Top 20 Nikto Commands Every Security Professional Should Know

1. Perform a basic scan against a target using the command `nikto -h http://example.com`. This command scans the specified host or URL with all default plugins.

2. Target non-standard ports by using the command `nikto -h 192.168.1.1 -p 8080`. This command scans the target on a specific port other than the default port 80.

3. Scan HTTPS targets by using the command `nikto -h https://example.com -ssl`. This command uses SSL/TLS when connecting to HTTPS targets, ignoring certificate errors if necessary.

4. Save the scan output to an HTML report by using the command `nikto -h http://example.com -o scan.html -Format html`. This command generates an HTML report that includes severity ratings and descriptions.

5. Save the scan output in JSON format by using the command `nikto -h http://example.com -o scan.json -Format json`. This command generates a machine-readable output that can be parsed programmatically or fed into other tools.

6. Scan multiple ports on a single host by using the command `nikto -h 192.168.0.1 -p 80,443,8080`. This command scans several common web ports on a single target.

7. Scan multiple hosts from a file by using the command `nikto -h targets.txt`. This command scans dozens or hundreds of targets in a single run, using a file containing a list of hosts.

8. Supply HTTP Basic authentication credentials by using the command `nikto -h http://example.com -id admin:password`. This command provides authentication credentials in the format username:password.

9. Route traffic through an HTTP proxy by using the command `nikto -h http://example.com -useproxy http://127.0.0.1:8080`. This command routes all Nikto traffic through an HTTP proxy, allowing for inspection, modification, and logging of requests.

10. Set a custom User-Agent string by using the command `nikto -h http://example.com -useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"`. This command sets a custom User-Agent string to help bypass basic filtering from default scanner User-Agents.

11. Select test categories using the tuning flag by using the command `nikto -h http://example.com -Tuning 1234`. This command runs specific categories of tests based on the characters provided, such as Interesting File (1), Misconfiguration (2), and Injection (4).

12. Run only specific categories of tests by using the command `nikto -h http://example.com -Tuning 34`. This command runs only Information Disclosure (3) and Injection (4) tests.

13. Exclude specific categories of tests by using the command `nikto -h http://example.com -Tuning x6`. This command runs all tests except Denial of Service (6).

14. Use IDS evasion techniques by using the command `nikto -h http://example.com -evasion 1`. This command applies LibWhisker IDS evasion techniques to make detection by IDS/IPS more difficult.

15. Combine multiple evasion techniques by using the command `nikto -h http://example.com -evasion 123`. This command layers multiple obfuscation methods, making it harder for IDS/IPS to detect the scan.

16. List available plugins by using the command `nikto -list-plugins`. This command lists all plugins that Nikto can run and then exits without performing a scan.

17. Run specific plugins only by using the command `nikto -h http://example.com -Plugins apacheusers`. This command selects which plugins to run, using a comma-separated list of plugin names.

18. Scan with all CGI directories by using the command `nikto -h http://example.com`. This command is useful for targeted testing on specific server components.