Save Nikto Scan Output to a File

Introduction

Nikto is a popular open-source web server scanner that performs comprehensive tests against web servers for multiple items, including over 6700 potentially dangerous files/programs, checks for outdated versions of over 1250 servers, and version-specific problems on over 270 servers.

When you run a scan, the results are typically displayed directly in your terminal. For documentation, further analysis, or sharing with a team, it's essential to save this output to a file. Nikto provides flexible options to save scan reports in various formats.

In this lab, you will learn how to save Nikto scan results to a file. You will practice saving the output in plain text (.txt) and Comma-Separated Values (.csv) formats by scanning a simple, locally running web server.

Choose a plain text output format

In this step, you will explore the different output formats that Nikto supports. Nikto uses plugins for its reporting capabilities, and you can list them to see the available formats.

The -list-plugins option shows all available plugins, including those for reporting. Let's run this command to see what formats we can use.

Execute the following command in your terminal:

nikto -list-plugins

You will see a long list of plugins. Scroll through the output and look for the "Reporting" section. This section lists all the file formats you can save your scan results in.

...
Reporting
--------------------------------------------------
        csv - Comma-separated value
        htm - HTML Report
        json - JSON Report
        nbe - Nessus NBE format
        sql - SQL (generic)
        txt - Plain text
        xml - XML
...

As you can see, txt is listed as a "Plain text" format. We will use this format first.

Use the -o flag to specify an output filename

In this step, you will learn about the flag used to specify an output file. To tell Nikto where to save the report, you use the -o (or --output) flag.

This flag must be used along with the -Format flag, which specifies the file format you chose in the previous step. The basic syntax is:

nikto -h <target> -Format <format> -o <filename>

Let's use the -help option to see the official description for the -o flag. You can pipe the output to grep to find the relevant line quickly.

Run this command:

nikto -help | grep -- "-o "

The output will show you the usage for the -o and --output flags.

-o, -output <file>      Write output to this file

Now you know how to specify both the format and the filename. In the next step, we will combine these to run a scan and save the results.

Run the scan and generate the text file

In this step, you will perform a scan and save the output to a plain text file. We will combine the flags and information from the previous steps.

Our target is the local web server running on port 8000. The URL for this server is http://127.0.0.1:8000.

Target Host (-h): http://127.0.0.1:8000
Format (-Format): txt
Output File (-o): scan_report.txt

Now, construct the full command and run it in your terminal. All operations should be performed in the default ~/project directory.

nikto -h http://127.0.0.1:8000 -Format txt -o scan_report.txt

Nikto will start the scan. You will see the scan progress in the terminal, but the final report will be written to the scan_report.txt file. Please wait for the scan to complete.

- Nikto v2.5.0
---------------------------------------------------------------------------
+ Target IP:          127.0.0.1
+ Target Hostname:    127.0.0.1
+ Target Port:        8000
+ Start Time:         ...
---------------------------------------------------------------------------
+ Server: SimpleHTTP/0.6 Python/3.10.6
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type.
...
+ 1 host(s) tested

Once the command finishes, a new file named scan_report.txt will be created in your current directory (~/project).

Verify the contents of the saved text file

In this step, you will verify that the scan results were correctly saved to the text file. You can use a command-line tool like cat to display the contents of the file.

Run the following command to view the contents of scan_report.txt:

cat scan_report.txt

The output will be the full Nikto report, which should look very similar to the output you saw in the terminal during the scan.

Nikto V2.5.0
================================================================
+-----------+
| General |
+-----------+
Date: ...
Start Time: ...
End Time: ...
Version: 2.5.0
...
+-----------+
|  Target   |
+-----------+
IP: 127.0.0.1
Hostname: 127.0.0.1
Port: 8000
...
+-----------+
| Findings  |
+-----------+
+ The anti-clickjacking X-Frame-Options header is not present.
...

You have successfully saved a Nikto scan report to a plain text file. This file can now be easily stored, archived, or shared.

Repeat the process to save in CSV format

In this step, you will repeat the process to save the scan results in a different format: CSV (Comma-Separated Values). The CSV format is structured and ideal for importing into spreadsheets like Excel or LibreOffice Calc, or for processing with scripts.

The procedure is nearly identical. You just need to change the value for the -Format flag to csv and provide a new filename with a .csv extension.

Target Host (-h): http://127.0.0.1:8000
Format (-Format): csv
Output File (-o): scan_report.csv

Run the following command to generate the report in CSV format:

nikto -h http://127.0.0.1:8000 -Format csv -o scan_report.csv

After the scan completes, a new file named scan_report.csv will be created. Let's view its contents with the cat command.

cat scan_report.csv

The output will be structured with comma-separated fields, which is the standard for CSV files.

"Host","IP","Port","Banner","Date","Vulnerability","Method","Description","Reference"
"127.0.0.1","127.0.0.1","8000","","...","OSVDB-3233: The anti-clickjacking X-Frame-Options header is not present.","GET","",""
"127.0.0.1","127.0.0.1","8000","","...","OSVDB-3092: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type.","GET","",""
...

You have now successfully generated a report in two different formats, demonstrating the flexibility of Nikto's output options.

Summary

In this lab, you have learned how to manage the output of the Nikto web server scanner. You successfully scanned a local web server and saved the results to files for later use.

Specifically, you practiced:

Listing available output formats using the -list-plugins option.
Using the -o and -Format flags to control the output file and its format.
Generating a scan report in plain text (.txt).
Generating a scan report in Comma-Separated Values (.csv).

This skill is fundamental for any security professional who needs to document findings, perform offline analysis, or integrate scan results into larger reporting systems.

Save Scan Output to a File with Nikto