How to Automate Nikto Scans for Continuous Security Testing

Table of Contents

Why Automate Nikto Scans?

Manual scanning is like locking your door only when you remember. Automation locks it every time.

Key benefits:

• Catch issues early: Find .env files before they go live.
• Reduce human error: No more “I forgot to scan staging.”
• Meet compliance: Prove daily scans for PCI, SOC 2, ISO 27001.
• Scale easily: Scan 10 or 1,000 servers with the same effort.
• React fast: Get alerts the moment a vulnerability appears.

Prerequisites: What You Need

Before automating, make sure you have:

• A Linux server or VM (Ubuntu, CentOS, etc.)
• Nikto installed (sudo apt install nikto or from GitHub)
• A list of target URLs or IPs to scan
• Basic command-line knowledge
• Optional: Docker, GitHub, Slack, or email setup

Method 1: Cron Jobs (Simple & Reliable)

The easiest way to automate Nikto is with cron, Linux’s built-in scheduler.

Step-by-step:

1. Create a scan script:

#!/bin/bash
TARGET="https://your-site.com"
OUTPUT="/var/scans/nikto-$(date +%Y%m%d-%H%M).html"
nikto -h $TARGET -o $OUTPUT -Format html
echo "Scan completed: $OUTPUT"

2. Save as /home/nikto-scanner/daily-scan.sh and make executable:

chmod +x /home/nikto-scanner/daily-scan.sh

3. Add to crontab (crontab -e):

0 3 * * * /home/nikto-scanner/daily-scan.sh >> /var/log/nikto-scan.log 2>&1

This runs daily at 3 AM. Reports are saved with timestamps.

Method 2: GitHub Actions (CI/CD Integration)

Perfect for developers. Scan every time code is pushed.

Create .github/workflows/nikto-scan.yml:

name: Nikto Security Scan
on:
  push:
    branches: [ main, staging ]
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM UTC

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Install Nikto
        run: sudo apt update && sudo apt install -y nikto

      - name: Run Nikto Scan
        run: |
          nikto -h https://your-site.com -o report.html -Format html

      - name: Upload Report
        uses: actions/upload-artifact@v3
        with:
          name: nikto-report
          path: report.html

Now every deploy triggers a scan. Reports are stored in GitHub.

Method 3: Docker + Watchtower (Containerized)

Run Nikto in a container. Update automatically with Watchtower.

Dockerfile:

FROM ubuntu:22.04
RUN apt update && apt install -y nikto curl
COPY scan.sh /scan.sh
ENTRYPOINT ["/bin/bash", "/scan.sh"]

scan.sh:

#!/bin/bash
nikto -h $TARGET -o /reports/report-$(date +%s).json -Format json
curl -X POST -H 'Content-type: application/json' --data "{\"text\":\"Nikto scan complete\"}" $SLACK_WEBHOOK

Run with:

docker run -e TARGET=https://site.com -e SLACK_WEBHOOK=xxx -v $(pwd)/reports:/reports nikto-scanner

Use Watchtower to auto-update the image weekly.

Method 4: Jenkins Pipeline (Enterprise)

For large teams. Full control and reporting.

Jenkinsfile snippet:

pipeline {
    agent any
    stages {
        stage('Nikto Scan') {
            steps {
                sh '''
                nikto -h https://prod-site.com -o results.xml -Format xml
                '''
            }
        }
        stage('Archive') {
            steps {
                archiveArtifacts 'results.xml'
            }
        }
    }
}

Sending Alerts: Slack, Email, and Webhooks

Don’t wait for reports. Get notified instantly.

• Slack: Use incoming webhooks
• Email: Pipe output to mail command
• Webhook: POST JSON to any endpoint

Slack example in bash:

WEBHOOK="https://hooks.slack.com/services/XXX/YYY/ZZZ"
curl -X POST -H 'Content-type: application/json' --data "{\"text\":\"Nikto found issues on staging!\"}" $WEBHOOK

Storing Results: HTML, JSON, and Databases

Choose your format:

• HTML: Human-readable reports
• JSON: Easy to parse and store
• Database: Use SQLite or PostgreSQL for trends

Parse JSON with Python:

import json, subprocess
result = subprocess.run(['nikto', '-h', 'site.com', '-Format', 'json'], capture_output=True)
data = json.loads(result.stdout)
for item in data['vulnerabilities']:
    print(item['msg'])

Automation Methods: Comparison Table

Best Practices for Reliable Automation

• Scan during off-peak hours (e.g., 2–4 AM)
• Use -Tuning x to reduce false positives
• Rotate and archive old reports (keep 30 days)
• Fail builds on critical findings
• Scan staging and production separately
• Update Nikto weekly with nikto -update
• Monitor scan logs for errors

Troubleshooting Common Issues

• Scan hangs: Add -timeout 30
• SSL errors: Use -ssl or update CA certs
• Rate-limited: Add -Pause 2 between requests
• No output: Check file permissions and paths
• Too many alerts: Filter by OSVDB ID or message

Conclusion: Security That Never Sleeps

Automation isn’t about replacing security experts. It’s about giving them superpowers.

With Nikto running automatically:

• You’ll catch phpinfo.php before it goes live.
• You’ll know the second a server falls out of date.
• You’ll sleep better knowing your sites are watched 24/7.

Start small. Set up a cron job today. Add Slack alerts tomorrow. In a week, you’ll wonder how you ever lived without it.

Security isn’t hard when it runs itself.

Written by a DevSecOps engineer who automated 200+ daily Nikto scans and never looked back.