nikto_scan
Scan web applications for vulnerabilities by running Nikto security tests to identify potential security issues in target URLs.
Instructions
Run Nikto web vulnerability scanner
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Target URL | |
| port | No | Target port (default: 80/443) |
Implementation Reference
- src/tools/vulnscan.ts:91-131 (handler)The primary handler function that runs the Nikto scanner via child_process.exec, parses results, and structures the ScanResult output.async niktoScan(url: string, port?: number): Promise<ScanResult> { try { let command = `nikto -h ${url}`; if (port) { command += ` -p ${port}`; } // Output format command += ' -Format txt'; console.error(`Executing: ${command}`); const { stdout, stderr } = await execAsync(command, { timeout: 600000 // 10 min timeout }); const vulnerabilities = this.parseNiktoOutput(stdout, url); return { target: url, timestamp: new Date().toISOString(), tool: 'nikto', results: { vulnerabilities, total_found: vulnerabilities.length, raw_output: stdout }, status: 'success' }; } catch (error) { return { target: url, timestamp: new Date().toISOString(), tool: 'nikto', results: {}, status: 'error', error: error instanceof Error ? error.message : String(error) }; } }
- src/index.ts:152-159 (schema)JSON schema defining input parameters for nikto_scan: required 'url' (string) and optional 'port' (number).inputSchema: { type: "object", properties: { url: { type: "string", description: "Target URL" }, port: { type: "number", description: "Target port (default: 80/443)" } }, required: ["url"] }
- src/index.ts:149-160 (registration)Tool registration in the MCP server's listTools handler, defining name, description, and input schema for discovery.{ name: "nikto_scan", description: "Run Nikto web vulnerability scanner", inputSchema: { type: "object", properties: { url: { type: "string", description: "Target URL" }, port: { type: "number", description: "Target port (default: 80/443)" } }, required: ["url"] } },
- src/index.ts:521-522 (registration)Dispatch registration in CallToolRequestSchema switch statement that invokes the actual niktoScan handler.case "nikto_scan": return respond(await this.vulnScanTools.niktoScan(args.url, args.port));
- src/tools/vulnscan.ts:227-260 (helper)Supporting function that parses Nikto's textual output into VulnerabilityResult array with severity classification.private parseNiktoOutput(output: string, target: string): VulnerabilityResult[] { const vulnerabilities: VulnerabilityResult[] = []; const lines = output.split('\n'); for (const line of lines) { if (line.includes('+ ') && !line.includes('Nikto v') && !line.includes('Target Host')) { let severity: 'info' | 'low' | 'medium' | 'high' | 'critical' = 'info'; // Determine severity based on content if (line.toLowerCase().includes('xss') || line.toLowerCase().includes('sql injection') || line.toLowerCase().includes('command injection')) { severity = 'high'; } else if (line.toLowerCase().includes('directory') || line.toLowerCase().includes('admin') || line.toLowerCase().includes('backup')) { severity = 'medium'; } else if (line.toLowerCase().includes('version') || line.toLowerCase().includes('information')) { severity = 'low'; } vulnerabilities.push({ id: `nikto-${vulnerabilities.length + 1}`, name: 'Nikto Finding', severity, description: line.trim(), affected_url: target }); } } return vulnerabilities; }