Nikto

Classic web scanner: dangerous files, headers and known versions.

Old-school web vulnerability scanner. It fires thousands of requests looking for default files, admin panels, forgotten backups, missing security headers and server versions with known CVEs. It is extremely noisy (any WAF or log will catch it), but in a lab it gives a fast picture of what the server exposes, and its version warnings are often the first thread to pull.

Family Vulnerabilities & exploits

Flags -h -p -ssl -Tuning -o

Concepts Web Content Discovery (Directory Fuzzing), From version to exploit

Cheatsheet Discovery & fuzzing

Installation

sudo apt install -y nikto

Useful commands3 commands

Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.