nikto "Unresolved host name" for in-scope authorized hostname

TL;DR

Nikto exits before scanning because the tester box's DNS cannot resolve the hostname. Resolve it yourself, fix the resolver or VPN path, or pass the IP with -vhost so nikto skips DNS entirely. The scan target does not change; only how you reach it does.

Unresolved host name

Use this when

• nikto -h YOUR_TARGET_HOST/ exits immediately with this error on an in-scope authorized hostname.
• The name works from your normal workstation but not from the tester box.

Not for this skill when

• The name resolves but the connection fails. That is routing or the service, not DNS.
• The hostname is out of scope. DNS trouble does not authorize a different target.

Steps

1. Confirm the resolver failure: dig +short target and getent hosts target. Verify: both come back empty on the tester box, proving it is DNS and not nikto.
2. Check which resolver the box uses and whether the VPN tunnel is up: try the lab's internal DNS server directly as the resolver for one lookup. Verify: the lab DNS answers even if the default resolver does not.
3. Quick workaround for the scan: nikto -h https://RESOLVED_IP/ -vhost target. Verify: nikto starts instead of exiting on the resolve step.
4. Durable fix: point the tester box at the lab DNS server or repair the split tunnel so lab zones resolve. Verify: plain lookups answer for lab hostnames with no manual flags.
5. If the hostname is a typo in the scope sheet, fix the sheet, not the DNS. Verify: the corrected name resolves and matches the engagement's target list.

Variant phrasings

nikto cannot resolve hostname

The plain-English phrasing.

nikto dns failure vpn

The split-tunnel phrasing.

nikto exits unresolved host

The startup-error phrasing.

Compatibility: nikto 2.1.x/2.5.x. Name resolution happens before any plugin loads, so this error always means pre-scan DNS.

Why it happens

Tester boxes on VPNs often get a resolver that knows the public internet but not the lab's private zone, or the tunnel drops and the box silently falls back to a public resolver. Nikto resolves once at startup and treats failure as fatal instead of retrying.

Edge cases / pitfalls

• Scanning by IP with -vhost is mandatory for name-based virtual hosts; without it you test the default site, which may be a different application entirely.
• Do not add the hostname to the box's hosts file as a permanent fix without noting it: stale entries have poisoned more than one retest.
• If only some lab names fail, the zone delegation is broken on the lab DNS side. Tell the lab admin instead of working around each name.
• A hostname that resolved yesterday and fails today usually means the VPN dropped; check the tunnel before reconfiguring DNS.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst-nIx6uuuTFZoMPWTIKMew