Nikto
Metrics as of , from the GitHub or GitLab API of each repository. Refreshed monthly.
What Nikto is
Nikto is a web server scanner. It runs from the command line as the Perl script nikto.pl, or as a Docker container from Docker Hub or ghcr.io. A scan targets a host or URL and runs all plugins unless a list is given. Tuning options select test classes such as misconfiguration, information disclosure, injection, SQL injection, file upload and authentication bypass. Evasion options apply URI encoding techniques to requests. Reports save as CSV, JSON, HTML, SQL, plain text or XML. The test database uses a small matching DSL over response body, headers, cookies and status codes. The code is GPL-3.0, while the database files carry separate distribution terms.
Written from the project's README, read , and its documentation (see sources).
- Category
- Security testing
- License
- GPL-3.0-only (COPYING applies GPL-3.0 to Nikto's code only; database files are not GPL and may only be distributed with Nikto.)
- Language
- Perl
- Changelog
- Releases on GitHub
Repository metrics
Status
activeLast commit within 90 days of the fetch date.Computed from the last commit date and the archive flag on the fetch date. See the status rules.
Alternatives
Listed security testing tools, same primary language first, then by GitHub stars. Each line gives one fact from the tool's documentation where it differs from Nikto's, with its source.
sqlmap: Scan targets: Web application parameters: GET, POST, cookie, User-Agent and Referer values. source: Docs: Features
Trivy: Scan targets: Container images, filesystems, remote Git repositories, virtual machine images, Kubernetes. source: README
Nuclei: Scan targets: Target URLs and hosts, from a single target or a list file. source: README
Gitleaks: Scan targets: Secrets such as passwords, API keys and tokens in git repositories, files and stdin. source: README
Promptfoo: Scan targets: LLM apps, through red teaming and vulnerability scanning. source: README
ffuf: Scan targets: Web servers: content paths, virtual hosts, GET parameters and POST data. source: README
ZAP: Scan targets: Web applications. source: README
OSV-Scanner: Scan targets: Project dependencies, checked against the OSV database. source: README
How to install
docker pull hackllc/nikto:latestQuestions
Is Nikto open source?
Yes. Nikto is released under GPL-3.0-only, an OSI-approved license, as reported by the GitHub API on 2026-09-22. COPYING applies GPL-3.0 to Nikto's code only; database files are not GPL and may only be distributed with Nikto.
Is Nikto maintained?
On 2026-09-22, the last commit to the default branch was on 2026-08-15, so the listed status is active. Rule: Last commit within 90 days of the fetch date.
How many GitHub stars does Nikto have?
10,736 stars on 2026-09-22, from the GitHub API. The number is refreshed at each monthly update.
What language is Nikto written in?
The repository's primary language, as reported by the GitHub API, is Perl.
How do I install Nikto?
The README gives this command: docker pull hackllc/nikto:latest
Sources
- GitHub REST API: repository, read
- GitHub REST API: commits, read
- GitHub REST API: latest release, read
- GitHub REST API: contributors, read
- LICENSE file, read
- README, read