Web Server Scanning with Nikto

Introduction

Welcome to the Web Server Scanning with Nikto lab.

Nikto is a widely-used, open-source web server vulnerability scanner. It performs comprehensive tests against web servers for multiple items, including over 6,700 potentially dangerous files and programs, checks for outdated versions of over 1,250 servers, and identifies version-specific problems. While Nikto is not designed to be stealthy (it is quite "noisy" and easily detected by Intrusion Detection Systems), it is incredibly fast and effective for baseline security audits.

Nikto is best understood as a fast breadth-first auditor. It helps you identify obvious web-server issues quickly, but it does not replace careful manual verification. Its noisiness is the tradeoff for that breadth.

In this lab, you will learn how to use Nikto to scan a local web server, tune your scans to focus on specific vulnerabilities, save your results into structured reports, and analyze the findings to improve server security.

Execute Basic Nikto Scan

In this step, you will learn how to perform a basic vulnerability scan against a target web server using Nikto.

For this lab, a local Apache web server has already been installed and started in your environment. This server will act as our target. Nikto operates via the command line, and its most fundamental usage requires only the -h (host) flag followed by the target IP address or domain name.

To initiate a basic scan against your local web server, run the following command in your terminal:

nikto -h http://localhost

At this stage, the goal is to establish a baseline of visible weaknesses and misconfigurations, not to prove exploitability for every item reported.

Once you execute the command, Nikto will begin probing the web server. You will see output appearing on your screen as Nikto discovers information.

- Nikto v2.1.5
---------------------------------------------------------------------------
+ Target IP:          127.0.0.1
+ Target Hostname:    localhost
+ Target Port:        80
+ Start Time:         2026-10-25 10:00:00 (GMT0)
---------------------------------------------------------------------------
+ Server: Apache/2.4.52 (Ubuntu)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined.
+ The X-Content-Type-Options header is not set.
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ /admin.txt: This might be interesting...
+ /info.php: Output from the phpinfo() function was found.
+ 8000 requests: 0 error(s) and 6 item(s) reported on remote host
+ End Time:           2026-10-25 10:00:15 (GMT0) (15 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

The output provides a wealth of information. It identifies the server software version (Apache/2.4.52), points out missing security headers (like X-Frame-Options), and highlights potentially sensitive files that were left on the server, such as /admin.txt and /info.php.

Ignore False Positives (Tuning)

In this step, you will learn how to tune your Nikto scans.

Because Nikto checks for thousands of potential issues, a default scan can sometimes take a long time and produce a lot of "noise" or false positives. To make your scans faster and more focused, Nikto provides the -Tuning flag.

This is a good reminder that scanner output quality is shaped by scope. Narrowing the test categories often improves the usefulness of the findings.

The -Tuning flag allows you to specify exactly which categories of tests you want to run. Each category is represented by a number or letter. For example:

• 1 - Interesting File / Seen in logs
• 2 - Misconfiguration / Default File
• 3 - Information Disclosure
• 4 - Injection (XSS/Script/HTML)
• 9 - SQL Injection

If you only want to check for Misconfigurations (2) and Information Disclosure (3), you can combine these numbers.

Run the following command to perform a tuned scan that only looks for Misconfigurations and Information Disclosure:

nikto -h http://localhost -Tuning 23

You will notice that this scan completes much faster than the basic scan because it skips hundreds of irrelevant tests, such as SQL injection or Denial of Service checks.

- Nikto v2.1.5
---------------------------------------------------------------------------
+ Target IP:          127.0.0.1
+ Target Hostname:    localhost
+ Target Port:        80
+ Start Time:         2026-10-25 10:05:00 (GMT0)
---------------------------------------------------------------------------
+ Server: Apache/2.4.52 (Ubuntu)
+ /admin.txt: This might be interesting...
+ /info.php: Output from the phpinfo() function was found.
+ 1500 requests: 0 error(s) and 3 item(s) reported on remote host
+ End Time:           2026-10-25 10:05:03 (GMT0) (3 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

By using the -Tuning flag, you can tailor Nikto to fit your specific auditing needs, saving time and reducing report clutter.

Save Output to Report

In this step, you will learn how to save the results of your Nikto scan into a structured report file.

When performing professional security audits, it is essential to keep records of your findings. Reading results directly from the terminal is fine for quick checks, but sharing findings with a team requires a proper document. Nikto supports saving output in several formats, including HTML, CSV, XML, and plain text.

To save a report, you need to use two flags:

• -o (or -output): Specifies the file path and name where the report will be saved.
• -Format: Specifies the format of the report (e.g., htm, csv, xml, txt).

Let's run a scan and save the output as an HTML file in your project directory. Execute the following command:

nikto -h http://localhost -Format htm -o /home/labex/project/report.html

While the scan is running, you will still see the standard output in your terminal. Once the scan is complete, Nikto will generate the HTML file at the path you specified.

You can verify that the file was created successfully by listing the contents of your current directory:

ls -l /home/labex/project/report.html

-rw-r--r-- 1 root root 4521 Oct 25 10:10 /home/labex/project/report.html

This HTML report can later be downloaded and opened in any standard web browser, providing a clean, tabular view of all discovered vulnerabilities.

Analyze Nikto Vulnerability Report

In this final step, you will learn how to quickly analyze the generated report using command-line tools.

While HTML reports are great for viewing in a browser, you might often find yourself working purely in a terminal environment without a graphical interface. In such cases, you can use standard Linux text processing tools like grep to extract specific information from your reports.

Let's search the HTML report we generated in the previous step to see if Nikto successfully documented the Apache server status information disclosure.

Use the grep command to search for the word "server-status" inside your report:

grep "server-status" /home/labex/project/report.html

    <td>/server-status: This reveals Apache information. Comment out appropriate line in httpd.conf or restrict access to allowed hosts.</td>

Next, let's check if the report captured the missing X-Frame-Options security header. This header is crucial for preventing clickjacking attacks.

grep "X-Frame-Options" /home/labex/project/report.html

    <td>The anti-clickjacking X-Frame-Options header is not present.</td>

By combining Nikto's reporting capabilities with Linux command-line utilities, you can rapidly parse through large vulnerability scans, extract critical findings, and begin the process of securing your web server.

Summary

Congratulations! You have successfully completed the Web Server Scanning with Nikto lab.

In this lab, you learned how to:

• Execute a basic vulnerability scan against a target web server using Nikto.
• Use the -Tuning flag to focus your scans on specific categories of vulnerabilities, reducing false positives and scan time.
• Export your scan results into a structured HTML report for documentation and sharing.
• Analyze the generated report using command-line tools like grep to quickly identify critical security flaws.

These skills form a strong foundation for conducting rapid, initial security assessments of web infrastructure.