Nikto (crossover)

nikto -h <url> -Format csv

Scans the web server with Nikto, detecting dangerous files and configurations (crossover from the classic scanner to the pipeline).

Run it when you want the web server scan (not the app logic): Nikto probes the server — dangerous files (backups, admin, config files), exposed directories, server versions with CVEs, insecure configurations. It's the classic web server scanner: the server surface, complementary to the app analysis (ZAP). In DevSecOps, Nikto is the deployment check: server configuration validated (with -Format csv for the pipeline).

Don't use it as an application analysis: Nikto scans the server (files and configurations), not the app logic — app injection and XSS are for the application DAST (ZAP). Active scanning generates traffic (and dangerous tests can break the server): the test environment is the place. And watch out: Nikto is one of the classics — its development is slow and false positives (listed files that don't exist) are common; findings must be verified (does the file exist or is it a scan false positive). Keep the database version up to date.