Hoping someone on here knows a way to reject Nikto traffic with Snort rules. I've been having zero luck for days finding this anywhere online. Thanks. Peace.

2 Answers 2


If you use Official Snort Ruleset then it is already included inside ruleset:

alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"ET SCAN Nikto Web App Scan in Progress"; flow:to_server,established; content:"(Nikto"; fast_pattern:only; http_header; pcre:"/^User-Agent\x3a[^\r\n]*?\(Nikto/Hmi"; threshold: type both, count 5, seconds 60, track by_src; reference:url,www.cirt.net/code/nikto.shtml; reference:url,doc.emergingthreats.net/2002677; classtype:web-application-attack; sid:2002677; rev:14;)

To add onto what Mirsad said; if you intending to block in Snort inline mode you need to set rules from alert to drop. For things like scans, you need to ensure your preprocessors are properly tuned.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .