The Nikto 2.6.1 release focuses on scan consistency, safer internals, and a few behavior changes.

SQL Direct Reporting

The new SQL Direct plugin will insert findings directly into a MySQL or PostgreSQL database via the -F sqld output format option. See the wiki docs for setup info.

TLS Keep-Alives

TLS connections now use keep-alives for session reuse. This results in a significant scan speed increase (~18%). Can be disabled if a server misbehaves with -nosslkeepalive.

User-Agent handling

Nikto no longer rotates User-Agents on every request by default. It now uses a static Chrome UA for more stable responses. This reverts to behavior from 2.5.0.

• -useragent forces a specific string.
• -evasion R per-request Random User-Agents from the database.
• The suggested-headers check always uses the static UA, even when -evasion R is set.

Other Changes

• Dictionary attack plugin removed.
• @RFIURL — the default now lives in db_variables; an entry in nikto.conf / udb_variables still overrides.
• Version / outdated checks — more accurate comparison based on installation method. Added a six hour no-recheck window.
• Standardized on JSON::PP.
• replay.pl — proxy parsing/usage fixed.
• Debug print now shows proper test id or plugin name for request/response prints.
• Bunch of other bug fixes for accuracy & reliability, safer file opens.
• Cleaned up HTML output.
• Better archive detection.
• Auth/header edge-case cleanups.

Nikto 2.6.0 is now available on GitHub.

This is a major release with significant internal improvements, new capabilities, and long-term architectural upgrades.

⚠️ Important Note

This release introduces format changes to JSON and XML reports that may impact
existing parsers and integrations. Also the primary branch has been set to main.

🔧 What’s New in 2.6.0

Nikto 2.6.0 includes hundreds of improvements, with highlights below:

• ~10% faster scans through core engine optimizations
• New Domain Specific Language (DSL) for more expressive, accurate tests
• Rewritten JSON, XML, and SQL report plugins
• Multiple report formats per scan (generate several outputs at once)
• All-new cross-platform LFI testing with platform detection
• Cookies enabled by default for more realistic scanning
• Randomized User-Agent selection per request
• Bulk scanner script for running multiple Nikto instances using screen
• Legacy plugin and dead-code removal (no test coverage lost)
• Reference cleanup (OSVDB, Securiteam, SecurityFocus removed)
• License update: Nikto code is now GPLv3
• New and more accurate tests added
• Improved config loading to reduce distro-specific issues (including Kali)
• Bash wrapper util to execute multiple scans in screen

…and many additional fixes and refinements.

Getting Started

You can start using Nikto 2.6.0 by updating an existing installation from GitHub or by downloading a release archive from the repository.

Feedback & Issues

As always, if you encounter bugs or problems, please open an issue on GitHub.

Nikto 2.5.0 has now been promoted to release and the master branch!

Note: Breaking changes to JSON and XML output may have occurred. If you rely on these formats please test before upgrading.

This version contains hundreds of updates over several years, including the highlights below.

• IPv6 support (thanks to @richardleach)
• Updated db_checks format uses multiple reference
• Hundreds of OSVDB and BID references replaced
• Removal of some very old and false-positive prone tests
• Decode Netscaler cookies (thanks to @canberkpolat)
• Add -usecookies flag to send received cookies with subsequent requests
• Add -followredirects flag to signal 3xx responses should be fetched and tested
• Add -noslash to remove trailing slash from directories
• Check for indexing on redirect paths
• Alert on alt-svc header
• Hundreds of bug fixes, test updates and enhancements, and other optimization changes

You can start using Nikto 2.5.0 by performing a git pull from the master branch, cloning the repository again, or downloading the zip file.

As always, if you encounter bugs or problems, please open an issue.