSS) or content (HTML). This does not include command injection.
5 - Remote File Retrieval - Inside Web Root. Resource allows remote users to retrieve unauthorized files from within the web server's root directory.
6 - Denial of Service. Resource allows a denial of service against the target application, web server or host (note: no intentional DoS attacks are attempted).
7 - Remote File Retrieval - Server Wide. Resource allows remote users to retrieve unauthorized files from anywhere on the target.
8 - Command Execution / Remote Shell. Resource allows the user to execute a system command or spawn a remote shell.
9 - SQL Injection. Any type of attack which allows SQL to be executed against a database.
a - Authentication Bypass. Allows client to access a resource it should not be allowed to access.
b - Software Identification. Installed software or program could be positively identified.
c - Remote source inclusion. Software allows remote inclusion of source code.
x - Reverse Tuning Options. Perform exclusion of the specified tuning type instead of inclusion of the specified tuning type.
Single request mode is designed to perform a solitary request against the target. This is useful to confirm a test result using the same resources Nikto used during a scan. The single option allows manual setting of most variables used by Nikto and LibWhisker, and upon completion will display both the request and the result of the operation.
Most options have a default value or can be left blank. The most
common and required values are at the beginning of the "questions"
section for slightly easier use. True and false are specified by numeric
equivalents, 1 and 0 respectively. Please note that Single mode is not
very user-friendly. Here is an example Nikto run with the
-Single option.
[dave@yggdrasil nikto-2.03]$ ./nikto.pl -Single -------------------------------------------- Nikto 2.1.1 -------------------------------------------- Single Request Mode Hostname or IP: localhost Port (80): URI (/): /test.html SSL (0): Proxy host: Proxy port: Show HTML Response (1): HTTP Version (1.1): HTTP Method (GET): User-Agent (Mozilla/4.75 (Nikto/2.1.1): Connection (Keep-Alive): Data: force_bodysnatch (0): force_close (1): http_space1 ( ): http_space2 ( ): include_host_in_uri (0): invalid_protocol_return_value (1): max_size (0): protocol (HTTP): require_newline_after_headers (0): retry (0): ssl_save_info (0): timeout (10): uri_password (): uri_postfix (): uri_prefix (): uri_user (): Enable Anti-IDS (0): -------------------------------------------- Done with questions Host Name: localhost Host IP: 127.0.0.1 HTTP Response Code: 404 -------------------------------------------- Connection Details Connection: Keep-Alive Host: localhost User-Agent: Mozilla/4.75 (Nikto/2.1.1 data: force_bodysnatch: 0 force_close: 1 force_open: 0 host: localhost http_space1: http_space2: ignore_duplicate_headers: 1 include_host_in_uri: 0 invalid_protocol_return_value: 1 max_size: 0 method: GET port: 80 protocol: HTTP require_newline_after_headers: 0 retry: 0 ssl: 0 ssl_save_info: 0 timeout: 10 trailing_slurp: 0 uri: /test.html uri_param_sep: ? uri_postfix: uri_prefix: version: 1.1 -------------------------------------------- Response Headers Connection: close Content-Length: 268 Content-Type: text/html; charset=iso-8859-1 Date: Tue, 18 Aug 2009 10:13:57 GMT Server: Apache/2 code: 404 http_data_sent: 1 http_eol: http_space1: http_space2: message: Not Found protocol: HTTP uri: /test.html version: 1.1 -------------------------------------------- Response Content <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /test.html was not found on this server.</p> <hr> <address>Apache/2 Server at localhost Port 80</address> </body></html>