What is Nikto?

Nikto is an Open Source web server scanner which performs comprehensive tests against web
servers for multiple items,

 It including over 6500 potentially dangerous files/CGIs,

 checks for outdated versions of over 1250 servers,
 It Identifies version specific problems on over 270 servers.
 It also checks for server configuration items such as the presence of multiple index files,
HTTP server options, and will attempt to identify installed web servers and software.
Scan items and plugins are frequently updated and can be automatically updated.

Installing Nikto:

# wget http://cirt.net/nikto/nikto-2.1.5.tar.gz

Saving to: `nikto-2.1.5.tar.gz'

# tar xvf nikto-2.1.5.tar.gz

nikto-2.1.5/

And there we have it. Nikto is saved into nikto-2.1.5/.

Running Nikto.

Here we have the basic output when we run Nikto.

nikto-2.1.5# perl nikto.pl

- Nikto v2.1.5
---------------------------------------------------------------------------
+ ERROR: No host specified

-config+ Use this config file

-Display+ Turn on/off display outputs
-dbcheck check database and other key files for syntax errors
-Format+ save file (-o) format
-Help Extended help information
-host+ target host
-id+ Host authentication to use, format is id:pass or id:pass:realm
-list-plugins List all available plugins
-output+ Write output to this file
-nossl Disables using SSL
-no404 Disables 404 checks
-Plugins+ List of plugins to run (default: ALL)
-port+ Port to use (default 80)
-root+ Prepend root value to all requests, format is /directory
-ssl Force ssl mode on port
-Tuning+ Scan tuning
-timeout+ Timeout for requests (default 10 seconds)
-update Update databases and plugins from CIRT.net
-Version Print plugin and database versions
-vhost+ Virtual host (for Host header)
+ requires a value

Note: This is the short help output. Use -H for full help text.
Basic website scan:

perl nikto.pl -h targetsite.com

This will preform a basic scan.

Running Nikto through Tor:

To run Nikto with Tor, you will need to be running Tor and edit the nikto.conf file, lines 52-53:
# Proxy settings — still must be enabled by -useproxy
PROXYHOST=127.0.0.1
PROXYPORT=8118

And then run Nikto with the following command:

./nikto.pl -h targetsite.com -useproxy

This will run Nikto through Tor.

Another useful command of Nikto is the -port option.

You are able to scan other ports than the default port 80.
./nikto.pl -h targetsite.com -useproxy -port 22