About
nikto runs a series of checks against a web server. It reports missing security headers, default files, outdated banners and other oversights. Use it only on sites you own or have written permission to test.
Install it
pkg install nikto
Run this inside Termux. If the package is already present, pkg will say so and
do nothing.
Commands worth knowing
6 of the invocations you will actually reach for. Tap the copy button to put one on your clipboard.
nikto -h https://example.com Run a baseline check on a site you own to catch missing headers and default files. nikto -h https://example.com -p 8080 Point the check at a service on a non-standard port. nikto -h https://example.com -Tuning 123 Limit the scan to specific test groups to keep a run short. nikto -h https://example.com -ssl Force TLS for a server that redirects oddly or serves both schemes. nikto -h https://example.com -o report.html -Format html Write the findings to a shareable HTML report. nikto -h https://example.com -id admin:secret Supply credentials. Authenticated areas of your own site get checked too. Worked example
Run nikto -h https://example.com and this is what you should see.
$ nikto -h https://example.com
- Server: nginx/1.24.0
+ The anti-clickjacking X-Frame-Options header is not present.
+ /admin/: Admin login page found.
+ 2 host(s) tested Developed by
Chris Sullo and David Lodge .