nikto

nikto -h <url>

Web vulnerability scanner that looks for misconfigurations, sensitive files, and CVEs.

After fingerprinting, to obtain a report of common vulnerabilities in web servers and applications. Nikto is fast and detects issues like outdated versions, exposed configuration files, and missing security headers. It is a good initial sweep tool.

Nikto is noisy and can cause blocks or alerts on WAF. If the target has a strong WAF, prefer stealthier tools like wpscan or dirb. Also, if the site is highly dynamic, results may have false positives.