Nikto Platform

Appearance

Nikto PlatformWeb Security Testing

Web-server scanning, crawling, content discovery, and LFI file retrieval — one browser console.

Getting Started
User Guide

Nikto Scanner

Probes web servers for misconfigurations, dangerous files, outdated software, and thousands of known issues. Launch scans from the New Scan wizard or a host's Nikto tab, tune request options and modules (including MS10-070 active testing), and review findings as they land.

Scans guide →

Web Crawler

Choose Standard (fast HTTP), Headless Browser (JS/SPA + screenshot), or both. Every engine logs each request to the activity log and feeds link discovery, technology detection, outdated JS checks, and recommendations.

Web Crawler guide →

LFI Commander (LFIC)

When a target has a local file inclusion flaw, LFI Commander uses it to pull files off the server — system paths, web roots, home directories, and more. Configure the vulnerable request, run module-driven scans, then browse and download retrieved content in a file explorer.

LFIC guide →

Bustah

Wordlist-driven path and directory discovery. Sweep for hidden admin panels, backups, and common paths; review hits in a results tree and merge them into the host sitemap.

Bustah guide →

Cloud Storage Listings

Detects anonymous Amazon S3, S3-compatible, and Azure Blob Storage listings. Walk a few pages into a finding, then export the full object list from Recommendations.

Cloud storage guide →

Tools in one console ​

The Nikto Platform puts complementary scanners behind a single UI. Launch them from the New Scan wizard or a host's tool tab.

Nikto Scanner ​

Nikto is a classic web server scanner. Point it at HTTP or HTTPS targets and it runs a large library of checks: default files, misconfigurations, headers, SSL issues, outdated components, and other common web weaknesses. Nikto scans can run over HTTP/3 (QUIC) when you opt in — see HTTP/3 scanning. LFIC and Bustah can use the same transport via Scan Defaults; the crawler cannot. Results appear as findings you can triage, add to a report, and export.

See Scans for the wizard and progress monitoring, and Scan options for Nikto modules and MS10-070. The Web Crawler and Bustah can run in the same launch.

LFI Commander ​

LFI Commander (shown in the UI as LFIC) is for local file inclusion vulnerabilities. You describe how the target includes files (the inject point, encoding, wrappers), confirm the flaw with a probe, then run scans built from modules and filesets to retrieve interesting paths. Retrieved files appear in a browsable tree with extracted content, intel from analysis modules, and zip downloads.

See LFIC for the setup wizard, modules, and results explorer.

Projects, findings, and audit ​

Projects and hosts organize targets. Findings and Report are where you triage and curate results. The activity log records every HTTP request to a target. A valid license is required to start new work against a target. Start with Getting Started or the User Guide.

Copyright © 2026 Hack LLC. All rights reserved. View the End User License Agreement.

Proprietary software. Licensed for use under the End User License Agreement.

Copyright © 2026 Hack LLC. All rights reserved.