Nikto
CIRT •
Since 2001
Quick Actions
Official Docs
What is Nikto?
Nikto is a popular open-source web server scanner that checks for dangerous files, outdated server software, version-specific problems, and server misconfigurations. It performs comprehensive tests against web servers to identify potential security issues. As a security testing tool, it does not respect robots.txt. Its presence in server logs may indicate authorized security testing or unauthorized scanning attempts.
User Agent String
Nikto
How to Control Nikto
Block Completely
To prevent Nikto from accessing your entire website, add this to your robots.txt file:
# Block Nikto
User-agent: Nikto
Disallow: /
Block Specific Directories
To restrict access to certain parts of your site while allowing others:
User-agent: Nikto
Disallow: /admin/
Disallow: /private/
Disallow: /wp-admin/
Allow: /public/
Set Crawl Delay
To slow down the crawl rate (note: not all bots respect this directive):
User-agent: Nikto
Crawl-delay: 10
How to Verify Nikto
Verification Method:
Verify scanner is authorized by the website owner
Verify scanner is authorized by the website owner
Learn more in the official documentation.
Detection Patterns
Multiple ways to detect Nikto in your application:
Basic Pattern
/Nikto/iStrict Pattern
/^Nikto$/Flexible Pattern
/Nikto[\s\/]?[\d\.]*?/iVendor Match
/.*CIRT.*Nikto/iImplementation Examples
// PHP Detection for Nikto
function detect_nikto() {
$user_agent = $_SERVER['HTTP_USER_AGENT'] ?? '';
$pattern = '/Nikto/i';
if (preg_match($pattern, $user_agent)) {
// Log the detection
error_log('Nikto detected from IP: ' . $_SERVER['REMOTE_ADDR']);
// Set cache headers
header('Cache-Control: public, max-age=3600');
header('X-Robots-Tag: noarchive');
// Optional: Serve cached version
if (file_exists('cache/' . md5($_SERVER['REQUEST_URI']) . '.html')) {
readfile('cache/' . md5($_SERVER['REQUEST_URI']) . '.html');
exit;
}
return true;
}
return false;
}
# Python/Flask Detection for Nikto
import re
from flask import request, make_responsedef detect_nikto():
user_agent = request.headers.get('User-Agent', '')
pattern = r'Nikto'
if re.search(pattern, user_agent, re.IGNORECASE):
# Create response with caching
response = make_response()
response.headers['Cache-Control'] = 'public, max-age=3600'
response.headers['X-Robots-Tag'] = 'noarchive'
return True
return False# Django Middleware
class NiktoMiddleware:
def __init__(self, get_response):
self.get_response = get_response
def __call__(self, request):
if self.detect_bot(request):
# Handle bot traffic
pass
return self.get_response(request)
// JavaScript/Node.js Detection for Nikto
const express = require('express');
const app = express();// Middleware to detect Nikto
function detectNikto(req, res, next) {
const userAgent = req.headers['user-agent'] || '';
const pattern = /Nikto/i;
if (pattern.test(userAgent)) {
// Log bot detection
console.log('Nikto detected from IP:', req.ip);
// Set cache headers
res.set({
'Cache-Control': 'public, max-age=3600',
'X-Robots-Tag': 'noarchive'
});
// Mark request as bot
req.isBot = true;
req.botName = 'Nikto';
}
next();
}app.use(detectNikto);
# Apache .htaccess rules for Nikto# Block completely
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} Nikto [NC]
RewriteRule .* - [F,L]# Or redirect to a static version
RewriteCond %{HTTP_USER_AGENT} Nikto [NC]
RewriteCond %{REQUEST_URI} !^/static/
RewriteRule ^(.*)$ /static/$1 [L]# Or set environment variable for PHP
SetEnvIfNoCase User-Agent "Nikto" is_bot=1# Add cache headers for this bot
<If "%{HTTP_USER_AGENT} =~ /Nikto/i">
Header set Cache-Control "public, max-age=3600"
Header set X-Robots-Tag "noarchive"
</If>
# Nginx configuration for Nikto# Map user agent to variable
map $http_user_agent $is_nikto {
default 0;
~*Nikto 1;
}server {
# Block the bot completely
if ($is_nikto) {
return 403;
}
# Or serve cached content
location / {
if ($is_nikto) {
root /var/www/cached;
try_files $uri $uri.html $uri/index.html @backend;
}
try_files $uri @backend;
}
# Add headers for bot requests
location @backend {
if ($is_nikto) {
add_header Cache-Control "public, max-age=3600";
add_header X-Robots-Tag "noarchive";
}
proxy_pass http://backend;
}
}
Should You Block This Bot?
Recommendations based on your website type:
| Site Type | Recommendation | Reasoning |
|---|---|---|
| E-commerce | Optional | Evaluate based on bandwidth usage vs. benefits |
| Blog/News | Allow | Increases content reach and discoverability |
| SaaS Application | Block | No benefit for application interfaces; preserve resources |
| Documentation | Selective | Allow for public docs, block for internal docs |
| Corporate Site | Limit | Allow for public pages, block sensitive areas like intranets |
Advanced robots.txt Configurations
E-commerce Site Configuration
User-agent: Nikto
Crawl-delay: 5
Disallow: /cart/
Disallow: /checkout/
Disallow: /my-account/
Disallow: /api/
Disallow: /*?sort=
Disallow: /*?filter=
Disallow: /*&page=
Allow: /products/
Allow: /categories/
Sitemap: https://example.com/sitemap.xml
Publishing/Blog Configuration
User-agent: Nikto
Crawl-delay: 10
Disallow: /wp-admin/
Disallow: /drafts/
Disallow: /preview/
Disallow: /*?replytocom=
Allow: /
SaaS/Application Configuration
User-agent: Nikto
Disallow: /app/
Disallow: /api/
Disallow: /dashboard/
Disallow: /settings/
Allow: /
Allow: /pricing/
Allow: /features/
Allow: /docs/
Quick Reference
User Agent Match
NiktoRobots.txt Name
NiktoCategory
securityRespects robots.txt
May not respect
Copied to clipboard!