mcpField
N
nikto-scan

nikto-scan

github.com/wgpsecSecurity1.8k43 installsUpdated 4d ago
Repository

About nikto-scan

nikto-scan is a methodology for using Nikto to assess web servers, aimed at security testers reviewing configurations and common risks. It covers scan tuning, authentication, and report output.

Key features

  1. 01Check outdated software, risky files, and misconfigurations
  2. 02Tune checks by category
  3. 03Use credentials or custom request headers
  4. 04Export JSON, HTML, and CSV reports

Use cases

  1. 01Check a web server for known issues
  2. 02Run information-disclosure checks only
  3. 03Scan a site that requires authentication
  4. 04Create an archivable scan report

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wgpsec/aboutsecurity --skill nikto-scan

After installing, type/nikto-scanin Claude Code to confirm it loaded.

Details

From the project README

Nikto Web 服务器漏洞扫描方法论

Nikto 是经典的 Web 服务器漏洞扫描器。核心优势：检查项丰富（7000+ 项）+ 开箱即用（无需配置）+ 覆盖面广（过时软件/危险文件/配置错误/已知漏洞）。

项目地址：https://github.com/sullo/nikto

Phase 1: 基本扫描

# 扫描单个目标
nikto -h http://target.com

# 指定端口
nikto -h target.com -p 8080

# HTTPS 扫描
nikto -h https://target.com

# 多端口扫描
nikto -h target.com -p 80,443,8080,8443

Phase 2: 扫描调优

# 指定扫描类型（Tuning）
# 1=文件上传 2=默认文件 3=信息泄露 4=注入 5=远程获取 6=DoS 7=远程shell 8=命令执行 9=SQL注入
nikto -h http://target.com -Tuning 123489

# 只做信息泄露检查
nikto -h http://target.com -Tuning 3

# 排除 DoS 类检查
nikto -h http://target.com -Tuning x6

# 指定插件
nikto -h http://target.com -Plugins apache_expect_xss,ssl

# 设置最大扫描时间
nikto -h http://target.com -maxtime 300

Phase 3: 认证和代理

# Basic Auth
nikto -h http://target.com -id admin:password

# Cookie 认证
nikto -h http://target.com -Add-header "Cookie: session=abc123"

# 自定义 User-Agent
nikto -h http://target.com -useragent "Mozilla/5.0"

# 通过代理
nikto -h http://target.com -useproxy http://127.0.0.1:8080

# 禁用 404 猜测（减少误报）
nikto -h http://target.com -no404

Phase 4: 输出格式

# JSON 输出
nikto -h http://target.com -Format json -output results.json

# HTML 报告
nikto -h http://target.com -Format html -output report.html

# CSV 输出
nikto -h http://target.com -Format csv -output results.csv

# XML 输出
nikto -h http://target.com -Format xml -output results.xml

常用场景速查

场景命令
快速扫描nikto -h http://target.com -maxtime 120
全面扫描nikto -h http://target.com -Tuning 123456789abc
SSL 检查nikto -h https://target.com -Plugins ssl
信息泄露nikto -h http://target.com -Tuning 3
带认证扫描nikto -h http://target.com -id admin:pass

Comments

Markdown supported