AppBreakup
Submit an app
Nikto logo

Nikto

Open-source command-line scanner that checks web servers for risky files, outdated software and misconfigurations.

Open sourcePenetration testing tools

Updated · AppBreakup editorial · Linux, macOS, Windows

Visit NiktoSee 5 alternatives

Is Nikto free?

Yes, free and open source

Switch from Nikto to

All 5
Verified facts
4 of 4
Alternatives ranked
5
Approved reviews
0
Visits sent from here
0

About Nikto

Nikto is a long-running open-source web server scanner used by penetration testers and sysadmins during authorised assessments. Pointed at a host, it runs thousands of checks for dangerous or interesting files, outdated server software and common misconfigurations, and fingerprints the server from headers, favicons and other clues. It can scan several ports or a list of hosts (including nmap output), tune which classes of checks run, try default credentials on basic auth realms, and write results as text, JSON, XML, HTML, CSV or straight into MySQL or PostgreSQL. It's a Perl script, so it runs on Linux, macOS and Windows, and there's a Docker image. Nikto is deliberately noisy and focused on coverage rather than stealth or speed, and it doesn't crawl and attack application logic the way a proxy-based scanner does. The code is GPL-licensed and free; its maker also sells a separate commercial Nikto Platform with more features.

Best for: Pentesters and admins who want a quick, scriptable check of a web server's exposed files and versions.

Pros and cons

What works

  • Free and open source with a large, regularly updated check database
  • Many report formats, including direct database output
  • Easy to script across many hosts or ports

Why people leave

  • Command line only, with no graphical interface
  • Very noisy, so it's easily spotted by intrusion detection
  • Checks servers rather than testing application logic like a full DAST proxy

Nikto vs ZAP, Burp Suite and Tenable Nessus

From each app's listing and the prices verified on its own site. A dash means we haven't verified it yet.

AttributeNiktoZAPBurp SuiteTenable Nessus
PricingOpen sourceOpen sourceFree plan + paidPaid
Verified price——$499 (Burp Suite Professional)$199/year
Free planFree appFree appYes, Community EditionYes (Nessus Essentials)
Open sourceNoYesNoNo
Self-hostableNoNoNoYes
PlatformsLinux, macOS, WindowsWindows, macOS, LinuxWindows, macOS, LinuxWindows, macOS, Linux, Web

Top Nikto alternatives

See all 5
  1. 1ZAP logo
    ZAP

    Free open-source scanner and proxy that also crawls and actively tests the application itself.

    68.8
  2. 2Burp Suite logo
    Burp Suite

    The standard web pentest proxy, with a paid scanner that goes far deeper into app logic.

    64.8
  3. 3Tenable Nessus logo
    Tenable Nessus

    Commercial vulnerability scanner covering whole networks, not just web servers.

    61.8
  4. 4sqlmap logo
    sqlmap

    Free tool for the next step: confirming and exploiting SQL injection Nikto can't test.

    59.4
  5. 5Caido logo
    Caido

    Modern web security proxy with a GUI, for manual testing beyond server checks.

    57.5

Why people left Nikto

In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.

No switching stories yet. If you moved away from Nikto, review the app you switched to and tell us why.

Reviews

No approved reviews yet. How we verify reviewers

Write a review of Nikto
Your rating of Nikto

Never shown publicly. A work email helps us verify you.

What did you use it for, and what was good or bad? At least 40 characters.

A GitHub username, your company domain, or say you can send a screenshot. Verified reviews count more.

By submitting, you confirm you're at least 16 and agree to our terms. Your name, rating, review and the date are published; your email isn't. See our privacy policy.

Nikto: common questions

What is Nikto?

Nikto: Open-source command-line scanner that checks web servers for risky files, outdated software and misconfigurations. Best for pentesters and admins who want a quick, scriptable check of a web server's exposed files and versions. Available for Linux, macOS and Windows.

Is Nikto free?

Yes. Nikto is free, open-source software.

Is Nikto open source?

No, Nikto is not open source. Open-source alternatives include ZAP and sqlmap.

What platforms does Nikto run on?

Nikto is available for Linux, macOS and Windows.

What are the best alternatives to Nikto?

The highest-ranked Nikto alternatives right now are ZAP, Burp Suite and Tenable Nessus. See the full ranked list for pricing, platforms and verified facts.

Nikto vs ZAP: what's the difference?

Both Nikto and ZAP are free and open source. ZAP is open source and Nikto is not. Both run on Linux, macOS and Windows.

See all 5 Nikto alternatives