Private corporate batches, live online cohorts and 1-on-1 mentoring in fast web server and misconfiguration scanning, tuned, scripted and fed into a triage workflow — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches Nikto in the position it actually occupies — a fast, noisy first-pass sweep in front of deeper dynamic testing, not a replacement for it. Sessions cover tuning categories and plugin selection so a scan targets what you care about, virtual host and SSL handling, proxying Nikto through an interception proxy so results join a wider workflow, output formats that feed a triage pipeline, and manual verification of findings before they become tickets — with every scan run against attendee-deployed targets and the authorisation boundary set before any scanning begins.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Nikto that means a trainer who has run it in production — fast web server and misconfiguration scanning, tuned, scripted and fed into a triage workflow — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Nikto batchNikto is an open-source web server scanner. It sends a large number of requests to a target web server and checks the responses against a maintained database of tests: default and sample files left in place, dangerous or unnecessary HTTP methods, outdated server and interpreter versions, directory indexing, backup and configuration files exposed under predictable paths, and missing or misconfigured security headers. It is a fingerprinting and misconfiguration tool rather than a deep application scanner, and that distinction defines both what it is good at and what it should never be relied on for.
What Nikto does well is breadth at speed. Pointed at a host, it will enumerate the server software, probe several thousand known-bad paths and report the ones that respond, usually within minutes. That makes it valuable as a first-pass sweep across an estate of web servers, as a regression check that a hardened build has not drifted, and as the fast layer in front of slower, deeper dynamic testing. What it does not do is understand your application: it will not authenticate through a modern login flow, follow a JavaScript-rendered route, or reason about business logic.
Nikto is deliberately noisy. It does not attempt to hide, it will generate a large volume of 404 responses in the target's logs, and it will trip a well-configured WAF or intrusion detection system almost immediately. That behaviour is genuinely useful in a defensive context — running Nikto against your own estate is a reliable way to confirm your detection and blocking actually work — but it also means scanning is something you do against systems you own, with authorisation recorded, and with a plan for what the target's logs and alerting will do while you run it.
Estates accumulate web servers that nobody owns. Reverse proxies, admin consoles, monitoring interfaces, legacy applications behind a load balancer, forgotten staging hosts — each one is a web server with a default configuration until somebody checks. Cloud and container adoption made spinning one up trivial and made keeping track of them harder, so periodic sweeping became a real operational need rather than a formality.
Nikto stays relevant because it is fast, free, scriptable and covers exactly the category of problem that keeps appearing in incident reports: an exposed configuration file, an admin interface reachable from the internet, a server banner revealing an unpatched version, a directory listing that should have been off. Those are cheap to find and cheap to fix, and they are found by breadth rather than depth.
The skill is in using it responsibly and usefully. Anyone can run the default scan; the difference is knowing how to tune it so a sweep across two hundred hosts finishes overnight, how to chain it through a proxy so results feed a wider workflow, how to separate the genuinely actionable findings from a long list of informational noise, how to verify a finding before escalating it, and how to run it as a scheduled control against your own infrastructure without paging the security operations team every week.
The problem Nikto solves and the much larger problem it does not. What a web server exposes by default, why misconfiguration remains one of the most common real findings, how a signature-driven scanner works, and an honest boundary between server scanning, application scanning and penetration testing.
Topics: What a default web server configuration exposes · Server fingerprinting and banner analysis · How a signature-driven scanner works: request, response, match · The Nikto test database and how tests are structured · Where Nikto stops: authentication, application logic, modern front ends · Nikto compared with dynamic application scanners and network scanners · Authorisation, rules of engagement and scanning only what you own
Getting a trustworthy installation. Perl-based and container installation, keeping test databases current, and running a first scan against a target you control — reading the output line by line so you know what each result type actually means before scanning anything larger.
Topics: Installing Nikto from source, package or container · Perl dependencies and SSL support · Updating test databases and verifying currency · Basic host, port and protocol options · Scanning HTTPS targets and handling certificate problems · Reading scan output: OSVDB-style references, findings and informational lines · Scanning a target behind a non-standard root path · Understanding what each request in the scan actually did
Making a scan deliberate. Test category tuning so the scan probes the risk classes you care about, plugin selection, virtual host handling where one address serves many sites, scanning target lists, and the time controls that make a large sweep finish before morning.
Topics: Tuning by test category and what each category covers · Plugin listing and selective plugin execution · Virtual host scanning where one IP serves many names · Scanning multiple targets from a file · Root path, CGI directory and port range options · Timeouts, maximum scan time and pausing between requests · Display and verbosity options for readable output · Mutation options and the cost they add
Working with real network paths. Basic authentication, routing through a forward proxy or an interception proxy so Nikto traffic joins a wider testing workflow, custom headers and user agents, and using Nikto's deliberate noisiness as a defensive test of your own detection and blocking.
Topics: HTTP basic authentication and credential handling · Routing through a forward proxy · Chaining Nikto through an interception proxy to capture traffic · Custom user agents and headers · Encoding and request variation options, and what they are for · Testing your own WAF and IDS: expected detections and blocks · Coordinating a scan with the team that owns the alerting · Recording evidence that a control fired
Turning a scan log into decisions. Output formats and which to use for which consumer, importing results into other tooling, and the discipline that matters most — verifying each finding manually, separating real exposure from informational noise, and writing a report an infrastructure team will act on.
Topics: Output formats: CSV, JSON, XML, HTML and native · Choosing a format per consumer: human, ticketing system, aggregator · Feeding results into a vulnerability management workflow · Verifying a finding by hand before escalating it · Common false positives and why they occur · Distinguishing informational disclosure from exploitable exposure · Severity assignment in context: internet-facing versus internal · Writing a finding an infrastructure engineer can act on without a follow-up call
Operating it. Scripting Nikto for scheduled sweeps, writing custom database entries for organisation-specific paths, running scans against staging targets from CI, and combining Nikto with deeper application scanning and network vulnerability scanning so each tool does the job it is good at.
Topics: Scripting scans and scheduling recurring sweeps · Managing target inventories and keeping them current · Custom entries in the test database for in-house paths · Database variables and how tests are expressed · Running a scan against an ephemeral staging deployment from CI · Diffing results between runs to surface drift · Combining Nikto with dynamic application scanning and network vulnerability scanning · Deciding when a finding belongs to infrastructure, platform or application
We rebuild the agenda around the tools you actually run.
Request a custom agendaDeploy a web server with directory indexing, leftover sample files and an outdated banner, scan it and explain every line of output.
Build a tuned scan profile using test categories, plugin selection and time controls, and justify each exclusion against the risk it drops.
Scan multiple virtual hosts served from a single address and prove each name was tested independently rather than once.
Run a scan against your own protected target and record which requests the WAF blocked, which the IDS alerted on and which passed silently.
Take a full scan result, verify each finding by hand, drop the informational noise and write findings an infrastructure engineer can act on unaided.
Build a recurring sweep across a target inventory with custom test entries, machine-readable output, run-over-run diffing and defined ownership for each finding class.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
Rajesh is a very good trainer I have experienced in DevSecOps training. The number of contents in different topics he has posted on the DevOpsSchool public website are amazing and user friendly for beginners and experienced professionals.
Got good lab sessions which kept the new DevOps tool learnings to the point and it helped a lot in my career.
I took Terraform training with the tutor named Mithilesh. I requested to tailor the course curriculum for my needs. He did an excellent job of showing me how to write the Terraform script per the instructions provided.
My experience with the AIOps training was positive. The course covered important topics in a structured way, and Rajesh Kumar explained the concepts patiently. I found the practical aspects particularly helpful because they made the technical content easier to understand.
I was looking to improve my understanding of AIOps, and this training helped me achieve that goal. Rajesh Kumar explained the subject in a structured and practical manner. The sessions on different AIOps concepts were informative.
I recently did a SRE Session with Rajesh Kumar from DevOps School and the session was great. Right from 1st day till day 15, we had a very interactive session. Rajesh clarified our doubts and the tool demos were excellent without any hiccups. He simplified the concepts while sticking to the content with a fine balance between theory and practice. Am convinced he is one of the best trainers for SRE & DevOps concepts.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.