Dictionary · Ethical Hacking Tools
Nikto
Web testing · Intermediate
A web-server scanner that checks a site you are allowed to test for outdated software, dangerous files, and common misconfigurations.
It looks for known bad signs on a web server, such as old version banners and default files. It is noisy and belongs only on targets in the test scope.
Example: A finding says the server header reveals an old product version. The next step is to confirm the version and patch it, not to assume every finding is exploitable.
Git in the Zone explains security tools and attack terminology so you can recognize them and defend against them. Practice only on systems you own or have written permission to test. Nothing on this site runs a command or an exploit.
What it is for
Check an authorized web server for known dangerous files and outdated signals.
Authorized use: Use it only on systems you own or have written permission to test. Git in the Zone explains the tool; it does not launch it.
Operating systems: Runs anywhere a Perl environment is available, commonly Linux.
Language you will see
- finding
- server header
- false positive
How to read the options
- Server header: A banner that may reveal the product version. Treat it as a clue to verify.
- Finding: One reported issue. It still needs a person to decide whether it is real and important.
How to read a finding
+ Server: ExampleServer/2.4.x + /backup: directory indexing is enabled
The server announced a version, and a directory may list its files. Both are leads for hardening. Neither line is permission to download the files.
Common misconception
- A scanner finding is a lead. Some are false positives, and a version banner is not itself a break-in.