Alternatives to Nikto
Web server scanner for risky files, outdated software and misconfigurations. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Nikto
Web server scanner for risky files, outdated software and misconfigurations.
Replacements
Listings that take over the same core job as Nikto.
Nuclei
A fast vulnerability scanner driven by YAML templates contributed by thousands of security researchers.
Nuclei replaces Nikto's signature checks with readable YAML templates from a community library, runs on Windows too, and has a separate paid cloud platform.
ZAP
Open-source web application security scanner and intercepting proxy.
ZAP adds an intercepting proxy and automated application scanning in a Java desktop tool, with an API for CI pipelines, rather than Nikto's server-focused path checks.
Wapiti
Check web applications with a Python-based vulnerability scanner.
Wapiti is a Python-based scanner that tests the web application itself rather than server files, and its scans can change application state.
OpenVAS
Full-featured open-source vulnerability scanner.
OpenVAS is a full network vulnerability scanner with scheduling and reporting, covering far more than web servers, but installation and feed synchronisation are involved.
Nessus
Widely used commercial vulnerability scanner.
Nessus is a closed-source commercial scanner with a large plugin library and compliance auditing; its free Essentials edition is capped at sixteen IP addresses.
ZAP
Inspect and test web applications with the ZAP security proxy.
ZAP combines manual request inspection through its security proxy with automated scanning, runs on Windows, macOS and Linux, and its automated findings still need review.
Similar software
Related functionality, not a direct replacement.
dirsearch
Web path scanner for discovering hidden directories and files.
Feroxbuster
Discover web content during an authorized application assessment.
Gobuster
Check candidate web paths and network names during security testing.
WPScan
WordPress security scanner for plugin, theme and configuration checks.
sqlmap
Automates detecting and exploiting SQL injection flaws, for testing your own applications before someone else does.
HackerTarget WhatWeb Scan
An online scan that runs WhatWeb and Wappalyzer to fingerprint the technologies behind a website.
