Nikto v2.1.0 - released

Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 3500 potentially dangerous files/CGIs, versions on over 900 servers, and version specific problems on over 250 servers. Scan items and plugins are frequently updated and can be automatically updated (if desired).

This version has gone through significant rewrites under the hood to how Nikto works, to make it more expandable and usable. Changes include:

JPEG - 6.7 kb

-* Rewrite to the plugin engine allowing more control of the plugin structure and making it easier to add plugins

  • Rewrite to the reporting engine allowing reporting plugins to cover more and also ensuring that output is written if Nikto is quit before finishing
  • Large overhaul of documentation to document built-in methods and variables (available in the tarball or on cirt.net).
  • Addition of caching to reduce amount of calls made to the web servers, as well as a facility to disable smart 404 guessing.
  • Addition of simple guessing for whether a system is an embedded device and to report what it is
  • Plugin to use OWASPs dictionary lists to attempt to brute force directories on the remote web server (as mutate 6)
  • Plugin to attempt to brute force domains (as mutate 5)
  • Allow username guessing (mutate 3 and 4) to use a dictionary file as well as brute forcing
  • Support for NTLM authentication
  • Lots of bug fixes and new security checks

More Information:

Post scriptum

Compliance Mandates

  • Application Scanner :

    PCI/DSS 6.3, SOX A12.4, GLBA 16 CFR 314.4(b) and (2), HIPAA 164.308(a)(1)(i), FISMA RA-5, SA-11, SI-2, ISO 27001/27002 12.6, 15.2.2

  • Network Discovery :

    PCI DSS 11.2, SOX A13.3, GLBA 16CFR Part 314.4(c), HIPAA 164.308(a)(8), FISMA RA-5

  • Vulnerability Scanner :

    PCI DSS 11.2, 6.6, SOX A13.3, GLBA 16CFR Part 314.4(c), HIPAA 164.308(a)(8), FISMA RA-5, SI-2, ISO 27001-27002 12.6, 15.2.2


Comments

Related Articles

Application Scanner
Network Discovery
Nikto
Vulnerability Scanner