nikto_scan

Instructions

Implementation Reference

• src/tools/vulnscan.ts:91-131 (handler)

  The primary handler function that runs the Nikto scanner via child_process.exec, parses results, and structures the ScanResult output.

  async niktoScan(url: string, port?: number): Promise<ScanResult> {
    try {
      let command = `nikto -h ${url}`;
      
      if (port) {
        command += ` -p ${port}`;
      }
      
      // Output format
      command += ' -Format txt';
      
      console.error(`Executing: ${command}`);
      
      const { stdout, stderr } = await execAsync(command, { 
        timeout: 600000 // 10 min timeout
      });
      
      const vulnerabilities = this.parseNiktoOutput(stdout, url);
      
      return {
        target: url,
        timestamp: new Date().toISOString(),
        tool: 'nikto',
        results: {
          vulnerabilities,
          total_found: vulnerabilities.length,
          raw_output: stdout
        },
        status: 'success'
      };
    } catch (error) {
      return {
        target: url,
        timestamp: new Date().toISOString(),
        tool: 'nikto',
        results: {},
        status: 'error',
        error: error instanceof Error ? error.message : String(error)
      };
    }
  }

• src/index.ts:152-159 (schema)

  JSON schema defining input parameters for nikto_scan: required 'url' (string) and optional 'port' (number).

  inputSchema: {
    type: "object",
    properties: {
      url: { type: "string", description: "Target URL" },
      port: { type: "number", description: "Target port (default: 80/443)" }
    },
    required: ["url"]
  }

• src/index.ts:149-160 (registration)

  Tool registration in the MCP server's listTools handler, defining name, description, and input schema for discovery.

  {
    name: "nikto_scan",
    description: "Run Nikto web vulnerability scanner",
    inputSchema: {
      type: "object",
      properties: {
        url: { type: "string", description: "Target URL" },
        port: { type: "number", description: "Target port (default: 80/443)" }
      },
      required: ["url"]
    }
  },

• src/index.ts:521-522 (registration)

  Dispatch registration in CallToolRequestSchema switch statement that invokes the actual niktoScan handler.

  case "nikto_scan":
    return respond(await this.vulnScanTools.niktoScan(args.url, args.port));

• src/tools/vulnscan.ts:227-260 (helper)

  Supporting function that parses Nikto's textual output into VulnerabilityResult array with severity classification.

  private parseNiktoOutput(output: string, target: string): VulnerabilityResult[] {
    const vulnerabilities: VulnerabilityResult[] = [];
    const lines = output.split('\n');
    
    for (const line of lines) {
      if (line.includes('+ ') && !line.includes('Nikto v') && !line.includes('Target Host')) {
        let severity: 'info' | 'low' | 'medium' | 'high' | 'critical' = 'info';
        
        // Determine severity based on content
        if (line.toLowerCase().includes('xss') || 
            line.toLowerCase().includes('sql injection') ||
            line.toLowerCase().includes('command injection')) {
          severity = 'high';
        } else if (line.toLowerCase().includes('directory') ||
                   line.toLowerCase().includes('admin') ||
                   line.toLowerCase().includes('backup')) {
          severity = 'medium';
        } else if (line.toLowerCase().includes('version') ||
                   line.toLowerCase().includes('information')) {
          severity = 'low';
        }
        
        vulnerabilities.push({
          id: `nikto-${vulnerabilities.length + 1}`,
          name: 'Nikto Finding',
          severity,
          description: line.trim(),
          affected_url: target
        });
      }
    }
    
    return vulnerabilities;
  }