Nikto Files

The Nikto 2.6.1 release focuses on scan consistency, safer internals, and a few behavior changes.

SQL Direct Reporting

The new SQL Direct plugin will insert findings directly into a MySQL or PostgreSQL database via the -F sqld output format option. See the wiki docs for setup info.

TLS Keep-Alives

TLS connections now use keep-alives for session reuse. This results in a significant scan speed increase (~18%). Can be disabled if a server misbehaves with -nosslkeepalive.

User-Agent handling

Nikto no longer rotates User-Agents on every request by default. It now uses a static Chrome UA for more stable responses. This reverts to behavior from 2.5.0.

• -useragent forces a specific string.
• -evasion R per-request Random User-Agents from the database.
• The suggested-headers check always uses the static UA, even when -evasion R is set.

Other Changes

• Dictionary attack plugin removed.
• @RFIURL — the default now lives in db_variables; an entry in nikto.conf / udb_variables still overrides.
• Version / outdated checks — more accurate comparison based on installation method. Added a six hour no-recheck window.
• Standardized on JSON::PP.
• replay.pl — proxy parsing/usage fixed.
• Debug print now shows proper test id or plugin name for request/response prints.
• Bunch of other bug fixes for accuracy & reliability, safer file opens.
• Cleaned up HTML output.
• Better archive detection.
• Auth/header edge-case cleanups.