> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/nikto-scanner-reference.md).

# Nikto step configuration

You can scan your application instances and ingest results from [Nikto](https://cirt.net/Nikto2).

### Important notes for running Nikto scans in STO <a href="#important-notes-for-running-nikto-scans-in-sto" id="important-notes-for-running-nikto-scans-in-sto"></a>

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).

### Nikto step settings for STO scans <a href="#nikto-step-settings-for-sto-scans" id="nikto-step-settings-for-sto-scans"></a>

The recommended workflow is to add a Nikto step to a Security or Build stage and then configure it as described below. You can also configure scans programmatically by copying, pasting, and editing the [YAML definition](#yaml-configuration).

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

#### Target <a href="#target" id="target"></a>

**Type**

**Target and variant detection**

**Name**

**Variant**

#### Instance <a href="#instance" id="instance"></a>

**Domain**

**Protocol**

**Port**

**Path**

#### Ingestion <a href="#ingestion" id="ingestion"></a>

**Ingestion File**

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

Use this field to run the [nikto scanner](https://manpages.ubuntu.com/manpages/focal/man1/nikto.1.html) with specific flags. For example, the `-Tuning` flag customizes the tests that the scanner runs. The following example excludes a test from the scan:

`-Tuning x01`

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Settings <a href="#settings" id="settings"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>