Nikto

Install & Update

# Kali / Debian / Ubuntu
sudo apt-get install nikto

# Git clone — latest code (v2.5.0+)
git clone https://github.com/sullo/nikto
cd nikto/program && perl nikto.pl -Help

# Docker — no local Perl required
docker pull sullo/nikto
docker run --rm sullo/nikto -h <target>

# Update plugin/signature database
nikto -update

# Verify installation and check DB integrity
nikto -Version
nikto -dbcheck

[!info]+ Command Breakdown

1. apt-get install nikto — installs the packaged version; may lag behind upstream releases
2. git clone — always pulls the latest v2.5.0+ code; preferred for up-to-date signatures
3. docker pull/run — fully self-contained; no Perl dependency on the host
4. -update — syncs the vulnerability plugin and signature database; run before every engagement
5. -dbcheck — syntax-validates DB files; run after updates to confirm integrity

Basic Web Scan

# Standard HTTP scan
nikto -h http://192.168.1.10

# Specify port
nikto -h <host> -p <port>

# Force HTTPS
nikto -h <host> -ssl

# Multiple ports
nikto -h <host> -p 80,443,8080

# Bulk scan from file (one host per line)
nikto -h hosts.txt

# HTTPS on non-standard port
nikto -h 192.168.1.10 -p 8443 -ssl

# Authenticated scan with virtual host override
nikto -h http://192.168.1.10 -id admin:admin -vhost internal.corp.local

# Scan host list with 2s delay, abort after 10 min
nikto -h hosts.txt -Pause 2 -maxtime 600s

# Route all traffic through Burp Suite
nikto -h http://10.10.10.10 -useproxy http://127.0.0.1:8080

# Spoof User-Agent
nikto -h http://10.10.10.10 -useragent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

[!info]+ Key Flags Reference

[!info]+ Output Interpretation

1. + OSVDB-XXXX — known vulnerability reference; always verify before reporting
2. + Server: Apache/2.2.x — outdated version detected; cross-check NVD/CVE
3. + /admin/ returning 200 — exposed panel; investigate access controls
4. + OPTIONS: PUT, DELETE — dangerous HTTP methods enabled; test for write access
5. + X-Frame-Options header not set — potential clickjacking; note for report

[!warning]+ OPSEC / Detection Notes 6. Default UA Mozilla/5.00 (Nikto/2.x.x) is trivially flagged by any WAF — always spoof with -useragent 7. Even with UA spoofing, the sequential probe pattern (/.git, /admin, /cgi-bin etc.) is a strong fingerprint 8. Every request appears in access.log and error.log; WAF rules will trigger 9. -Pause adds delay but does not randomise order — rate-based detection still fires 10. No stealth mode exists — treat all Nikto scans as loud/noisy 11. Use -Tuning b (software ID only) for the lowest-footprint option

[!failure]+ Common Errors

Tuning & Targeted Checks

[!faq]+ What is Tuning? Tuning narrows scans to specific vulnerability classes — reduces noise, cuts scan time, and lowers detection surface. Combine multiple codes in a single string (e.g. -Tuning 49 = XSS + SQLi).

[!info]+ Tuning Code Reference

# XSS + SQLi only
nikto -h http://10.10.10.10 -Tuning 49

# Info disclosure + misconfiguration
nikto -h http://10.10.10.10 -Tuning 23

# Auth bypass + command execution
nikto -h http://10.10.10.10 -Tuning a8

# All checks EXCEPT denial of service
nikto -h http://10.10.10.10 -Tuning x6

# Software ID only — lowest footprint
nikto -h http://10.10.10.10 -Tuning b

# Full sweep minus DoS, save as JSON
nikto -h http://10.10.10.10 -Tuning x6 -o results.json -Format json

[!info]+ Command Breakdown

1. Tuning codes are combined as a string — -Tuning 49 runs codes 4 AND 9 simultaneously
2. x reversal prefix — -Tuning x6 runs everything except DoS; safest full-scan option
3. b alone — software identification only; quietest possible scan; good for initial fingerprinting
4. Combining -Tuning with -o and -Format json captures structured results for later analysis

[!danger]+ Tuning Code 6 — Denial of Service Code 6 can cause service disruption on the target. Exclude with -Tuning x6 unless DoS testing is explicitly authorised in your scope agreement.

[!warning]+ OPSEC Note Multiple tuning codes still execute many sequential requests — the pattern remains recognisable to IDS/WAF regardless of which codes are selected.

Evasion Techniques

[!warning]+ Effectiveness Warning Nikto evasion codes provide very limited bypass against modern WAFs (Cloudflare, ModSecurity v3). Request volume is unchanged — rate/volume-based detection still fires. Best combined with -Pause, narrow -Tuning, and UA spoofing.

[!info]+ Evasion Code Reference

# Random URI encoding
nikto -h http://10.10.10.10 -evasion 1

# URI encoding + case change combined
nikto -h http://10.10.10.10 -evasion 17

# Targeted scan + evasion combo + slow down
nikto -h http://10.10.10.10 -Tuning 49 -evasion 12 -Pause 1

[!info]+ Command Breakdown

1. Evasion codes combine as a string — -evasion 17 applies codes 1 AND 7 simultaneously
2. -evasion 12 -Pause 1 — encoding + directory self-reference with 1s delay; reduces scan velocity
3. Pairing narrow -Tuning with evasion codes and UA spoofing is the closest Nikto gets to low-noise operation

Output Formats & Nmap Integration

[!info]+ Supported Output Formats (-Format)

# JSON output
nikto -h http://10.10.10.10 -o scan.json -Format json

# HTML report for client delivery
nikto -h http://10.10.10.10 -p 443 -ssl -o report.htm -Format htm

# XML for vulnerability management import
nikto -h http://10.10.10.10 -o nikto_out.xml -Format xml

# Multiple formats from one scan (comma-separated)
nikto -h http://10.10.10.10 -o results.csv -Format csv,xml

# nmap greppable output piped directly to Nikto
# (discovers HTTP ports then scans each automatically)
nmap -p80,443,8080,8443 192.168.1.0/24 -oG - | nikto -h -

# nmap XML output fed to Nikto directly
nmap -sV -p80,443 192.168.1.0/24 -oX nmap_out.xml
nikto -h nmap_out.xml -o nikto_results.xml -Format xml

# Live output to stdout AND file simultaneously
nikto -h http://10.10.10.10 -Display P | tee nikto_live.txt

[!info]+ Command Breakdown

1. -Format json requires v2.5.0+; older apt packages may not support it — use git clone if missing
2. -oG - | nikto -h - — nmap pipes greppable output directly; Nikto reads host list from stdin; efficient for subnet sweeps
3. -h nmap_out.xml — Nikto natively parses nmap XML; automatically extracts hosts and ports
4. -Display P | tee — streams live findings to terminal and writes to file simultaneously
5. msf+ / nbe formats require additional DB configuration in nikto.conf
6. Format is auto-detected from file extension if -Format is omitted

Nuclei

Install & Template Management

# Option 1 — Go install (always latest)
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Option 2 — Pre-built binary (Linux x64)
wget https://github.com/projectdiscovery/nuclei/releases/latest/download/nuclei_linux_amd64.zip
unzip nuclei_linux_amd64.zip && mv nuclei /usr/local/bin/

# Option 3 — Docker
docker pull projectdiscovery/nuclei:latest
docker run --rm projectdiscovery/nuclei -u https://example.com

# Option 4 — Kali apt (may lag upstream; prefer binary)
sudo apt-get install nuclei

# Verify installation
nuclei -version
nuclei -health-check

[!info]+ Template Management Commands

# First run auto-downloads templates to ~/.local/nuclei-templates/
nuclei -u example.com

# Update templates to latest release
nuclei -ut

# Update nuclei engine binary
nuclei -up

# Use custom template directory
nuclei -ud /opt/nuclei-templates -ut

# Show installed template version
nuclei -tv

# List all available templates
nuclei -tl

# List all available tags
nuclei -tgl

# Validate a template before use
nuclei -t /path/to/template.yaml -validate

# Disable auto-update check (OPSEC — suppresses outbound to GitHub on start)
nuclei -u example.com -duc

[!info]+ Template Source Reference

[!info]+ Official Template Directory Layout

nuclei-templates/
├── http/cves/              # CVE-specific (1,400+)
├── http/exposures/         # Info disclosure (275+)
├── http/misconfiguration/  # Misconfigs (237+)
├── http/exposed-panels/    # Admin panels (662+)
├── http/default-logins/    # Default credentials (103+)
├── http/technologies/      # Tech fingerprint (282+)
├── http/vulnerabilities/   # General vulns (509+)
├── workflows/              # Multi-step chains (189+)
├── ssl/                    # TLS/cert checks
├── dns/                    # DNS checks
├── network/                # TCP/UDP checks
└── file/                   # Local file checks

Basic Vulnerability Scan

# All templates, single target
nuclei -u https://example.com

# Scan from target list
nuclei -l targets.txt

# Specific template or directory
nuclei -u https://example.com -t http/cves/

# Multiple template directories
nuclei -u https://example.com -t http/cves/ -t ssl -t http/exposures/

# High/critical severity only
nuclei -l targets.txt -s high,critical

# Tag-based — WordPress checks
nuclei -u https://example.com -tags wordpress

# Exclude info noise
nuclei -u https://example.com -es info

# Auto-scan — tech detection drives template selection
nuclei -u https://example.com -as

# New templates only (latest release delta)
nuclei -u https://example.com -nt

# Specific CVE by template ID
nuclei -u https://example.com -id CVE-2021-44228

# Load template directly from URL
nuclei -u https://example.com -turl https://raw.githubusercontent.com/.../template.yaml

[!info]+ Key Flags — Target

[!info]+ Key Flags — Templates & Filtering

[!info]+ Common Tags Reference

[!info]+ Output Interpretation

1. [INF] — Tech/version detected; low operational priority
2. [LOW] / [MED] — Misconfigs, disclosures; assess contextual risk
3. [HIGH] / [CRIT] — Confirmed or likely exploitable; investigate immediately
4. Template ID shown inline (e.g. CVE-2021-44228) — map to NVD for full CVSS score
5. [matcher-status] lines with -ms — shows failed matches; useful for false-positive tuning

[!failure]+ Common Errors

Output Formats & Reporting

[!info]+ Output Flag Reference

# JSONL with timestamps, no raw payloads
nuclei -l targets.txt -s high,critical -jsonl-export findings.jsonl -ts -or

# Markdown report — full req/resp included
nuclei -u https://example.com -markdown-export ./report/

# SARIF for GitHub Actions CI gate
nuclei -u https://example.com -sarif-export nuclei.sarif

# Filter JSONL with jq — critical findings only
nuclei -u https://example.com -json-export out.json
cat out.json | jq '.[] | select(.info.severity=="critical")'

# Silent mode — print findings only, no banner
nuclei -l targets.txt -s high,critical -silent -o findings.txt

# Persistent report database across multiple scans
nuclei -l targets.txt -rdb nuclei_results.db

# Store every request/response as evidence
nuclei -u https://example.com -store-resp -srd ./traffic_archive/

[!info]+ Command Breakdown

1. -ts -or — timestamps every finding and omits raw payloads; keeps files compact for audit logs
2. -markdown-export — generates one Markdown file per template match; ideal for client deliverables
3. -sarif-export — SARIF format integrates with GitHub Security tab and Azure DevOps pipeline gates
4. jq '.[] | select(.info.severity=="critical")' — filters JSON export to critical findings only; powerful for triage
5. -rdb — SQLite database accumulates results across multiple scan runs; enables trend tracking
6. -store-resp -srd — archives every raw HTTP request/response for evidence and replay

Rate Limiting & OPSEC

[!info]+ Rate / Concurrency Flags

[!info]+ OPSEC Flags

# Low-and-slow stealth scan — high/critical only
nuclei -l targets.txt -rl 5 -c 5 -bs 5 -timeout 15 -s high,critical

# No OAST, proxied, spoofed UA, throttled
nuclei -u https://example.com \
  -ni \
  -p http://127.0.0.1:8080 \
  -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" \
  -rl 10 -c 5

# Passive mode — zero active requests (feed Burp export)
nuclei -l burp_responses.txt -im jsonl -passive

# TLS fingerprint randomisation
nuclei -u https://example.com -tlsi

# Resume a large interrupted scan
nuclei -l targets.txt -resume resume.cfg

# Disable update telemetry entirely
nuclei -u https://example.com -duc -ni

[!info]+ Command Breakdown

1. -rl 5 -c 5 -bs 5 — throttles to 5 req/s, 5 parallel templates, 5 hosts at once; drastically reduces noise
2. -ni — the single most important OPSEC flag; stops DNS/HTTP callbacks to oast.pro, oast.live, oast.me which are externally observable
3. -passive -im jsonl — feeds pre-captured responses (e.g. Burp export); zero new requests sent to target
4. -tlsi — randomises TLS JA3 fingerprint; experimental but reduces tool-specific TLS detection
5. -duc — prevents version-check HTTP request to GitHub on every invocation; relevant in air-gapped or monitored environments

[!warning]+ OPSEC / Detection Notes 6. -ni is the single most important OPSEC flag — OAST callbacks to oast.pro/oast.live/oast.me are externally observable and will expose the scan 7. Default 150 req/s across 25 parallel templates is very loud; reduce to ≤10 req/s for stealth operations 8. All requests still appear in web server access.log — no flag prevents server-side logging 9. -duc prevents a version-check HTTP request to GitHub on every invocation 10. Self-host Interactsh for OOB testing with zero external callbacks 11. Prefer narrow template sets (-t http/cves/ -s high,critical) over all-templates runs — cuts request count by 90%+ 12. -as auto-scan fires a Wappalyzer fingerprint probe first — adds one visible pre-scan request

DAST / Fuzzing

[!danger]+ Authorisation Warning DAST mode sends modified/injected payloads — highly detectable by WAF/IDS. Only use on explicitly authorised scope. Combine with -rl 5 -ni -p http://127.0.0.1:8080 for proxied, throttled fuzzing.

# Clone fuzzing templates
git clone https://github.com/projectdiscovery/fuzzing-templates

# Enable DAST mode — all fuzzing templates
nuclei -list endpoints.txt -dast

# Fuzz query parameters only
nuclei -list endpoints.txt -dast -tags fuzzing-req-query

# Fuzz request body only
nuclei -list endpoints.txt -dast -tags fuzzing-req-body

# Fuzz cookies
nuclei -list endpoints.txt -dast -tags fuzzing-req-cookie

# Fuzz request headers
nuclei -list endpoints.txt -dast -tags fuzzing-req-header

# Fuzz URL path segments
nuclei -list endpoints.txt -dast -tags fuzzing-req-path

# Skip header + cookie fuzzing to reduce noise
nuclei -list endpoints.txt -dast -etags fuzzing-req-header,fuzzing-req-cookie

# Katana crawl → Nuclei DAST pipeline
katana -u https://example.com -jc -aff -o endpoints.txt
nuclei -list endpoints.txt -dast -s high,critical -rl 10

# Feed Katana JSONL output directly
nuclei -l katana.jsonl -im jsonl -dast

[!info]+ DAST Fuzzing Flags

[!info]+ Command Breakdown

1. -dast — activates DAST engine; requires fuzzing-templates to be present
2. -tags fuzzing-req-query — restricts fuzzing to URL query parameters; lowest-noise DAST option
3. -etags fuzzing-req-header,fuzzing-req-cookie — excludes header and cookie fuzzing; reduces detection surface
4. katana -jc -aff — JavaScript crawling with form filling; produces comprehensive endpoint list for DAST input
5. -im jsonl — tells Nuclei the input file is JSONL format (Katana’s native output format)

Workflows & Chaining

[!faq]+ What are Workflows? Workflows run multi-step conditional scans — detect technology first, then automatically select and run relevant templates. Defined in YAML; avoids running irrelevant templates against every target.

# Run a specific workflow
nuclei -u https://example.com -w workflows/cms-detect.yaml

# Run all workflows in a directory
nuclei -u <target> -w workflows/

# Run all official workflows
nuclei -u https://example.com -w ~/.local/nuclei-templates/workflows/

# Combine workflow + structured output
nuclei -u https://example.com -w workflows/cms-detect.yaml \
  -markdown-export ./report/ -s medium,high,critical

[!example]+ CMS Detection Workflow YAML

id: example-workflow
info:
  name: CMS Detection + Targeted Scan
  author: operator
  severity: info
workflows:
  - template: http/technologies/cms-detection.yaml
    matchers:
      - name: wordpress
        subtemplates:
          - tags: wp-plugin,wp-theme
          - template: http/cves/2021/    # WordPress CVEs
      - name: drupal
        subtemplates:
          - tags: drupal
      - name: joomla
        subtemplates:
          - tags: joomla

[!example]+ Auth Bypass Workflow YAML

id: auth-bypass-workflow
info:
  name: Auth Bypass Assessment
  author: operator
  severity: critical
workflows:
  - template: http/technologies/tech-detect.yaml
  - template: http/default-logins/
    matchers:
      - name: login-successful
        subtemplates:
          - template: http/exposures/
          - tags: exposure,rce

[!info]+ Workflow Structure Breakdown

1. id — unique identifier used in output and reporting
2. workflows > template — first template to execute (detection step)
3. matchers > name — matches a specific result from the detection template
4. subtemplates — templates/tags to run only if the matcher fires; conditional chaining
5. Workflows eliminate wasted requests — e.g. WordPress CVEs only run if WordPress is confirmed

Recon Pipeline Integration

[!important]+ Install the Full ProjectDiscovery Stack

go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
go install github.com/projectdiscovery/katana/cmd/katana@latest
go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

# Subdomain → live hosts → Nuclei (high/critical CVEs)
subfinder -d example.com -silent | \
  httpx -silent | \
  nuclei -s high,critical -t http/cves/ -ni -rl 20

# Full pipeline: subdomains → live hosts → Nuclei with exclusions
subfinder -d example.com -silent | \
  httpx -silent | \
  tee alive.txt | \
  nuclei -l alive.txt -es info -ept ssl -s medium,high,critical \
    -ni -rl 15 -o findings.txt

# Crawl endpoints then DAST fuzz
katana -u https://example.com -jc -aff -silent -o endpoints.txt
nuclei -list endpoints.txt -dast -tags fuzzing-req-query,fuzzing-req-body \
  -s high,critical -rl 5 -ni

# Full automated recon pipeline (single command)
subfinder -d example.com -all -silent | \
  httpx -silent | \
  katana -list - -silent -nc -jc -aff -ef woff,css,png,svg,jpg -aff | \
  nuclei -im jsonl -es info,unknown -ept ssl -ss template-spray \
    -ni -rl 10 -o nuclei_out.txt

# Scan from nmap XML output
nmap -sV -p80,443,8080,8443 192.168.1.0/24 -oG - | \
  grep "open" | awk '{print $2}' | \
  httpx -silent | \
  nuclei -s high,critical -ni -rl 10

[!info]+ Key httpx Pipeline Flags

[!info]+ Command Breakdown

1. subfinder -silent | httpx -silent — passive subdomain enumeration feeds into live host probing; httpx filters unreachable hosts
2. tee alive.txt — splits the pipe; writes live hosts to file AND continues the pipeline simultaneously
3. -ept ssl — excludes SSL protocol templates; avoids noisy cert-expiry findings in mixed pipelines
4. -ss template-spray — sprays one template across ALL hosts before moving to the next; spreads load and avoids per-host detection thresholds
5. -ef woff,css,png,svg,jpg — Katana excludes static asset extensions; keeps endpoint list clean for Nuclei
6. -im jsonl — instructs Nuclei to parse input as JSONL (Katana’s native output); preserves full request context

[!warning]+ OPSEC / Detection Notes

1. Always include -ni in automated pipelines — prevents uncontrolled OAST callbacks
2. Use -ss template-spray to spread load and avoid per-host detection thresholds
3. subfinder performs passive enumeration only; katana and nuclei are active — scope accordingly
4. Add -duc to suppress update checks in CI/CD pipelines

Writing Custom Templates

[!faq]+ When to Write a Custom Template Write custom templates when: a specific behaviour has no existing template; you need to detect a proprietary application’s endpoints; you want to check for a custom misconfiguration; or you are adapting a PoC exploit for templated scanning.

[!example]+ Minimal HTTP Template Skeleton

id: custom-template-id               # unique; used in output

info:
  name: Example Exposed Debug Page
  author: operator
  severity: medium                   # info / low / medium / high / critical
  description: Detects exposed debug endpoint
  tags: exposure,custom

http:
  - method: GET
    path:
      - "{{BaseURL}}/debug"          # {{BaseURL}} = scheme://host:port

    matchers-condition: and          # and / or
    matchers:
      - type: word                   # word / regex / status / size / binary / dsl
        part: body                   # body / header / all / interactsh_protocol
        words:
          - "debug mode"
          - "stack trace"
        condition: or                # or / and

      - type: status
        status:
          - 200

[!example]+ Template with Extractor + Multiple Paths

id: version-disclosure

info:
  name: App Version Disclosure
  author: operator
  severity: info
  tags: tech,exposure

http:
  - method: GET
    path:
      - "{{BaseURL}}/version"
      - "{{BaseURL}}/api/version"
      - "{{BaseURL}}/status"

    matchers:
      - type: regex
        part: body
        regex:
          - '([0-9]+\.[0-9]+\.[0-9]+)'

    extractors:
      - type: regex
        part: body
        regex:
          - '([0-9]+\.[0-9]+\.[0-9]+)'

[!example]+ OOB / OAST Template (requires Interactsh)

id: ssrf-oob-check

info:
  name: SSRF OOB Detection
  author: operator
  severity: high
  tags: ssrf

http:
  - method: GET
    path:
      - "{{BaseURL}}/?url={{interactsh-url}}"

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"

# Validate template syntax
nuclei -t custom-template.yaml -validate

# Test against single target with debug output
nuclei -u https://example.com -t custom-template.yaml -debug

# Run with verbose output
nuclei -u https://example.com -t custom-template.yaml -v

# Run against target list
nuclei -l targets.txt -t ./custom-templates/ -s medium,high -ni

[!info]+ Command Breakdown

1. -validate — parses YAML and checks template syntax before running; always validate before deploying
2. -debug — prints full raw HTTP request and response for every template probe; essential for development
3. {{BaseURL}} — Nuclei variable automatically populated with scheme://host:port from the target
4. {{interactsh-url}} — automatically generates an OOB callback URL; match fires when the callback is received
5. matchers-condition: and — ALL matchers must fire for a finding to be reported; reduces false positives

[!info]+ Matcher Types Reference

References

1. Nikto — GitHub
2. Nikto — Official Site
3. Nikto — Official Documentation
4. Nikto — Usage Documentation
5. Nikto — Arch Linux Man Page
6. Nikto — HighOn.Coffee Cheat Sheet
7. Nikto — Terminal Guide
8. Nuclei — GitHub
9. Nuclei — Install Docs
10. Nuclei — Running Docs
11. Nuclei — Template Structure Docs
12. Nuclei — README
13. Nuclei — Workflows Documentation
14. Nuclei — kb.offsec.nl Reference
15. Nuclei — Mass Scale Usage
16. Nuclei — Beginner’s Guide (Bugcrowd)
17. Nuclei Templates — Official
18. Nuclei Templates — Fuzzing
19. Nuclei Templates — DAST Templates
20. Nuclei Templates — Template Guide
21. Interactsh — Self-hosted OOB
22. Pipeline One-Liners — 0xPugal
23. ProjectDiscovery Blog

#WebScan #Nikto #Nuclei #DAST #Fuzzing #ReconPipeline #WebAppTesting #VulnerabilityScanning #OPSEC #ProjectDiscovery