nikto

No entries match these filters. Clear filters

1. 2.6.1 Jul 31, 2026 · issue 032

   Nikto 2.6.1 adds SQL Direct database reporting, TLS keep-alives for ~18% faster scans, and a new COOKIE: DSL matcher.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.6.1 https://github.com/sullo/nikto.git
   # already have the repo? check out this version:
   $ git checkout 2.6.1

   └──▷ TRY IT
   Stream scan findings directly into a PostgreSQL database for centralized reporting across multiple scans.
   copy

   $ nikto.pl -h https://target.example.com -o results -F sqld

   • Adds -F sqld output format to insert findings directly into a MySQL or PostgreSQL database via the new SQL Direct plugin.
   • TLS connections now use keep-alives for session reuse, delivering an ~18% scan speed increase; disable with -nosslkeepalive if a server misbehaves.
   • Adds -useragent flag to force a specific User-Agent string for all requests.
   • Adds -evasion R option for per-request random User-Agent rotation from the database.
   • Adds COOKIE: and !COOKIE: DSL matchers to the test database for matching or excluding HTTP cookie content in custom rules.

   +1 more show less

   • Switches default User-Agent to a static Chrome UA for more stable server responses, with per-request randomization now opt-in via -evasion R.

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The dictionary attack plugin has been removed; scans relying on it will no longer function.
   • !User-Agent is no longer rotated on every request by default; workflows depending on per-request UA rotation must add -evasion R explicitly.
2. 2.6.0 Feb 11, 2026 · release notes

   Nikto 2.6.0 adds a new DSL for expressive tests, cross-platform LFI testing, multi-format reports, and a bulk scanner script.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.6.0 https://github.com/sullo/nikto.git
   # already have the repo? check out this version:
   $ git checkout 2.6.0

   • New Domain Specific Language (DSL) enables more expressive and accurate test authoring.
   • All-new cross-platform LFI testing with automatic platform detection.
   • Multiple report formats can be generated from a single scan simultaneously.
   • Rewritten JSON, XML, and SQL report plugins with updated output formats.
   • Randomized User-Agent selection per request for more evasive scanning.

   +3 more show less

   • Cookies enabled by default for more realistic scanning behavior.
   • Bulk scanner script allows running multiple Nikto instances in parallel using screen.
   • ~10% faster scans through core engine optimizations.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !JSON and XML report formats have changed, which may break existing parsers and integrations.
   • !The primary branch has been renamed from master to main, which may break scripts or CI pipelines pinned to the old branch name.
3. 2.5.0 Dec 3, 2023 · release notes

   Nikto 2.5.0 adds -usecookies, -followredirects, -noslash flags and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 2.5.0 https://github.com/sullo/nikto.git
   # already have the repo? check out this version:
   $ git checkout 2.5.0

   • Adds db_checks format update that uses multiple references for check metadata
   • Adds -usecookies CLI flag to forward cookies received from the target server in subsequent requests
   • Adds -followredirects CLI flag to automatically fetch and test 3xx response targets
   • Adds -noslash CLI flag to strip trailing slashes from directory paths during scanning
   • Adds detection for alt-svc HTTP headers

   +1 more show less

   • Adds native IPv6 network support for target connections

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !JSON output format structure may have changed; users must test before upgrading if they rely on it.
   • !XML output format structure may have changed; users must test before upgrading if they rely on it.