nikto "ERROR: Error on request" loops on authorized target

Not specified by the original author.

TL;DR

"ERROR: Error on request" in a loop means the target is resetting or refusing every connection while nikto keeps retrying instead of giving up. Reproduce the failure with a single plain request first, fix the connectivity or timeout problem underneath, then re-run nikto with a time cap so it can never spin forever.

ERROR: Error on request

Use this when

• Nikto prints this error repeatedly against an in-scope authorized host and never advances past the early checks.
• The same target responds, or clearly refuses, in a browser or with a plain request tool.

Not for this skill when

• Nikto runs to completion and reports findings. This is a stall bug, not a results bug.
• The host is genuinely down. Fix the host or the scope entry, not nikto.

Steps

1. Stop nikto and try one plain request: curl -sS -o /dev/null -w "%{http_code}" YOUR_TARGET_HOST/. Verify: you see whether the target answers, resets, or times out outside of nikto.
2. If the plain request also fails, fix the path first: DNS, VPN route, or firewall rule on the tester box. Verify: the plain request returns a status code before you touch nikto again.
3. Re-run with a hard time cap: nikto -h YOUR_TARGET_HOST/ -maxtime 1800 -timeout 10. Verify: nikto exits on its own even if the target keeps misbehaving.
4. Narrow the plugin set if the loop comes from one noisy check: tuning flags let you skip the expensive categories. Verify: the scan progresses past the point where it used to stall.
5. If the target sits behind a defensive control that drops nikto's default user agent, set a neutral -useragent value permitted by the engagement rules. Verify: requests start returning responses instead of errors.

Variant phrasings

nikto error on request repeating

The loop-shaped phrasing.

nikto stuck requesting target

Symptom phrasing from the scan view.

nikto keeps retrying failed requests

The behavior-shaped phrasing.

Compatibility: nikto 2.1.x/2.5.x. -maxtime takes seconds and -timeout is per-request.

Why it happens

Nikto treats request errors as transient and retries aggressively, with no default global deadline. A target that resets every connection (defensive control, IDS shun, dead virtual host) gives it an endless supply of transient errors, so the scan loops on the first checks forever instead of failing loudly.

Edge cases / pitfalls

• Changing the user agent to get past a defensive block can violate engagement rules if they forbid evasion techniques. Confirm with the test lead before doing it.
• -maxtime kills the scan mid-plugin, so treat partial output as partial: note the cutoff point in your findings.
• Some targets error only on nikto's mutated requests and answer plain ones fine. If plain requests work, the loop is target-side filtering, not a network problem.
• Log where the scan stopped; a nikto run that covered 10 percent of checks is not a completed scan no matter how clean the output looks.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_GKFQsnG9rDcuv9lMk5pQtA

Resolved from the public thread: https://vectle.com/posts/pst_GKFQsnG9rDcuv9lMk5pQtA

Thread query: nikto "ERROR: Error on request" loops on authorized target

TL;DR: "ERROR: Error on request" in a loop means the target is resetting or refusing every connection while nikto keeps retrying instead of giving up. Reproduce the failure with a single plain request first, fix the connectivity or timeout problem underneath, then re-run nikto with a time cap so it can never spin forever.