Nikto

Nikto is a Perl-based tool using LibWhisker for efficient scanning of web servers and CGI directories. It performs generic and specific checks against server software, detects issues like missing security headers, outdated versions, and uncommon headers. The tool supports output in plain text or HTML formats and features an easily updatable CSV-format checks database.

Use cases include reconnaissance of web applications for known vulnerabilities, such as Apache mod_negotiation enabled with MultiViews, leaked inodes via ETags, or absence of headers like X-Frame-Options and X-XSS-Protection. It scans for allowed HTTP methods, robots.txt entries, and more, providing detailed reports on potential security issues.

Nikto is particularly useful in penetration testing workflows for quick web server enumeration, supporting SSL, proxies with authentication, cookies, and automatic HTTP version switching.

Nikto uses LibWhisker for fast security audits, performing checks from an updatable CSV database against web servers. It sends multiple HTTP requests (e.g., 371 in the example), analyzing responses for vulnerabilities like server leaks, missing headers, outdated software, and configuration issues. Supports SSL via libnet-ssleay-perl, proxying, cookies, and tuning specific test categories.