Which statement best describes Nikto's scanning scope?

• A. It checks for flaws in custom web applications
• B. It checks for well-known flaws, not custom app flaws
• C. It checks for zero-day vulnerabilities
• D. It checks for client-side scripting issues

Answer: (B)

Nikto’s scanning scope is focused on identifying well-known, publicly documented vulnerabilities and server misconfigurations, not bespoke or custom application flaws. It operates by comparing the server’s responses against a large database of known issues, such as outdated server versions, default files, and common misconfigurations, rather than hunting for unknown or zero-day vulnerabilities. It also targets server-side concerns rather than client-side scripting issues like JavaScript or HTML vulnerabilities. Because of that, describing its scope as checking for well-known flaws, not custom app flaws, best matches how Nikto is designed to function.