nikto_usage.html

一个用perl写的功能强大的cgi漏洞检测程序

<b>NAME</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Nikto  - Web Server and CGI Scanner<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Version - 1.32<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
<b>SYNOPSIS</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;nikto [-h target] [options]<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
<b>WARNING</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Nikto is a tool for finding default web files and examing web server and CGI security.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;It makes a lot of reqeusts to the remote server, which in some cases may cause the server<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;to crash.  It may also be illegal to use this software against servers you do not have <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;permission to do test.<br>
<br>
<br>
<b>DESCRIPTION</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Nikto is designed to examine web servers and look for items in multiple categories:<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- misconfigurations<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- default files and scripts<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- insecure files and scripts<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- outdated software<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;It uses Rain Forest Puppy's LibWhisker (wiretrip.net) for HTTP functionality, and can perform checks in <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;HTTP or HTTPS.  It also supports basic port scanning and will determine if a web server<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;is running on any open ports.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Nikto checks and code can be automatically udpated from the main distribution server by<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;using the 'update' option (see below) to ensure Nikto is checking the most recent vulnerabilities.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Nikto will also load user defined checks at startup if they are placed in a file named "user_scan_database.db" in<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;the plugins directory.  Unlike scan_database.db, this file will not be over-written if the -update option is used. This<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;should always be used if you add your own checks (and you should send those checks to [e-mail]).<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Nikto leaves a footprint on a server it scans--both in an invalid 404 check and in the User-Agent header. This can<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;be changed by forcing the $NIKTO{fingerprint} and $NIKTO{useragent} to new values in the source code, OR, if any<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;IDS evasion (-e) option is used.  Note that it's pretty obvious when Nikto is scanning a server anyway--the large<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;number of invalid requests sticks out a lot in the server logs, although with an IDS evasion technique it might not<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;be extremely obvious that it was Nikto.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Why the name Nikto? See the movies The Day the Earth Stood Still" and, of course "Army of Darkness" for the answer. For<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;a full list of pop-culture references to this, see http://www.blather.net/archives2/issue2no21.html which has a lot of<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;good information.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
<b>OPTIONS</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;The options listed below are all optional except the -h target specification.  They can all be abbreviated<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;to the first letter (i.e., -m for -mutate), with the exception of -verbose and -debug.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -Cgidirs&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Optionally force the CGI directories to scan. Valid values are 'none' to not check any, 'all' to force scan all<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CGi directories (like the deprecated -allcgi), or a value to use as the CGI directory, i.e. '/cgi/'. <br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -cookies&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Print out the cookie names and values that were received during the scan.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -evasion <evasion method><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  IDS evasion techniques.  This enables the intrusion detection evasion in LibWhisker.  Multiple options<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  can be used by stringing the numbers together, i.e. to enable methods 1 and 5, use "-e 15".  The valid<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  options are (use the number preceeding each description):<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;   &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Random URI encoding (non-UTF8)<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;   &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Add directory self-reference /./<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;   &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 3&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Premature URL ending<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;   &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 4&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Prepend long random string to request<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;   &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Fake parameters to files<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;   &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TAB as request spacer instead of spaces<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;   &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 7&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Random case sensitivity<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;   &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Use Windows directory separator \ instead of /<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;   &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 9&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Session splicing<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;   &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;See the LibWhisker source for more information, or http://www.wiretrip.net/<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -findonly<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Use port scan to find valid HTTP and HTTPS ports only, but do not perform checks against them.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -Format<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Output format for the file specified with the -output option. Valid formats are:<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;HTM - HTML output format.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;TXT - Text output format. This is the default if -F is not specified.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CSV - Comma Seperated Value format.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -generic <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Force full scan rather than trusting the "Server:" identification string, as many servers allow this<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;to be changed.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -host <ip, hostname or file><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  Target host(s) to check against. This can be an IP address or hostname, or a file of IPs or hostnames.  <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  If this argument is a file, it should formatted as described below. This is the only required option.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -id <user:password:realm><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;HTTP Authentication use, format is userid:password for authorizing Nikto a web server realm. For NTLM<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;realms, format is id:password:realm.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -mutate <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Mutate checks. This causes Nikto put all files with all directories from the .db files and <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;can the host. You might find some oddities this way. Note that it generates a lot of checks.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -nolookup<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Don't perform a host name lookup.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -output <filename><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Write output to this file when complete.  Format is text unless specified via -Format.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -port <port number><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Port number to scan, defaults to port 80 if missing.  This can also be a range or list of ports, which<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Nikto will check for web servers.  If a web server is found, it will perform a full scan unless the<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-f option is used.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -root<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Always prepend this to requests, i.e., changes a request of "/password.txt" to "/directory/password.txt" <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(assuming the value passed on the CLI was "/directory")<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -ssl <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Force SSL mode on port(s) listed.  Note that Nikto attempts to determine if a port is HTTP or HTTPS <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;automatically, but this can be slow if the server fails to respond or is slow to respond to the <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;incorrect one. This sets SSL usage for *all* hosts and ports.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -timeout&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Timeout for each request, default is 10 seconds<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -useproxy<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Use the proxy defined in config.txt for all requests<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -vhost <ip or hostname><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Virtual host to use for the "Host:" header, in case it is different from the target.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -Version<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Print version numbers of Nikto, all plugins and all databases.<br>
<br>
   These options cannot be abbreviated to the first letter:<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-dbcheck<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This option will check the syntax of the checks in the scan_database.db and user_scan_database.db files. This<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;is really only useful if you are adding checks or are having problems.<br>
<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -debug<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Print a huge amount of detail out. In most cases this is going to be more information than you need, so<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;try -verbose first.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-update<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This will connect to cirt.net and download updated scan_database.db and plugin files. Use this with<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;caution as you are downloading files--perhaps including code--from an "untrusted" source. This option<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cannot be combined with any other, but required variables (like the PROXY settings) will be loaded<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;from the config.txt file.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  -verbose <br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Print out a lot of extra data during a run. This can be useful if a scan or server is failing, or to see<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;  &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;exactly how a server responds to each request.<br>
<br>
<b>HOSTNAME FILE</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;If a file is specified with -h instead of a hostname or IP, Nikto will open the file to use it as a list of targets. The file<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;should be formatted with one host per line. If no port is specified, port 80 is assumed. Multiple ports may be specified per<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;host. If a host file is used, any ports specified via -p are added to every host. Valid lines would be:<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;10.100.100.100<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;10.100.100.100:443<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;10.100.100.100,443<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;10.100.100.100:443:8443<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;10.100.100.100,443,8443<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;evilash.example.com,80<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(etc)<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
<br>
<b>CONFIG FILE</b><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;The 'config.txt' file provides a means to set variables at run-time without modifying the Nikto source itself. The<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;options below can be set in the file. Options that accept multiple values (CGIDIRS, SKIPPORTS, etc.) should just use<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;a space to distinguish multiple values.  None of these are required unless you need them.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;CLIOPTS - Add any option here to be added to every Nikto execution, whether specified at the command line or not.<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;NMAP - Path to nmap. If defined, Nikto will use nmap to port scan a host rather than PERL code, and so should be faster.<br>