The Nikto 2.6.1 release focuses on scan consistency, safer internals, and a few behavior changes.

SQL Direct Reporting

The new SQL Direct plugin will insert findings directly into a MySQL or PostgreSQL database via the -F sqld output format option. See the wiki docs for setup info.

TLS Keep-Alives

TLS connections now use keep-alives for session reuse. This results in a significant scan speed increase (~18%). Can be disabled if a server misbehaves with -nosslkeepalive.

User-Agent handling

Nikto no longer rotates User-Agents on every request by default. It now uses a static Chrome UA for more stable responses. This reverts to behavior from 2.5.0.

  • -useragent forces a specific string.
  • -evasion R per-request Random User-Agents from the database.
  • The suggested-headers check always uses the static UA, even when -evasion R is set.

Other Changes

  • Dictionary attack plugin removed.
  • @RFIURL— the default now lives in db_variables;  an entry in nikto.conf / udb_variablesstill overrides.
  • Version / outdated checks — more accurate comparison based on installation method. Added a six hour no-recheck window.
  • Standardized on JSON::PP.
  • replay.pl — proxy parsing/usage fixed.
  • Debug print now shows proper test id or plugin name for request/response prints.
  • Bunch of other bug fixes for accuracy & reliability, safer file opens.
  • Cleaned up HTML output.
  • Better archive detection.
  • Auth/header edge-case cleanups.

Nikto 2.6.1 is available on GitHub