https://DevOpsCloud.io -- Cloud Monk Losang Jinpa, Ph.D., MCSE/MCT, GitOps DevOps Engineer

Nikto - A web server scanner that identifies vulnerabilities and misconfigurations in web servers, such as outdated software or exposed directories. https://cirt.net/Nikto2

• Definition: Nikto is an open-source web server scanner that performs comprehensive tests against web servers for multiple items, including potentially dangerous files, outdated server software, and various server configuration issues.
• Function: Identifies security vulnerabilities and issues in web servers by scanning for known problems, outdated versions, and misconfigurations.
• Components:

   * '''Nikto Core''': The main script that performs the scanning and reporting.
   * '''Plugins''': Extend the capabilities of Nikto by adding checks for specific vulnerabilities and issues.
   * '''Database''': Contains information about known vulnerabilities, outdated software versions, and other potential security issues.

• Features:

   * '''Comprehensive Scanning''': Checks for over 6,700 potentially dangerous files and programs, and more than 1,250 outdated versions.
   * '''Server Identification''': Determines the server software and its version.
   * '''Security Checks''': Looks for configuration issues such as HTTP server options, default files and programs, and security-related headers.
   * '''Reporting''': Generates reports in various formats including plain text, HTML, XML, and CSV.
   * '''Customization''': Supports custom scripts and plugins to extend functionality.

• Usage: Commonly used by security professionals to assess the security of web servers, identify potential vulnerabilities, and ensure compliance with security best practices.

• Running a basic scan with Nikto:

   ```bash
   nikto -h http://example.com
   ```

• Running a scan with a specific port:

   ```bash
   nikto -h http://example.com -p 8080
   ```

• Saving the scan results to a file:

   ```bash
   nikto -h http://example.com -o results.html -Format htm
   ```

• Using Nikto in a Python script:

   ```python
   import subprocess

 def run_nikto_scan(target_url):
     result = subprocess.run(['nikto', '-h', target_url], capture_output=True, text=True)
     print(result.stdout)
     if result.stderr:
         print(f"Error: {result.stderr}")

 # Run Nikto scan on a target URL
 run_nikto_scan('http://example.com')
 ```

• Using Nikto in a Java program:

   ```java
   import java.io.BufferedReader;
   import java.io.InputStreamReader;

 public class NiktoExample {
     public static void runNiktoScan(String targetUrl) {
         try {
             Process process = new ProcessBuilder("nikto", "-h", targetUrl).start();
             BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream()));
             String line;
             while ((line = reader.readLine()) != null) {
                 System.out.println(line);
             }
             reader.close();
             int exitCode = process.waitFor();
             if (exitCode != 0) {
                 BufferedReader errorReader = new BufferedReader(new InputStreamReader(process.getErrorStream()));
                 while ((line = errorReader.readLine()) != null) {
                     System.err.println("Error: " + line);
                 }
                 errorReader.close();
             }
         } catch (Exception e) {
             e.printStackTrace();
         }
     }

     public static void main(String[] args) {
         // Run Nikto scan on a target URL
         runNiktoScan("http://example.com");
     }
 }
 ```

• Nikto: An open-source web server scanner that performs comprehensive tests against web servers for known vulnerabilities, outdated server software, and various server configuration issues. It is widely used by security professionals to assess web server security and ensure compliance with security best practices. Nikto offers extensive scanning capabilities, server identification, and customizable reporting, making it a valuable tool for web server security assessments.