How to Generate and Analyze Nikto Scan Reports

Table of Contents

Why Nikto Reports Matter

A terminal full of text is useless if no one acts on it. Reports turn data into decisions.

Good reports help you:

• Prove compliance (PCI, SOC 2, ISO 27001)
• Show progress over time
• Assign fixes to developers
• Communicate risk to managers
• Track remediation

Nikto Output Formats Explained

Nikto supports 6 formats. Use the right one for your goal:

• txt: Plain text (default)
• html: Pretty, clickable, human-readable
• xml: Structured, for old tools
• json: Modern, for scripts and dashboards
• csv: For spreadsheets
• msf: For Metasploit import

Best for beginners: HTML
Best for automation: JSON

Generate HTML Reports (Best for Humans)

One command creates a beautiful, shareable report:

nikto -h https://yoursite.com -o report.html -Format html

Output includes:

• Color-coded findings
• Clickable OSVDB links
• Server banner
• Scan time and host

Generate JSON Reports (Best for Automation)

Perfect for CI/CD, dashboards, and parsing:

nikto -h https://yoursite.com -o scan.json -Format json

JSON structure:

{
  "host": "yoursite.com",
  "vulnerabilities": [
    {
      "msg": "/.env: Environment file exposed",
      "osvdb": 123456,
      "method": "GET",
      "url": "/.env"
    }
  ]
}

Generate XML Reports (Legacy Systems)

For old ticketing systems or SIEMs:

nikto -h https://yoursite.com -o scan.xml -Format xml

Use only if required. JSON is better in 2025.

Create Custom Reports with Scripts

Want only critical issues? Use grep:

nikto -h site.com | grep -i "OSVDB-0\|phpinfo\|.env" > critical.txt

Or build a summary with bash:

#!/bin/bash
nikto -h $1 -o full.html -Format html
echo "Scan complete: $(date)" > summary.txt
grep -c "OSVDB" full.html >> summary.txt
echo "See full.html for details" >> summary.txt

How to Analyze HTML Reports

Open report.html in any browser. Look for:

• Red text: High risk (e.g., phpinfo.php)
• OSVDB links: Click to read exploit details
• Server banner: Is version exposed?
• Interesting files: .bak, .git, config

How to Parse JSON Reports with Python

Count critical issues:

import json
with open('scan.json') as f:
    data = json.load(f)
critical = [v for v in data['vulnerabilities'] if 'phpinfo' in v['msg'] or '.env' in v['msg']]
print(f"Critical issues: {len(critical)}")

Generate CSV:

import csv
with open('report.csv', 'w') as f:
    writer = csv.writer(f)
    writer.writerow(['URL', 'Message'])
    for v in data['vulnerabilities']:
        writer.writerow([v['url'], v['msg']])

Prioritize Findings: Risk Levels

Not all Nikto findings are equal. Use this guide:

• Critical (Fix in 24h): .env, .git, phpinfo.php, config.bak
• High (Fix in 7 days): Outdated server, PUT/DELETE allowed, weak SSL
• Medium (Fix in 30 days): Directory indexing, missing headers
• Low (Optional): Server banner leak, default pages

Sample Report Summary Table

Share Reports with Teams and Clients

Best practices:

• Password-protect PDFs if sensitive
• Use secure file sharing (not email)
• Include executive summary
• Add remediation deadlines
• Track fixes in a ticketing system

Convert HTML to PDF:

wkhtmltopdf report.html report.pdf

Automate Report Generation

Daily scans with email:

cron: 0 3 * * * /home/user/nikto-scan.sh

# nikto-scan.sh
nikto -h https://site.com -o /reports/$(date +%F).html -Format html
echo "Nikto report attached" | mail -s "Daily Scan" -A /reports/$(date +%F).html [email protected]

Slack alerts on critical findings:

if grep -q "phpinfo\|.env" report.html; then
  curl -X POST -H 'Content-type: application/json' --data '{"text":"Critical issue found!"}' $SLACK_WEBHOOK
fi

Conclusion: From Scan to Action

Nikto doesn’t fix anything. You do.

But with the right reports:

• You’ll see the real risks
• You’ll prioritize what matters
• You’ll prove your work
• You’ll prevent the next breach

Start simple:

• Run nikto -o report.html -Format html
• Open it
• Fix one thing
• Run again

In a week, you’ll have a system. In a month, you’ll have a culture.

Security isn’t about tools. It’s about closing the loop. And every great loop starts with a report.

Written by a security engineer who turned 1,000+ Nikto reports into zero critical findings.