-ask yes|no|auto
Whether to ask about submitting updates. Options: yes
(ask about each), no (don't ask, don't send), auto (don't ask, just
send).
-Add-header header:value
Add HTTP headers (can be used multiple times, one per
header pair).
-check6
Check if IPv6 is working (connects to ipv6.google.com or
value set in nikto.conf).
-Cgidirs dirs
Scan these CGI directories. Special words
"none" or "all" may be used. A literal value for a CGI
directory such as "/cgi-test/" may be specified (must include
trailing slash).
-config file
Use this config file instead of the default
nikto.conf.
-dbcheck
Check database and other key files for syntax
errors.
-Display options
Turn on/off display outputs: 1 (Show redirects), 2 (Show
cookies received), 3 (Show all 200/OK responses), 4 (Show URLs which require
authentication), D (Debug output), E (Display all HTTP errors), P (Print
progress to STDOUT), S (Scrub output of IPs and hostnames), V (Verbose
output).
-evasion technique
Encoding technique: 1 (Random URI encoding), 2 (Directory
self-reference), 3 (Premature URL ending), 4 (Prepend long random string), 5
(Fake parameter), 6 (TAB as request spacer), 7 (Change the case of the URL), 8
(Use Windows directory separator), A (Use carriage return as request spacer),
B (Use binary value 0x0b as request spacer).
-followredirects
Follow 3xx redirects to new location.
-Format format
Save file format: csv (Comma-separated-value), json (JSON
Format), htm (HTML Format), sql (Generic SQL, see docs for schema), sqld (SQL
Direct, directly inserts into MySQL/PostgreSQL database), txt (Plain text),
xml (XML Format). Multiple formats can be specified as a comma-separated list.
If not specified, the format will be taken from the file extension passed to
-output. Note: sqld format requires DB_TYPE, DB_HOST, DB_PORT, DB_NAME in
nikto.conf and NIKTO_DB_USER, NIKTO_DB_PASS environment variables.
-Help
Display extended help information.
-host target
Host(s) to target. Can be an IP address, hostname or text
file of hosts. A single dash (-) maybe used for stdout. Can also parse nmap
-oG style output.
-id id:pass[:realm]
ID and password to use for host Basic host
authentication. Format is "id:password" or
"id:password:realm".
-ipv4
IPv4 Only.
-ipv6
IPv6 Only.
-key file
Client certificate key file.
-list-plugins
List all available plugins, perform no testing.
-maxtime time
Maximum testing time per host (e.g., 1h, 60m,
3600s).
-mutate options
Guess additional file names: 1 (Test all files with all
root directories), 2 (Guess for password file names), 3 (Enumerate user names
via Apache), 4 (Enumerate user names via cgiwrap), 6 (Attempt to guess
directory names from dictionary file).
-mutate-options options
Provide information for mutates.
-no404
Disables nikto attempting to guess a 404 page.
-nocookies
Do not use cookies from responses in requests.
-nointeractive
Disable interactive features.
-nolookup
Do not perform name lookups on IP addresses.
-noslash
Strip trailing slash from URL (e.g., '/admin/' to
'/admin').
-nossl
Do not use SSL to connect to the server.
-Option name=value
Over-ride an option in nikto.conf, can be issued multiple
times.
-output file
Write output to the file specified ('.' for auto-name).
The format used will be taken from the file extension. This can be over-ridden
by using the -Format option.
-Pause seconds
Seconds (integer or floating point) to delay between each
test.
-Platform platform
Platform of target: nix (Unix/Linux), win (Windows), or
all (both).
-Plugins list
List of plugins to run (default: ALL).
-port ports
TCP port(s) to target. To test more than one port on the
same host, specify the list of ports. Ports can be specified as a range (i.e.,
80-90), or as a comma-delimited list, (i.e., 80,88,90). If not specified, port
80 is used.
-RSAcert file
Client certificate file.
-root path
Prepend root value to all requests, format is
/directory.
-Save directory
Save positive responses to this directory ('.' for
auto-name).
-ssl
Only test SSL on the ports specified. Using this option
will dramatically speed up requests to HTTPS ports, since otherwise the HTTP
request will have to timeout first.
-timeout seconds
Seconds to wait before timing out a request. Default
timeout is 10 seconds.
-Tuning options
Tuning options will control the test that Nikto will use
against a target. By default, if any options are specified, only those tests
will be performed. If the "x" option is used, it will reverse the
logic and exclude only those tests. Use the reference number or letter to
specify the type, multiple may be used:
•0 - File Upload
•1 - Interesting File / Seen in logs
•2 - Misconfiguration / Default File
•3 - Information Disclosure
•4 - Injection (XSS/Script/HTML)
•5 - Remote File Retrieval - Inside Web Root
•6 - Denial of Service
•7 - Remote File Retrieval - Server Wide
•8 - Command Execution / Remote Shell
•9 - SQL Injection
•a - Authentication Bypass
•b - Software Identification
•c - Remote Source Inclusion
•d - WebService
•e - Administrative Console
•x - Reverse Tuning Options (i.e., include all
except specified)
-url target
Target host/URL (alias of -host).
-Userdbs type
Load only user databases, not the standard databases.
Options: all (Disable standard dbs and load only user dbs), tests (Disable
only db_tests and load udb_tests).
-useragent string
Over-rides the default useragent.
-useproxy proxy
Use the HTTP proxy defined in the configuration file, or
given as argument in the format
http://server:port.
-Version
Display the Nikto software, plugin and database
versions.
-vhost hostname
Specify the Host header to be sent to the target.
-404code codes
Ignore these HTTP codes as negative responses (always).
Format is "302,301".
-404string string
Ignore this string in response body content as negative
response (always). Can be a regular expression.
