Development

Development

Nikto Dev Now on Github

Recently all new Nikto development has moved from Assembla to GitHub!

Specifiying Individual Plugins

In Nikto 2.1.1, the facillity to call only specific plugins was added. This was mainly designed as a debugging and development feature so that it is easier to test one plugin without running all of the tests. This was a very simple plugin string that consisted of a simple comma separated list of plugin names.

In Nikto 2.1.2 it was discovered that this facillity was of more use than previously thought and could fix one of the basic flaws with the current plugin system: that of passing parameters to the plugin, something that had been hacked via using -mutate-options.

Nikto's Interactive Features & Status Reporting

Nikto 2.1.2 introduces some much needed status reporting, along with some new interactive features.

First up, the Display mode "P" will print a progress report to STDOUT every 500 tests (configurable in nikto.conf or via -Plugins). During a scan, you'll see something like this:

Nikto::Parser

Jabra, author of Nikto's XML output format, has just released Nikto::Parser (along with several other security tool parsers). This perl module takes in a Nikto XML file (or runs Nikto directly) and creates an easily accessible interface to the data.

Here's an example reading in a saved scan file.

Last chance for features in Nikto 2.1.0

I've decided to stop procrastinating and put the final polish on the next version of Nikto and aim for a mid-July release date.

This is the last chance to guide the remaining tasks I have left. If you want some super great feature or needed bug fix in the next version, head over to assembla (http://trac2.assembla.com/Nikto_2) and raise a ticket, post on the discussion list or send me an email.

What not to do when changing a configuration file

We've had a couple of bugs raised after some people have upgraded Nikto 2.02 to Nikto 2.03 and kept the same configuration file.

To fix a bug there was a wee change to the configuration file with Nikto 2.03, but there was no extra check in the code to give the new setting a default value.

If you have problems with Nikto 2.03 failing to find web servers, check config.txt and ensure that the below line is present:

CHECKMETHODS=HEAD GET

(This line defines which HTTP methods Nikto uses to check whether an HTTP server is listening).

Pages