Nikto

v2.5.0CIRT.net

Fires thousands of checks against a web server — outdated software, dangerous files, default pages, header hygiene. The range's Nikto reads the authored web-service fixtures and reports the findings the scenario models.

Category: Web application security testing
Package: nikto
Runs on: Linux · Windows
Commands: nikto, nikto.pl

Findings are drawn from the authored web-service fixtures. No request leaves the browser.

Install it

The scripts below install the real CIRT.net package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-nikto.sh

Windows installer (PowerShell)

Install-nikto.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Nikto
```
sudo apt install -y nikto
```

RHEL, Fedora (dnf)

Install Nikto
```
sudo dnf install -y nikto
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install Nikto
```
sudo pacman -S --noconfirm nikto
```

Alpine (apk)

Install Nikto
```
sudo apk add nikto
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which nikto
```
Check the version
```
nikto --version
```
The range reports 2.5.0.

Remove it

Take it off again
```
sudo apt remove --purge nikto
```

On Windows

Windows Package Manager (winget)

Search the catalog
```
winget search nikto
```
Install Nikto
```
winget install --id nikto -e
```
Package names drift between distributions; search first if this one misses.

Chocolatey (choco)

Install Nikto
```
choco install nikto -y
```
Run the shell as administrator.

Check it worked

Confirm it resolves
```
where nikto
```
Check the version
```
nikto --version
```
The range reports 2.5.0.

Remove it

Take it off again
```
winget uninstall --id nikto
```

Inside the range

Tick it on the launch screen
Under Nikto's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y nikto
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Nikto

Reps: Range Targets — swing at the piñataA per-run virtual estate of intentionally-weak boxes. Use nmap, curl, sqlmap, nikto and hydra against the range's own hosts; the target names, credentials, tables and flags change every run, so the walkthrough has to be earned, not memorised.
Reps: Range Targets — swing at the piñata (Windows)The Range Targets estate, worked from a Windows analyst box. Same per-run virtual targets, driven with PowerShell, nmap, sqlmap, nikto and hydra from a Windows console — the names, credentials, tables and flags still change every run.
Pentest: External Recon to FootholdEnumerate a customer's public perimeter from an approved scan window, chain a stale service to a foothold, and file the first finding with CVSS and remediation before you touch anything else.
Pentest: Web App Assessment (OWASP Top 10)Assess a storefront with the Burp-lite workbench at /pentest/proxy: repeat a login, fuzz an id parameter, catch an IDOR and a stored XSS, and file each finding under its OWASP Top 10 category.