Debugging

The first route to try when debugging issues or findings is to use the -Display option with either the "v" (verbose) or "d" (debug) flags, or both. It is probably a good idea to redirect full debug output to a file as it is quite lengthy.

If the verbosity levels does not provide enough information, the second step (although highly recommended during penetration tests where evidence may be needed later) is to use the -Savedir option. This will create an output directory with a text file for each finding, which contains the raw request and response, additional information on why a test triggered, and JSON representations of the request and response. Also, check at the replay.pl to replay requests based on the JSON output.

Finally, running Nikto through a proxy such as Burp can reveal valuable information as to why a test is triggering or having another issue. However, be aware that the proxy may be modifying requests in other subtle ways.