How do I get an HTML report from Nikto?

`nikto -h https://example.com -Format htm -o nikto.html`. Nikto writes one self-contained file; publish it with a single curl and the scan has a stable URL.

Nikto is noisy. Does publishing make that worse?

It makes it tractable. Most of the noise is the same handful of findings every scan, and once a reviewer has pinned 'known, this is the default Apache icons alias, low risk' to one of them, it stays pinned. Triage you keep beats triage you redo.

How do I compare this scan to the last one?

PATCH the same report id per host. Each scan appends a revision at one URL, so the diff shows what actually changed rather than making you re-read 200 identical lines.

Should the report be public?

No. It is a list of what a scanner found interesting about a host you own. Reports are private by default, with access set per report.

Am I allowed to scan the host?

Only ones you own or have written authorization to test. Nikto is an active scanner and will be visible in the target's logs; publishing the results does not change who is allowed to produce them.

Share a Nikto scan report

Nikto's output is famously long and famously repetitive, and both of those are arguments for putting it somewhere durable rather than somewhere temporary. Two hundred lines of which maybe six matter, and the knowledge of which six lives in one person's head.

That knowledge is the expensive part. A scan takes minutes to re-run; the triage takes an afternoon and gets thrown away every time.

Publish it

nikto -h "$TARGET" -Format htm -o nikto.html || true

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html nikto.html \
        --arg title "Nikto — $TARGET — $(date +%F)" \
        '{title: $title, html: $html}')"

One report id per target host. PATCH keeps the URL and appends a revision, so the triage notes from the last scan are still sitting on the findings when the next one lands.

Use a scoped token with reports:write only, and keep the report private or team-visible — see the sharing model.

Only scan what you are authorized to scan

Nikto sends thousands of active requests and will show up in the target's access logs as exactly what it is. Own the host, or hold written authorization for it. Publishing results does not create permission to produce them.

What the URL changes

Triage survives the scan. Pin the reasoning to the finding once; it is there on every later revision. See commenting on HTML.
Diffs instead of re-reads. Revision-to-revision comparison finds the new line in a wall of identical ones.
A report a client can open. Consultancies ship the link — with a password — instead of a PDF nobody can reply to inline.

Limits

HTML body: 5 MB. A long scan of a large site can approach it; scan per host and keep a report per host.
Scripts run, sandboxed: allow-scripts, no allow-same-origin.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Create your first report →

ZAP reports — the deeper web scan
testssl.sh · Nmap
Security scan reports · Share with a client