Nikto Platform
A pentester’s web security testing suite — scan, crawl, discover, exploit, and generate report content from one web console.
Run it on your own network — internal, air-gapped, or in the cloud. Your targets and findings never leave your machine. Made by pentesters, for pentesters.
Crawl with a real browser.
A headless browser maps the app for JavaScript, screenshots, detected tech. Paths seed Bustah discovery.
Discover, interactively.
Bustah turns crawl results into content discovery you steer: review new directories and descend when you want, instead of fire-and-forget brute force.
Recommendations.
The platform suggest new tests and tools to run, some runnable with a click, some links to specialized software.
Operate an LFI, don’t just flag it.
LFIc performs mass file retrieval from a target, parsing users and checking home dirs, following web configs to doc roots, PHP shell injection, and more.
LFIc — operate a local file inclusion
Classic LFI testing is a manual path payload. LFIc confirms the inclusion, then runs modules that enumerate files, chase process, home dirs, and web-server files; pull platform profiles; inject PHP shells; browse a tree of retrieved files and download them. The results are like having a foothold, not a scanner hit.
Nikto scanning
Web server checks for dangerous files, outdated software, and misconfigurations.
Crawler
Maps the application with a headless browser to find paths and technologies.
Bustah
Interactive content discovery that you pause and descend into as it finds directories.
LFIc
Confirms a local file inclusion, then lets you retrieve and browse files.
Recommendation engine
Suggests follow-up tests from findings, some launchable from the console.
JWT analysis
Examines JSON Web Tokens found in responses for weaknesses.
Secrets detection
Flags credentials and keys exposed in responses.
Outdated Libraries
Identifies client-side libraries running out-of-date versions.
HTTP/3
Full testing of targets over HTTP/3.
ms10-070
Test & exploit classic the ASP oracle.
Reporting
Findings triage workflow and reports.
Activity log
Records every HTTP request sent to a target for auditing.
All Patreon members will get discounts on future licenses, bugs/suggestions from the group will take priority and lead to more discounts!
The Nikto Platform
A unified web interface to run the Nikto Platform’s embedded tools with a full triage and reporting interface.
- Scanner findings triage view before adding to report
- “Report Fodder” — screenshot-able explanations of testing methodology, results, and more, for your pentest reports
- Findings screenshot mode for clean report images
- Deduplicated findings and report items across issues and scanned
- Recommendations based on observed app–run included tools or pointers to third-party resources
- Support for HTTP 1.0/1.1/1.2/3.0 (H3/QUIC)
- Upstream proxy support
- Light/Dark/Retro UI modes
- Logging
Nikto Scanner
The classic trusted web server scanner, rebuilt for speed and better accuracy:
- Check for 7k+ dangerous or interesting files, misconfigurations, panels
- Completely rewritten 404 detection for more accurate findings
- Secrets detection in results
- Version checks for thousands of products
- Basic/NTLM/Digest password guessing
- Feeds other tools in the platform
- Shellshock, OptionsBleed, Cloud SSRF tests, Apache mod_userdir user enum, Spring Boot Actuator, Firebase checks, and more.
Bustah
Interactive fast content discovery you steer, not fire-and-forget brute force.
- Auto traverse or choose per found directory
- Built in or user-supplied file lists
- Seed directories from crawler
- Filter hits based on code or content matching
- Quick filter results on file names and contents
- Multi-method false-positive reduction
Response Analysis & Post Processing
All target web server responses are analyzed for issues, secrets, and more:
- JWT Analysis (expiration check, sensitive claim callout, key callout
- JWT Testing (alg:none, JWK injection, key-confusion)
- Cookie Testing (settings, layered decoding, secrets/PII detection, serialization)
- API Key validity testing including full Google suite
- Secrets callout
- Errors and stack traces
- TLS Certificate checks
- Technology detection with version checks
Crawler
Maps the application with a real browser:
- Headless Chromium or traditional crawl
- Seed other tools with found paths
- Screenshot base webpage
- Detects JS technologies and checks versions
- Check for indexing at all levels
LFI Commander
Turn a local file inclusion/path traversal into an easy exploit path. The results land in a browsable tree of retrieved files.
- Pull users from passwd file
- Probe home directories for sensitive files with weak permissions
- Extract OS info
- Find and parse web server configs
- Inject PHP shells log poisoning via require()
- Automatically remove HTML artifacts from results for clean viewing/download
- Quick filter results on file names and contents
- Linux /proc/ enumeration
- Probe for files in web roots, sourced from:
- Common file lists
- Robots.txt
- Crawler
- PHP include/require paths
Cloud Storage Enumerator
Run a recommended job to extract direct download links from cloud storage buckets including Amazon S3 (and compatible) and Azure Blob Storage:
- Total files counted
- Paged exploration of files
- Downloadable HTML report with links to files
Padding Oracle
Detects and exploits the classic ASP.NET padding-oracle flaw (MS10-070):
- Confirm vulnerability via multi-stage probes
- Exploit to retrieve web.config file
- Multiple levels of confirmation: simple detection alert, confirmation, or exploit
| Feature | Nikto Platform | Nikto (OSS) |
|---|---|---|
| Web Scan (dangerous files, misconfigs, versions) | ✓ | ✓ |
| Browser Crawl for Discovery | ✓ | ✗ |
| Interactive content discovery (Bustah) | ✓ | ✗ |
| Operate an LFI/Traversal (LFI Commander) | ✓ | ✗ |
| JWT Analysis & Testing | ✓ | ✗ |
| Secrets Detection | ✓ | ✗ |
| Outdated JS Library Detection | ✓ | ✗ |
| API Key Validity Testing | ✓ | ✗ |
| Google API Key Service Testing | ✓ | ✗ |
| MS10-070 Padding Oracle Test & Exploit | ✓ | ✗ |
| Cloud Storage Bucket Enumeration | ✓ | ✗ |
| Follow-Up Testing Recommendations | ✓ | ✗ |
| HTTP/3 (QUIC) Support | ✓ | ✗ |
| Web Interface | ✓ | ✗ |
| Findings Triage & Reporting | ✓ | ✗ |
| Report Fodder Testing Explanations for Pentest Reports | ✓ | ✗ |
| Screenshot Modes for Reports | ✓ | ✗ |
| License | Commercial | GPLv3 |
| Get it | Join Patreon for Beta | Nikto2 on GitHub |