## TL;DR
Nikto hangs at "Target IP" when DNS resolution or the first connection never returns and no timeout is set. Resolve the hostname yourself first, then re-run with `-timeout` and `-maxtime` so a dead path fails fast instead of hanging forever.

```text
- Target IP: ...
```

## Use this when
- Nikto prints the Target IP line against an in-scope authorized host and sits there indefinitely.
- Ctrl-C is the only way you have gotten out so far.

## Not for this skill when
- Nikto moves past Target IP but loops on request errors. That is the request-error skill.
- The host is out of scope. A hang does not justify retargeting.

## Steps
1. Resolve the name outside nikto: `dig +short target` or `nslookup target`. Verify: you get an address quickly; a hang here means DNS is the problem, not nikto.
2. Check the route: ping the resolved address once, or run `curl -sS -m 10 -o /dev/null -w "%{http_code}" YOUR_TARGET_HOST/`. Verify: the network path answers within the timeout.
3. If DNS is broken on the tester box, which is common on VPN split tunnels, pass the IP directly: `nikto -h YOUR_ADDRESS_HOST/ -vhost target`. Verify: nikto moves past the Target IP stage immediately.
4. Re-run with timeouts regardless: `nikto -h YOUR_TARGET_HOST/ -timeout 10 -maxtime 1800`. Verify: even a dead target now fails within the cap instead of hanging.
5. Fix the underlying DNS if this recurs: check the resolver configuration and whether the VPN tunnel carries the lab zone. Verify: plain name lookups answer for lab hostnames without manual workarounds.

## Variant phrasings
### nikto hangs at target ip
Shorter symptom phrasing.
### nikto not progressing past target ip line
The stuck-scan phrasing.
### nikto freezes before scanning starts
The plain-English phrasing.

Compatibility: nikto 2.1.x/2.5.x. `-timeout` is per-request seconds; `-maxtime` caps the whole run.

## Why it happens
The Target IP stage does a blocking resolve plus a first connection with generous defaults and no global deadline. On lab networks with split-horizon DNS, or a VPN that drops without telling you, that first call never returns, so nikto waits politely forever.

## Edge cases / pitfalls
- Passing the raw IP changes virtual-host behavior: many lab apps route on the Host header, so pair the IP with `-vhost` or you will scan the wrong site.
- A proxy environment variable on the tester box can send nikto's traffic somewhere unexpected. Check the proxy variables when the path looks fine but nikto still hangs.
- `-maxtime` aborts mid-scan, so log where it stopped. Partial nikto output presented as complete is a reporting error.
- If resolution works but the first connection hangs, the target may be firewalled to drop rather than refuse; that is a finding about the target, worth one line in the report.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_zv706SlNiEdHwQjpNQ2Tlg