← retour aux outils back to tools

# Nikto

Scanner de serveur web qui vérifie les fichiers dangereux, les versions de logiciels obsolètes et les mauvaises configurations courantes. Web server scanner that checks for dangerous files, outdated software versions, and common misconfigurations.

↗ https://github.com/sullo/nikto

## Overview

Nikto is an open-source web server scanner that performs comprehensive tests including checking for over 6700 potentially dangerous files, outdated server software, and version-specific vulnerabilities. It’s noisy but thorough.

## Common Usage

Basic scan

    nikto -h https://target.com

Scan specific port

    nikto -h 10.10.10.1 -p 8080

Scan with authentication

    nikto -h https://target.com -id admin:password

    # Save report
    nikto -h https://target.com -o report.html -Format htm
    nikto -h https://target.com -o report.txt

Scan through proxy (Burp)

    nikto -h https://target.com -useproxy http://127.0.0.1:8080

Scan specific path

    nikto -h https://target.com -root /webapp/

Disable SSL cert verification

    nikto -h https://target.com -nossl

## Key Findings to Review

- Server version — check CVE databases for the detected version
- Dangerous files — `.git/`, `phpinfo.php`, `backup.zip`, admin panels
- Missing headers — X-Frame-Options, X-Content-Type-Options, CSP
- Default content — default index files, sample scripts

Help / Man page

    nikto -h <host> [options]

    TARGET:
      -h HOST         Target host/IP/URL
      -p PORT         Target port (default: 80)
      -ssl            Force SSL/HTTPS
      -vhost HOST     Virtual host to send in Host header

    SCANNING:
      -Tuning x       Scan tuning (0-9, x = multiple):
                      0=File Upload, 1=Interesting File,
                      2=Misconfiguration, 3=Info Disclosure,
                      4=Injection, 5=Remote File Retrieval,
                      6=Denial of Service, 7=Remote Shell,
                      8=Command Execution, 9=SQL Injection

    AUTHENTICATION:
      -id USER:PASS   HTTP Basic/NTLM authentication
      -C all          Test all cookies

    OUTPUT:
      -o FILE         Output file
      -Format FORMAT  htm, csv, txt, xml, json

    PERFORMANCE:
      -timeout N      Timeout per request (default: 10s)
      -useproxy URL   HTTP proxy

    EVASION:
      -evasion N      IDS evasion technique (1-8)

## Vue d’ensemble

Nikto est un scanner de serveur web open-source qui effectue des tests complets incluant la vérification de plus de 6700 fichiers potentiellement dangereux, de logiciels serveur obsolètes et de vulnérabilités spécifiques aux versions. Il est bruyant mais exhaustif.

## Utilisation courante

    # Scan de base
    nikto -h https://target.com

    # Scan sur un port spécifique
    nikto -h 10.10.10.1 -p 8080

    # Scan avec authentification
    nikto -h https://target.com -id admin:password

    # Sauvegarder le rapport
    nikto -h https://target.com -o report.html -Format htm
    nikto -h https://target.com -o report.txt

    # Scanner via un proxy (Burp)
    nikto -h https://target.com -useproxy http://127.0.0.1:8080

    # Scanner un chemin spécifique
    nikto -h https://target.com -root /webapp/

    # Désactiver la vérification du certificat SSL
    nikto -h https://target.com -nossl

## Résultats clés à examiner

- Version du serveur : vérifier les bases CVE pour la version détectée
- Fichiers dangereux : `.git/`, `phpinfo.php`, `backup.zip`, panneaux d’administration
- En-têtes manquants : X-Frame-Options, X-Content-Type-Options, CSP
- Contenu par défaut : fichiers index par défaut, scripts exemples

Aide / Page de manuel

    nikto -h <host> [options]

    TARGET:
      -h HOST         Target host/IP/URL
      -p PORT         Target port (default: 80)
      -ssl            Force SSL/HTTPS
      -vhost HOST     Virtual host to send in Host header

    SCANNING:
      -Tuning x       Scan tuning (0-9, x = multiple):
                      0=File Upload, 1=Interesting File,
                      2=Misconfiguration, 3=Info Disclosure,
                      4=Injection, 5=Remote File Retrieval,
                      6=Denial of Service, 7=Remote Shell,
                      8=Command Execution, 9=SQL Injection

    AUTHENTICATION:
      -id USER:PASS   HTTP Basic/NTLM authentication
      -C all          Test all cookies

    OUTPUT:
      -o FILE         Output file
      -Format FORMAT  htm, csv, txt, xml, json

    PERFORMANCE:
      -timeout N      Timeout per request (default: 10s)
      -useproxy URL   HTTP proxy

    EVASION:
      -evasion N      IDS evasion technique (1-8)