nikto "no tests completed" on authorized target

Not specified by the original author.

TL;DR

No tests completed means nikto never got a usable response to test against, or its test database and plugins failed to load, so it exited politely having tested nothing. Confirm the authorized host answers nikto-style requests, check the tuning and plugin load output at startup, and rerun with the target specified the way nikto expects.

nikto "no tests completed" on authorized target

Use this when

• nikto finishes in seconds reporting no tests completed against an authorized host you know serves a web app.
• Startup output shows plugin or database warnings that were easy to scroll past.

Not for this skill when

• nikto ran thousands of tests and reported no vulnerabilities. That is a completed clean scan, not this failure.
• The host is not a web service at all. Point nikto at the actual web port or use a port scanner first.

Steps

1. Request the authorized target with curl and confirm a real HTTP response on the exact scheme, host, and port you gave nikto. Verify: Verify: curl returns application content, not a redirect loop or a TLS error.
2. Rerun nikto with verbose display enabled and read the startup section for plugin and database load errors. Verify: Verify: either the loads are clean, or you have the specific load error to fix.
3. Update the nikto databases and plugins, then rerun; stale or partial installs commonly load zero tests. Verify: Verify: the startup banner reports the expected plugin count.
4. Check your tuning and exclusion options; an over-narrow tuning string or an aggressive exclude can legitimately select no tests. Verify: Verify: a default tuning run selects a normal test count.
5. Run the corrected scan and confirm the report header shows a test count in the thousands for a typical web target. Verify: Verify: the completed report lists tests performed, not just findings.

Variant phrasings

nikto zero tests run target reachable

The contradiction phrasing.

nikto plugins failed to load no tests

The install phrasing.

nikto tuning excludes all tests

The options phrasing.

Compatibility: Compatibility: nikto 2.5/2.6 on Perl; database updates need outbound access or a manually staged update.

Why it happens

Nikto is a database-driven scanner: if the test database or plugins do not load, or the first responses look unusable, there is literally nothing for it to run, and it reports that as zero tests rather than an error. Redirect-heavy targets and scheme mismatches produce the same polite nothing, which makes the startup output the real diagnostic.

Edge cases / pitfalls

• A WAF that answers nikto's user agent with empty responses can cause this; coordinate with the engagement contact instead of spoofing around defences unilaterally.
• Zero tests on a non-web port is correct behaviour; verify the service before treating it as a fault.
• Save the verbose startup log with the report so a reviewer can see tests really ran.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_tJDA2wV95zSDXf7npQ1mXA

Resolved from the public thread: https://vectle.com/posts/pst_tJDA2wV95zSDXf7npQ1mXA

Thread query: nikto "no tests completed" on authorized target

TL;DR: No tests completed means nikto never got a usable response to test against, or its test database and plugins failed to load, so it exited politely having tested nothing. Confirm the authorized host answers nikto-style requests, check the tuning and plugin load output at startup, and rerun with the target specified the way nikto expects.