Ravi Sir's Cyber Security Cards › Revision Cards
Nikto: Web Server Scanning
Nikto: Web Server Scanning Nikto scans a web server for dangerous files, old software, default pages and missing security headers. It is noisy (easy to detect) but fast. Good for a first look at your own Apache or Nginx. Each finding is a homework item for the web server you built. Fix default pages
Read card text
What this card says
What it is
Nikto scans a web server for dangerous files, old software, default pages and missing security headers.
How it works
It is noisy (easy to detect) but fast. Good for a first look at your own Apache or Nginx.
Why it matters for security
Each finding is a homework item for the web server you built.
Fix default pages, update software, add headers.
| Nikto says | Meaning |
|---|---|
| Server version disclosed (Apache/2.2.8) | Attacker learns the exact version |
| Directory indexing found | Files in a folder are listed publicly |
| phpinfo.php found | Full PHP configuration exposed |
| X-Frame-Options / Content-Security-Policy header missing | Clickjacking and XSS protection absent |
| HTTP TRACE method enabled | Old cross-site tracing risk |
Learn more in the lesson: 20.5 Nikto: Web Server Scanning