Nikto Cheat Sheet - rt Cheat Sheet by r.taylor27

Single Port

Host/IP

nikto -h 192.16­8.0.1

URL/PORT

nikto -h https:­//1­92.1­68.0.1­:443/

Multiple Ports

Same Host

nikto -h 192.16­8.0.1 -p 80,88,443

-Display+

3 Show all 200/OK responses

4 Show URLs which require authen­tic­ation

P Print progress to STDOUT

S Scrub outupt of IPs and hostnames

-evasion+

3 Premature URL ending

4 Prepend long random string

7 Change the case of the URL

8 Use Windows directory separator ()

-list-­plugins

List all available plugins, perform no testing

1 Test all files with all root direct­ories

2 Guess for password file names

5 Attempt to brute force sub-domain names, assume that the host name is the parent domain

6 Attempt to guess directory names from the supplied dictionary file

-port+

Port to use (default 80)

1 Intere­sting File / Seen in logs

2 Miscon­fig­uration / Default File

5 Remote File Retrieval - Inside Web Root

6 Denial of Service

9 SQL Injection

0 File Upload

c Remote Source Inclusion

d WebService

-Tuning

0 File Upload

1 Intere­sting File/ Seen in Logs

4 Injection

5 Remote File Retrieval - Web

8 Command Execution / Remote Shell

9 SQL Injection

c Remote Source

x Reverse Tuning