https://cybertoolchain.io/tools/nikto New releases and features in nikto, tracked by The Cyber Toolchain. en Fri, 31 Jul 2026 16:17:55 GMT https://github.com/sullo/nikto/releases/tag/2.6.1 https://github.com/sullo/nikto/releases/tag/2.6.1 Fri, 31 Jul 2026 16:17:55 GMT Nikto 2.6.1 adds SQL Direct database reporting, TLS keep-alives for ~18% faster scans, and a new COOKIE: DSL matcher. • Adds `-F sqld` output format to insert findings directly into a MySQL or PostgreSQL database via the new SQL Direct plugin. • TLS connections now use keep-alives for session reuse, delivering an ~18% scan speed increase; disable with `-nosslkeepalive` if a server misbehaves. • Adds `-useragent` flag to force a specific User-Agent string for all requests. • Adds `-evasion R` option for per-request random User-Agent rotation from the database. • Adds `COOKIE:` and `!COOKIE:` DSL matchers to the test database for matching or excluding HTTP cookie content in custom rules. • Switches default User-Agent to a static Chrome UA for more stable server responses, with per-request randomization now opt-in via `-evasion R`. Breaking changes: • The dictionary attack plugin has been removed; scans relying on it will no longer function. • User-Agent is no longer rotated on every request by default; workflows depending on per-request UA rotation must add `-evasion R` explicitly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nikto https://github.com/sullo/nikto/releases/tag/2.6.0 https://github.com/sullo/nikto/releases/tag/2.6.0 Wed, 11 Feb 2026 22:01:29 GMT Nikto 2.6.0 adds a new DSL for expressive tests, cross-platform LFI testing, multi-format reports, and a bulk scanner script. • New Domain Specific Language (DSL) enables more expressive and accurate test authoring. • All-new cross-platform LFI testing with automatic platform detection. • Multiple report formats can be generated from a single scan simultaneously. • Rewritten JSON, XML, and SQL report plugins with updated output formats. • Randomized User-Agent selection per request for more evasive scanning. • Cookies enabled by default for more realistic scanning behavior. • Bulk scanner script allows running multiple Nikto instances in parallel using screen. • ~10% faster scans through core engine optimizations. Breaking changes: • JSON and XML report formats have changed, which may break existing parsers and integrations. • The primary branch has been renamed from `master` to `main`, which may break scripts or CI pipelines pinned to the old branch name. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nikto https://github.com/sullo/nikto/releases/tag/2.5.0 https://github.com/sullo/nikto/releases/tag/2.5.0 Sun, 03 Dec 2023 19:00:51 GMT Nikto 2.5.0 adds `-usecookies`, `-followredirects`, `-noslash` flags and IPv6 support. • Adds `db_checks` format update that uses multiple references for check metadata • Adds `-usecookies` CLI flag to forward cookies received from the target server in subsequent requests • Adds `-followredirects` CLI flag to automatically fetch and test 3xx response targets • Adds `-noslash` CLI flag to strip trailing slashes from directory paths during scanning • Adds detection for `alt-svc` HTTP headers • Adds native IPv6 network support for target connections Breaking changes: • JSON output format structure may have changed; users must test before upgrading if they rely on it. • XML output format structure may have changed; users must test before upgrading if they rely on it. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nikto