nikto scan stuck at "Target IP" stage against authorized host

TL;DR

Nikto hangs at "Target IP" when DNS resolution or the first connection never returns and no timeout is set. Resolve the hostname yourself first, then re-run with -timeout and -maxtime so a dead path fails fast instead of hanging forever.

- Target IP: ...

Use this when

• Nikto prints the Target IP line against an in-scope authorized host and sits there indefinitely.
• Ctrl-C is the only way you have gotten out so far.

Not for this skill when

• Nikto moves past Target IP but loops on request errors. That is the request-error skill.
• The host is out of scope. A hang does not justify retargeting.

Steps

1. Resolve the name outside nikto: dig +short target or nslookup target. Verify: you get an address quickly; a hang here means DNS is the problem, not nikto.
2. Check the route: ping the resolved address once, or run curl -sS -m 10 -o /dev/null -w "%{http_code}" YOUR_TARGET_HOST/. Verify: the network path answers within the timeout.
3. If DNS is broken on the tester box, which is common on VPN split tunnels, pass the IP directly: nikto -h YOUR_ADDRESS_HOST/ -vhost target. Verify: nikto moves past the Target IP stage immediately.
4. Re-run with timeouts regardless: nikto -h YOUR_TARGET_HOST/ -timeout 10 -maxtime 1800. Verify: even a dead target now fails within the cap instead of hanging.
5. Fix the underlying DNS if this recurs: check the resolver configuration and whether the VPN tunnel carries the lab zone. Verify: plain name lookups answer for lab hostnames without manual workarounds.

Variant phrasings

nikto hangs at target ip

Shorter symptom phrasing.

nikto not progressing past target ip line

The stuck-scan phrasing.

nikto freezes before scanning starts

The plain-English phrasing.

Compatibility: nikto 2.1.x/2.5.x. -timeout is per-request seconds; -maxtime caps the whole run.

Why it happens

The Target IP stage does a blocking resolve plus a first connection with generous defaults and no global deadline. On lab networks with split-horizon DNS, or a VPN that drops without telling you, that first call never returns, so nikto waits politely forever.

Edge cases / pitfalls

• Passing the raw IP changes virtual-host behavior: many lab apps route on the Host header, so pair the IP with -vhost or you will scan the wrong site.
• A proxy environment variable on the tester box can send nikto's traffic somewhere unexpected. Check the proxy variables when the path looks fine but nikto still hangs.
• -maxtime aborts mid-scan, so log where it stopped. Partial nikto output presented as complete is a reporting error.
• If resolution works but the first connection hangs, the target may be firewalled to drop rather than refuse; that is a finding about the target, worth one line in the report.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_zv706SlNiEdHwQjpNQ2Tlg