Nikto step configuration

Scan application instances with Nikto.

You can scan your application instances and ingest results from Nikto.

Important notes for running Nikto scans in STO

• You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer Configure your pipeline to use STO images from private registry.

• STO supports three different approaches for loading self-signed certificates. For more information, refer Run STO scans with custom SSL certificates.

Nikto step settings for STO scans

The recommended workflow is to add a Nikto step to a Security or Build stage and then configure it as described below. You can also configure scans programmatically by copying, pasting, and editing the YAML definition.

Scan

Scan Mode

Scan Configuration

Target

Type

Target and variant detection

Name

Variant

Instance

Domain

Protocol

Port

Path

Ingestion

Ingestion File

Log Level

Additional CLI flags

Use this field to run the nikto scanner with specific flags. For example, the -Tuning flag customizes the tests that the scanner runs. The following example excludes a test from the scan:

-Tuning x01

Fail on Severity

Settings

Additional Configuration

Advanced settings