It's final time to stop procrastinating: Nikto 2.1.0 is here!
This version has gone through significant rewrites under the hood to how Nikto works, to make it more expandable and usable. Changes include:
- Rewrite to the plugin engine allowing more control of the plugin structure and making it easier to add plugins
- Rewrite to the reporting engine allowing reporting plugins to cover more and also ensuring that output is written if Nikto is quit before finishing
- Large overhaul of documentation to document built-in methods and variables (available in the tarball or on cirt.net
- Addition of caching to reduce amount of calls made to the web servers, as well as a facility to disable smart 404 guessing.
- Addition of simple guessing for whether a system is an embedded device and to report what it is
- Plugin to use OWASPs dictionary lists to attempt to brute force directories on the remote web server (as mutate 6)
- Plugin to attempt to brute force domains (as mutate 5)
- Allow username guessing (mutate 3 and 4) to use a dictionary file as well as brute forcing
- Support for NTLM authentication
- Lots of bug fixes and new security checks
Please, try out, break and report bugs and suggestions...