## TL;DR
Nikto exits before scanning because the tester box's DNS cannot resolve the hostname. Resolve it yourself, fix the resolver or VPN path, or pass the IP with `-vhost` so nikto skips DNS entirely. The scan target does not change; only how you reach it does.

```text
Unresolved host name
```

## Use this when
- `nikto -h YOUR_TARGET_HOST/` exits immediately with this error on an in-scope authorized hostname.
- The name works from your normal workstation but not from the tester box.

## Not for this skill when
- The name resolves but the connection fails. That is routing or the service, not DNS.
- The hostname is out of scope. DNS trouble does not authorize a different target.

## Steps
1. Confirm the resolver failure: `dig +short target` and `getent hosts target`. Verify: both come back empty on the tester box, proving it is DNS and not nikto.
2. Check which resolver the box uses and whether the VPN tunnel is up: try the lab's internal DNS server directly as the resolver for one lookup. Verify: the lab DNS answers even if the default resolver does not.
3. Quick workaround for the scan: `nikto -h https://RESOLVED_IP/ -vhost target`. Verify: nikto starts instead of exiting on the resolve step.
4. Durable fix: point the tester box at the lab DNS server or repair the split tunnel so lab zones resolve. Verify: plain lookups answer for lab hostnames with no manual flags.
5. If the hostname is a typo in the scope sheet, fix the sheet, not the DNS. Verify: the corrected name resolves and matches the engagement's target list.

## Variant phrasings
### nikto cannot resolve hostname
The plain-English phrasing.
### nikto dns failure vpn
The split-tunnel phrasing.
### nikto exits unresolved host
The startup-error phrasing.

Compatibility: nikto 2.1.x/2.5.x. Name resolution happens before any plugin loads, so this error always means pre-scan DNS.

## Why it happens
Tester boxes on VPNs often get a resolver that knows the public internet but not the lab's private zone, or the tunnel drops and the box silently falls back to a public resolver. Nikto resolves once at startup and treats failure as fatal instead of retrying.

## Edge cases / pitfalls
- Scanning by IP with `-vhost` is mandatory for name-based virtual hosts; without it you test the default site, which may be a different application entirely.
- Do not add the hostname to the box's hosts file as a permanent fix without noting it: stale entries have poisoned more than one retest.
- If only some lab names fail, the zone delegation is broken on the lab DNS side. Tell the lab admin instead of working around each name.
- A hostname that resolved yesterday and fails today usually means the VPN dropped; check the tunnel before reconfiguring DNS.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_-nIx6uuuTFZoMPWTIKMe_w