| 1 | 2008-09-12 plugins/nikto_core.plugin plugins/nikto_httpoptions.plugin |
|---|
| 2 | plugins/db_httpoptions |
|---|
| 3 | - Fix for ticket #38: httpoptions are drawn from a database |
|---|
| 4 | - Now setup to allow dynamic databases, rather than all being imported |
|---|
| 5 | by nikto_core at start time |
|---|
| 6 | 2008-09-06 plugins/nikto_core.plugin tmpl/htm_close.tmpl |
|---|
| 7 | - Fix for ticket #53: all plugins now show last mod date |
|---|
| 8 | - Fix for ticket #51: updated copyright date in HTML |
|---|
| 9 | 2008-09-04 plugins/nikto_core.plugin |
|---|
| 10 | - Fix for ticket #55, introduced by the solution for ticket #44 |
|---|
| 11 | - Fix for ticket #53 |
|---|
| 12 | =========Nikto 2.03========= |
|---|
| 13 | 2008-08-12 plugins/db_outdated |
|---|
| 14 | - Fix for Jetty to latest version, fixes ticket #49 |
|---|
| 15 | 2008-08-07 docs/nikto_manual.html |
|---|
| 16 | - New export of the manual from the docbook |
|---|
| 17 | - Updated versions in nikto.pl |
|---|
| 18 | 2008-08-06 plugins/db_outdated |
|---|
| 19 | - Added various new versions |
|---|
| 20 | 2008-08-05 plugins/db_favicon |
|---|
| 21 | - Fix for ticket #45 |
|---|
| 22 | - Added favicons for Roku Soundbridge and Ampache |
|---|
| 23 | 2008-07-14 plugins/nikto_headers.plugin |
|---|
| 24 | - Changes to look at non-standard headers |
|---|
| 25 | - Changes to examine Apache's ETag header |
|---|
| 26 | 2008-07-07 nikto.pl plugins/nikto_core.plugin plugins/nikto_reports.plugin |
|---|
| 27 | - Fix for ticket #41 - a rather nasty bug that's been in nikto 2 since |
|---|
| 28 | its inception; where variables weren't fully expanded. |
|---|
| 29 | 2008-07-02 plugins/nikto_core.plugin |
|---|
| 30 | - Fix for ticket #11 - change CGIDIRS test so that they're not |
|---|
| 31 | hardcoded. The reponse codes are now kept in a variable in |
|---|
| 32 | db_variables |
|---|
| 33 | - Applied same to enumerating apache users plugin |
|---|
| 34 | - Fix for ticket #39 - we now check whether getoptions failed, show |
|---|
| 35 | usage and exit with a code of one. This also means that it will exit |
|---|
| 36 | gracefully if a parameter is missed out when one is required. |
|---|
| 37 | 2008-06-24 plugins/nikto_core.plugin |
|---|
| 38 | - Fix for ticket #35 - allow multiple HTTP methods to identify |
|---|
| 39 | an HTTP server, these are set with the variable CHECKMETHODS in |
|---|
| 40 | config.txt |
|---|
| 41 | - Fix for a bug in the nmap reader where it would ignore the IP |
|---|
| 42 | address if it nmap didn't return a hostname. |
|---|
| 43 | 2008-06-22 plugins/db_tests |
|---|
| 44 | - Fix for ticket #26 - stop domino tests producing false positives |
|---|
| 45 | 2008-06-20 plugins/nikto_httpoptions.plugin |
|---|
| 46 | - Fix for ticket #30 - ensure that propfind has the right OSVDB tag |
|---|
| 47 | 2008-04-22 plugins/nikto_outdated.plugin |
|---|
| 48 | - Change to allow stop duplication of items when scanning more than one |
|---|
| 49 | host. Fix for bug 28 |
|---|
| 50 | 2008-04-16 plugins/nikto_core.plugin |
|---|
| 51 | - Change to allow reading of a host list from stdin |
|---|
| 52 | - Fix for enhancement 10: read from nmap output (only -oG) |
|---|
| 53 | 2008-04-15 plugins/nikto_core.plugin |
|---|
| 54 | - Fixes for bug 25: Unopen ports are now reported |
|---|
| 55 | 2008-04-14 templates/htm* |
|---|
| 56 | - Fixes for bug 24: HTML output is now valid HTML 4.01 Strict |
|---|
| 57 | 2008-04-11 nikto.pl |
|---|
| 58 | - Started using international dates instead of the weird US format |
|---|
| 59 | - Added a fix for bug id 23: allow a range of ports instead of a comma |
|---|
| 60 | separated list |
|---|
| 61 | 2008-04-11 db_outdated |
|---|
| 62 | - Updated current version of Apache to 2.2.8 |
|---|
| 63 | 01.06.2008 2.02 |
|---|
| 64 | - Added XML output thanks to the work of Jabra. XML format comes from templates (same as HTML). See the 'templates' dir for more info. |
|---|
| 65 | - HTML reports changed by Jabra to remove some oddities and remove HTML from items |
|---|
| 66 | - Fixed non-reporting of non-HTTP ports (or closed ports) when at least one port was HTTP. |
|---|
| 67 | - Removed experimental knowledge base (KB) code, as XML output is more flexible for long-term scan tracking |
|---|
| 68 | - Added unique identifiers to all tests from databases, and all tests created in code |
|---|
| 69 | - Updated documentation |
|---|
| 70 | 01.02.2008 nikto_core |
|---|
| 71 | - Fixed improper parsing of long options (-update, etc.). Thanks to Frank Breedijk for figuring this out. |
|---|
| 72 | 12.30.2007 db_servers |
|---|
| 73 | - Removed as it is not used |
|---|
| 74 | 12.19.2007 nikto_msgs.plugin |
|---|
| 75 | - Add a boundary for regex on versions to cut down false positives |
|---|
| 76 | 12.19.2007 niko_favicon.plugin |
|---|
| 77 | - Added OSVDB ID |
|---|
| 78 | 12.18.2007 niko_favicon.plugin |
|---|
| 79 | - Fix false positive when favicon.ico doesn't exist |
|---|
| 80 | 11.22.2007 Nikto 2.01 release |
|---|
| 81 | - Fix anti ids encoding use. thanks to Francisco Amato |
|---|
| 82 | - Fix virtual host usage if set via CLI. thanks Jon Hart |
|---|
| 83 | - Fix Host header restoration when testing for IIS IP leak |
|---|
| 84 | - Fix for plugindir & templatedir if EXECDIR is set in config.txt, thanks Shiraishi.M and Will Andrews for pointing it out. |
|---|
| 85 | - Fix count of items--count now accurately reflects the number of items, not just number of vulns. thanks Frank Breedijk |
|---|
| 86 | - Kick a few more things to KB that should be saved |
|---|
| 87 | - Added SKIPIDS to config.txt to completely ignore some tests loaded from db_tests. Suggested by Christian Folini. |
|---|
| 88 | - Enhanced rm_active_content to try to exclude the file/QUERYSTRING requested |
|---|
| 89 | - Unset the auth header after guessing at it. Thanks Paul Woroshow for reporting the bug. |
|---|
| 90 | 11.12.2007 nikto_headers.plugin |
|---|
| 91 | - Fix internal IP address snarfing for IIS, thanks Frank Breedijk for pointing it out |
|---|
| 92 | 11.10.2007 Nikto 2.00 release |
|---|
| 93 | - Rewrite of nikto_httpoptions.plugin to read the Public header |
|---|
| 94 | - Fixups to prevent namespace violations in nikto.pl and nikto_core.plugin |
|---|
| 95 | - Add some normalizations to the -root option variable, suggested by Erik Cabetas |
|---|
| 96 | - Added -Display with options for suppressing redirects & cookies from being included in output |
|---|
| 97 | - Added -Tuning options to let users specify what they would like to test, or exclude certain categories |
|---|
| 98 | - Added config.txt's NMAPOPTS, thanks Sean Lewis for the suggestion |
|---|
| 99 | - All new HTML report |
|---|
| 100 | - Bugfix: a found cookie would report for every port/server after it was found |
|---|
| 101 | - Bugfix: all hosts scanned with all ports if hosts file used |
|---|
| 102 | - Bugfix: all hosts scanned with port 80 despite what the user wanted |
|---|
| 103 | - Bugfix: Reverse DNS inet_aton error fix, pointed out by Jason Peel @ Foundstone |
|---|
| 104 | - Changed auth checking so it will test any directory found, not just /, and removed nikto_realms.plugin as a consequence |
|---|
| 105 | - Changed scan_database.db format significantly (and name), (and all the code to deal with tests) |
|---|
| 106 | - Completely new 404 engine which causes less false-positives (see docs) |
|---|
| 107 | - Created dump_lw_hash instead of dump_request_hash & dump_result_hash |
|---|
| 108 | - Implemented a knowledge base which (should) store all the gory details of scans... probably use this later ;) |
|---|
| 109 | - Moved pre-defined variables from config.txt to variables.db so they can be automagically updated. Entries in config.txt are still read. |
|---|
| 110 | - Removed %CFG, storing vars in %NIKTO instead |
|---|
| 111 | - Removed -generic |
|---|
| 112 | - Removed extraneous global vars |
|---|
| 113 | - Removed load_realms, combined with load_variables |
|---|
| 114 | - Replaced %CONFIG with %NIKTOCONFIG |
|---|
| 115 | - Set MAX_WARN to trigger on any response code, skipping 404|403|401|400 to avoid common ones |
|---|
| 116 | - Added -Single single request mode |
|---|
| 117 | - Updates to use the RFP's LibWhisker 2.0 |
|---|
| 118 | - Added -Help to show extended help ouput, changed default help screen to be shorter. Suggested by Jericho. |
|---|
| 119 | - Additional error checking on invalid reverse-dns (Paul Woroshow) |
|---|
| 120 | - Cleaned up comment/line parsing routines in multiple places, from Erik Cabetas |
|---|
| 121 | - Tightened some for loops with real values instead of guessing, from Erik Cabetas |
|---|
| 122 | - Addded error message if no host is specified, from Erik Cabetas |
|---|
| 123 | - Added more robust output file type checking (txt/htm/cvs), from Erik Cabetas |
|---|
| 124 | - Added more debug statements regarding which CGI directories will be scanned, from Erik Cabatas |
|---|
| 125 | - Bugfix: more 'half dead host' scanning issues resolved with Jericho. LW is much pickier now about calling http_close |
|---|
| 126 | - Added error if -F specified without -o, from Erik Cabetas |
|---|
| 127 | - Bugfix: server category match no longer matches partial strings, from Erik Cabetas |
|---|
| 128 | - Bugfix: mis-pasted line, pointed to by Erik Cabetas |
|---|
| 129 | - Send all errors to STDERR |
|---|
| 130 | - Added -config option to specify a config file, thanks to Pavel Kankovsky |
|---|
| 131 | - fixed regex issue on banner. thanks Alexander Ehlert for pointing it out |
|---|
| 132 | - All other plugins updated for v2 changes |
|---|
| 133 | - Added favicon.ico hash checking |
|---|
| 134 | - ... gobs more |
|---|
| 135 | |
|---|
| 136 | 02.06.2004 nikto_core.plugin 1.21 |
|---|
| 137 | - Cleaned up comment/line parsing routines in multiple places, from Erik Cabetas |
|---|
| 138 | - Tightened some for loops with real values instead of guessing, from from Erik Cabetas |
|---|
| 139 | - Removed duplicate bit of code, from Erik Cabetas |
|---|
| 140 | - Addded error message if no host is specified, from Erik Cabetas |
|---|
| 141 | - Added more robust output file type checking (txt/htm/cvs), from Erik Cabetas |
|---|
| 142 | - Added more debug statements regarding which CGI directories will be scanned, from Erik Cabatas |
|---|
| 143 | |
|---|
| 144 | 12.17.2003 |
|---|
| 145 | nikto_core.plugin 1.20 |
|---|
| 146 | - Fixed BID links, thanks Richard Tortorella for the report. |
|---|
| 147 | |
|---|
| 148 | 10.27.2003 Nikto 1.32 release |
|---|
| 149 | nikto_core.plugin 1.19 |
|---|
| 150 | - Removed unecessary 'use IO::Socket' call from resolve() |
|---|
| 151 | - Removed unecessary counters |
|---|
| 152 | - Replaced some slow foreach counters |
|---|
| 153 | - Moved proxy_check earlier, before port_scan, so it will be set first |
|---|
| 154 | - Removed -allcgi option in favor of -CGIdir, which can specify to test 'all', 'none' or a specific directory. |
|---|
| 155 | - Bugfix: testing through proxy by making sure host name is set instead of ip, thanks to Fabrice Annic for the catch |
|---|
| 156 | - Bugfix: a regex/logic/if error in test_target, thanks Pavel Kankovsky for the bug report. 401/302 messages will now report regardless of test/pass fail. |
|---|
| 157 | - Bugfix: -dbcheck now identifies duplicates without relying on message text, thanks Jericho / Attrition.org for pointing this out |
|---|
| 158 | |
|---|
| 159 | nikto.pl 1.12 |
|---|
| 160 | - Rearranged order of get_banner & setup so that it would be called right |
|---|
| 161 | |
|---|
| 162 | nikto_headers.plugin 1.08 |
|---|
| 163 | - Added DAAP header check |
|---|
| 164 | |
|---|
| 165 | 10.02.2003 |
|---|
| 166 | nikto_core.plugin 1.18 |
|---|
| 167 | - Fixed get_banner to properly handle multi host/port scans |
|---|
| 168 | |
|---|
| 169 | 10.01.2003 |
|---|
| 170 | nikto_outdated.plugin 1.12 |
|---|
| 171 | - Fixed improper matching in version evals, reported by Paul Bakker |
|---|
| 172 | |
|---|
| 173 | 09.30.2003 |
|---|
| 174 | nikto_core.plugin 1.17 |
|---|
| 175 | - Reordered loop code to make -f scans faster. |
|---|
| 176 | - Added a skip for "(Win32)" in the version updates back to cirt.net |
|---|
| 177 | |
|---|
| 178 | nikto_outdated.plugin 1.11 |
|---|
| 179 | - Stripping () from version strings |
|---|
| 180 | |
|---|
| 181 | 09.24.2003 Nikto 1.31 release |
|---|
| 182 | nikto_core.plugin 1.16 |
|---|
| 183 | - Fixed a bug in resolve() that may prevent name lookups when host files used |
|---|
| 184 | - Fixed a bug in resolve() where scan would exit if 1 name resolution from host file failed |
|---|
| 185 | - Changed set_targets so that if the -h value exists as a file it reads that instead of resolving it as a name. This eliminates need for .csv or .txt file name endings. |
|---|
| 186 | - Added auto or semi-auto update of version strings to CIRT.net. This is done through a simple GET request. Controlled via config.txt's UPDATES variable. |
|---|
| 187 | *ABSOLUTELY NO* server info is sent... only versions from HTTP headers, i.e. "Apache/4.0". Thanks to Jericho for feedback/ideas. |
|---|
| 188 | - Added a host counter output at end & for every 10 hosts |
|---|
| 189 | - Set CHANGES.txt download only on *code* updates, not DBs |
|---|
| 190 | - Added MAX_WARN to config.txt for warning level on OK/Moved messages, thanks Jericho for the suggestion. |
|---|
| 191 | - Added PROMPTS to config.txt to allow user control of prompting--good for unattended scans |
|---|
| 192 | - Added a regex test to dbcheck() better catch errors in server_msgs.db |
|---|
| 193 | - Thanks again to Jericho for many updated tests/information. |
|---|
| 194 | - Cleaned up port scan code |
|---|
| 195 | - Fixed/improved scanning through proxies |
|---|
| 196 | |
|---|
| 197 | nikto_outdated.plugin 1.09 |
|---|
| 198 | - Added support for sending updates of version strings to CIRT.net. See nikto_core.plugin version 1.15 notes. |
|---|
| 199 | |
|---|
| 200 | LW.pm - 1.8 |
|---|
| 201 | - Updated to LW.pm v1.8, see the change log included with it (www.wiretrip.net/rfp/). |
|---|
| 202 | |
|---|
| 203 | nikto.pl - 1.10 |
|---|
| 204 | - Implemented versioning on nikto.pl (!), many changes to support core 1.15 |
|---|
| 205 | - Put 'require LW.pm' down *after* we know where it is.. duh. Thanks J Barber (ussysadmin.com) for the suggestion. Also changed it 'require' vs 'use' so in the future I can update it, if necessary. |
|---|
| 206 | - Hosts are now tested in the same order as the appear in an input file |
|---|
| 207 | |
|---|
| 208 | |
|---|
| 209 | 08.18.2003 |
|---|
| 210 | nikto_outdated.plugin 1.08 |
|---|
| 211 | - Fixed nasty regex bug in the version eval, and made more efficient. Pointed out by fr0stman, thx Zeno for assistance |
|---|
| 212 | |
|---|
| 213 | 07.22.2003 |
|---|
| 214 | nikto_headers.plugin 1.07 |
|---|
| 215 | - Added Host header back after delete in IIS Content-Location check. Thanks to Abdi Ponce for the bug report & debug. |
|---|
| 216 | |
|---|
| 217 | nikto_httpoptions.plugin 1.04 |
|---|
| 218 | - Changed PROPPATCH, TRACK, TRACE messages. Changed PROPFIND message, thanks to Jericho for tracking down some good info on it. Added SEARCH message. |
|---|
| 219 | |
|---|
| 220 | nikto_core.plugin 1.14 |
|---|
| 221 | - Added <title> tags to the HTML output for browser-neatness |
|---|
| 222 | - Removed a stray debug print |
|---|
| 223 | |
|---|
| 224 | 07.03.2003 |
|---|
| 225 | - Thanks to Jeremy Bae for many Jeus Webserver tests. |
|---|
| 226 | |
|---|
| 227 | 06.29.2003 |
|---|
| 228 | nikto_core.plugin 1.13 |
|---|
| 229 | - changed some &function calls to function() to keep $_ from being passed down another level.. thanks to zeno for the heads-up. |
|---|
| 230 | |
|---|
| 231 | nikto_headers.plugin 1.05 |
|---|
| 232 | - fixed the IIS4 content-location check as it had a tendency to fail miserably... |
|---|
| 233 | |
|---|
| 234 | 06.29.2003 |
|---|
| 235 | nikto_core.plugin 1.12 |
|---|
| 236 | - changed output of dump_request to be more like normal request text |
|---|
| 237 | |
|---|
| 238 | 06.29.2003 |
|---|
| 239 | nikto_core.plugin 1.11 |
|---|
| 240 | - bug fix for scanning through proxies |
|---|
| 241 | |
|---|
| 242 | 06.19.2003 |
|---|
| 243 | nikto_core.plugin 1.10 |
|---|
| 244 | - added 'csv' to file formats in -help output (doh!) |
|---|
| 245 | - minor speedups |
|---|
| 246 | |
|---|
| 247 | 06.17.2003 |
|---|
| 248 | nikto_user_enum_apache.plugin 1.02 |
|---|
| 249 | - Bugfix: some user names not tested (zz, zzz, etc.) |
|---|
| 250 | - Major rewrite for speed improvements |
|---|
| 251 | |
|---|
| 252 | nikto_user_enum_cgiwrap.plugin 1.01 |
|---|
| 253 | - Bugfix: some user names not tested (zz, zzz, etc.) |
|---|
| 254 | - Major rewrite for speed improvements |
|---|
| 255 | |
|---|
| 256 | 06.16.2003 |
|---|
| 257 | nikto_core.plugin 1.09 |
|---|
| 258 | - dbcheck option enhanced: check that all plugins are in the order file |
|---|
| 259 | - dbcheck option enhanced: check that all plugins have properly named sub calls |
|---|
| 260 | - update option enhanced: retrieves updated CHANGES.txt file with code updates |
|---|
| 261 | - Bugfix: resolve() did not properly catch invalid IP addresses. Reported by Rick Tortorella. |
|---|
| 262 | |
|---|
| 263 | 06.12.2003 |
|---|
| 264 | nikto_core.plugin 1.08 |
|---|
| 265 | - Removed iprint() entirely (finally) |
|---|
| 266 | - Made "Needs Auth" links active in HTML output |
|---|
| 267 | |
|---|
| 268 | 05.30.2003 |
|---|
| 269 | nikto_core.plugin 1.07 |
|---|
| 270 | - Bugfix: |
|---|
| 271 | |
|---|
| 272 | 05.30.2003 |
|---|
| 273 | nikto_core.plugin 1.06 |
|---|
| 274 | - Added number of elapsed seconds to final host/port output |
|---|
| 275 | - Bugfix: Changed CAN/CVE link to point to cve.mitre.org instead of ICAT |
|---|
| 276 | - Bugfix: Duplicate port 80 in nmap options if -p not specified but 80 specified in hosts file |
|---|
| 277 | |
|---|
| 278 | 05.28.2003 |
|---|
| 279 | nikto_core.plugin 1.05 |
|---|
| 280 | - Bugfix: -update code prevented automatic updates. Found & fixed by Keith Young. Also reported by Paul Worshaw. |
|---|
| 281 | |
|---|
| 282 | 05.27.2003 |
|---|
| 283 | Nikto 1.30 release |
|---|
| 284 | General changes |
|---|
| 285 | - removed nikto_google.plugin entirely (may add better plugin later) |
|---|
| 286 | - major "under the hood" changes to make things easier to maintain, read & modify |
|---|
| 287 | - killed as many global vars as I could stand in favor of a few global hashes (CLI input, etc.) |
|---|
| 288 | - added $CURRENT_HOST_ID and $CURRENT_PORT as globals--these are the pointers to "where you are" (mostly as in $TARGETS) |
|---|
| 289 | - added the ability to have basic conditional items for tests, i.e. "200!index" to designate a response of "200" but the |
|---|
| 290 | content does not contain "index" (suggested by Paul Woroshow). |
|---|
| 291 | - added -V option, which displays versions of all code files & databases (suggested by Jericho) |
|---|
| 292 | - specifying -ssl now forces *all ports* on *all servers* to use ssl. best that can be done for now. |
|---|
| 293 | - added multi-host support via a text file with port specification in the file or via CLI |
|---|
| 294 | - all new save file routines |
|---|
| 295 | - unbuffered file output to keep partial/cancelled run data |
|---|
| 296 | - removed the -w option in favor of -F with multiple formats |
|---|
| 297 | - added support for NTLM authentication |
|---|
| 298 | - added cgiwrap plugin |
|---|
| 299 | nikto_core.plugin 1.05 |
|---|
| 300 | - Many updates to support multiple host scans |
|---|
| 301 | - Added UA for update agents |
|---|
| 302 | - Changed all %SERVER hash refs to either %CLI or %TARGETS |
|---|
| 303 | - Removed %BANNERS (now in %TARGETS) |
|---|
| 304 | - Added set_targets() to handle various target input methods |
|---|
| 305 | - Bugfix: non-SSL ports not found after first SSL port found on a host |
|---|
| 306 | - Bugfix: authentication realms were not checked with the proper root if -r was specified on the CLI |
|---|
| 307 | - Bugfix: can't call 'fprint' if core plugin is not found (duh!). Found by Erwin Paternotte. |
|---|
| 308 | nikto_user_enum_cgiwrap.plugin 1.00 |
|---|
| 309 | - added |
|---|
| 310 | nikto_mutate.plugin 1.05 |
|---|
| 311 | - change for using %CLI |
|---|
| 312 | nikto_passfiles.plugin 1.01 |
|---|
| 313 | - change for using %CLI |
|---|
| 314 | nikto_user_enum_apache.plugin 1.01 |
|---|
| 315 | - change for using %CLI |
|---|
| 316 | - renamed from 'nikto_userenum.plugin' |
|---|
| 317 | nikto_msgs.plugin 1.03 |
|---|
| 318 | - minor changes for multi-host support |
|---|
| 319 | plugins_order.txt 1.03 |
|---|
| 320 | - removed nikto_google.plugin |
|---|
| 321 | |
|---|
| 322 | 02.23.2003 |
|---|
| 323 | nikto_core.plugin 1.04 |
|---|
| 324 | - Added a work around for servers that answer with blank www-authenticate headers with invalid id/pass combos |
|---|
| 325 | nikto_realms.plugin 1.00 |
|---|
| 326 | - Added to distro |
|---|
| 327 | realms.db 1.00 |
|---|
| 328 | - Added to distro |
|---|
| 329 | plugins_order.txt 1.02 |
|---|
| 330 | - Added nikto_realms.plugin |
|---|
| 331 | |
|---|
| 332 | 01.22.2003 |
|---|
| 333 | nikto_httpoptions.plugin 1.03 |
|---|
| 334 | - standardized wording, added TRACE option, added more description to WebDAV msgs (thanks Jericho at attrition.org). |
|---|
| 335 | |
|---|
| 336 | 01.22.2003 |
|---|
| 337 | nikto_core.plugin 1.03 |
|---|
| 338 | - fixed a bug with matching proper server categories, thanks to Paul Woroshow. |
|---|
| 339 | |
|---|
| 340 | 01.17.2003 |
|---|
| 341 | nikto_core.plugin 1.02 |
|---|
| 342 | - fixed the GetOptions only looking for "-gener" instead of "-generic", thanks to Michel Arboi |
|---|
| 343 | |
|---|
| 344 | 01.02.2003 |
|---|
| 345 | nikto_core.plugin 1.01 |
|---|
| 346 | - fixed proxy authentication not prompting for -update option |
|---|
| 347 | |
|---|
| 348 | 01.01.2003 |
|---|
| 349 | Nikto 1.23 |
|---|
| 350 | - added nikto_plugin_order.txt to force plugin order to something we want rather than alpha |
|---|
| 351 | - added nikto_core.plugin & removed most functions from nikto.pl |
|---|
| 352 | - added -cookies option |
|---|
| 353 | - enhanced db syntax error checking (spurred by syntax problems Thomas Reinke found) |
|---|
| 354 | - started using the LW 1.6 libraries |
|---|
| 355 | - fixed infinite loop output problem (no longer wrapping long lines) |
|---|
| 356 | - removed usage from saved output (too long) |
|---|
| 357 | - remove nikto_frontpage.plugin and put checks in scan_database.db |
|---|
| 358 | - moved server categories from scan_database.db to servers.db |
|---|
| 359 | - got rid of the leading "c," requirement from scan_database.db |
|---|
| 360 | - added STATIC-COOKIE config item as suggested by Eyal Udassin |
|---|
| 361 | - made CLI options case sensitive (to support more options, hosts files, etc) |
|---|
| 362 | - added Javier Fernandez-Sanguino Pen~a's Apache user enumeration plugin |
|---|
| 363 | - added -r (-root) file prepend as suggested by Eyal Udassin |
|---|
| 364 | - many DB typo fixes from Jay Swofford |
|---|
| 365 | - fixed a regex bug in nikto_robots.plugin and nikto_apacheusers.plugin |
|---|
| 366 | - new update location (path) to better support upgrades that don't effect db syntax |
|---|
| 367 | |
|---|
| 368 | 08.21.2002 |
|---|
| 369 | Nikto 1.21 |
|---|
| 370 | - Fixed all the proxy code--none of it was working due to where it was set in the initialization. |
|---|
| 371 | - Added -update to the help output. Not sure why it wasn't there. |
|---|
| 372 | |
|---|
| 373 | 08.12.2002 |
|---|
| 374 | Nikto 1.20 |
|---|
| 375 | - Re-packaged to take out a testing line from LW.pm. Thanks to D Rhoades for the catch |
|---|
| 376 | |
|---|
| 377 | 08.11.2002 |
|---|
| 378 | Nikto 1.20 |
|---|
| 379 | - Moved all mutate options to plugins |
|---|
| 380 | - Added password file mutate plugin |
|---|
| 381 | - Added better error messages if problems arise |
|---|
| 382 | - Test for false-positives on all CGI directories |
|---|
| 383 | - Added -useproxy CLI |
|---|
| 384 | - Printing SSL certs the server accepts |
|---|
| 385 | - Fixed port sorting if -f is used |
|---|
| 386 | - Forked 1.20DCX edition for DefCon 10 CD: difference is only output |
|---|
| 387 | - Fixed a bug where "findonly" was referenced as "findports" (thanks J DePriest) |
|---|
| 388 | - Added properly wrapped text output in saved files |
|---|
| 389 | |
|---|
| 390 | 05.25.2002 |
|---|
| 391 | Nikto 1.100 |
|---|
| 392 | - stopped nikto from dying if no config.txt file found |
|---|
| 393 | - added Apache user enumeration plugin |
|---|
| 394 | - added robots.txt plugin |
|---|
| 395 | - set false-positive message to display at end of run as well as during |
|---|
| 396 | - |
|---|
| 397 | 04.23.2002 |
|---|
| 398 | Nikto 1.10BETA_3 |
|---|
| 399 | - fixed CAN/CVE links, added BID/CA/MS links (suggested by Jericho). |
|---|
| 400 | - prints total number of 'issues' found (suggested by Jericho). |
|---|
| 401 | - fixed proxy usage in the cirt.net update function. |
|---|
| 402 | - updated to use LW 1.4, which fixes an SSL infinite loop problem. |
|---|
| 403 | - fixed 401 auth suppression (broken in beta 2). |
|---|
| 404 | - added robots plugin to examine robots.txt & add items found to the mutate check |
|---|
| 405 | - |
|---|
| 406 | 03.31.2002 |
|---|
| 407 | Nikto 1.10BETA_2 |
|---|
| 408 | - fixed the config.txt DEFAULTHTTPVER variable setting so it really works |
|---|
| 409 | - made proxy_check run only once per session |
|---|
| 410 | - removed all reference to "nikto" in the scan_database.db |
|---|
| 411 | - |
|---|
| 412 | 03.23.2002 |
|---|
| 413 | Nikto 1.10BETA_1 |
|---|
| 414 | - renamed plugins from .pl to .plugin, just for clarity. but they're still perl files |
|---|
| 415 | - allowed nikto.pl to update plugins the same as .db files |
|---|
| 416 | - usage of LW 1.2 |
|---|
| 417 | - countless "under the hood" type things |
|---|
| 418 | - lowercase-incoming-headers to more easily handle case sensitive nonsense |
|---|
| 419 | - compartmentalized a LOT more code to make things easier to read |
|---|
| 420 | - created config.txt file configuration w/o midifying nikto.pl itself |
|---|
| 421 | - added user_scan_database.db so that it won't get ovwr-written if the user adds checks |
|---|
| 422 | - enabled RFP's LibWhisker anti-ids options |
|---|
| 423 | - change "check," to "c," in scan_database, just to save a little bandwidth on cirt.net :) |
|---|
| 424 | - added plugin to check HTTP methods |
|---|
| 425 | - created a 'mutate' mode for really brute force finding stuff on servers |
|---|
| 426 | - added the ability to set default CLI options via config file |
|---|
| 427 | - added PLUGINDIR config variable |
|---|
| 428 | - added plugin to check other HTTP headers (just x-powered-by for now) |
|---|
| 429 | - added ability for nikto to auto-determine ssl v non-ssl on a port |
|---|
| 430 | - added port scanning ability (with or without nmap) |
|---|
| 431 | - added ability to send message via the update script's versions.txt file. I don't know why, but it may be handy to let folks know if a new beta is out, or something. |
|---|
| 432 | - implemented the virtual host headers as patched by Pasi Eronen |
|---|
| 433 | - |
|---|
| 434 | 01.17.2002 |
|---|
| 435 | Nikto 1.018 |
|---|
| 436 | - Added /mpcgi/ to the @CGIDIRS array based on some suggestions. |
|---|
| 437 | - Fixed a bug in the auth_check function (thanks RFP), and cleaned up error reporting on failed auths |
|---|
| 438 | - |
|---|
| 439 | 01.12.2002 |
|---|
| 440 | Nikto 1.017 |
|---|
| 441 | - Fixed a bug where the data portion of a request did not reset to null after some checks (thanks to Phil Brass for pointing me at it & letting me test against his server). |
|---|
| 442 | - |
|---|
| 443 | 01.10.2002 |
|---|
| 444 | Nikto 1.016 |
|---|
| 445 | - Add dump_*hash functions |
|---|
| 446 | - Added pause (-x) in scan loop |
|---|
| 447 | - Fixed a bug which caused a major slowdown |
|---|
| 448 | - Added load_conf for setup for configuration files (future) |
|---|
| 449 | - Fixed http vs. https links in output files |
|---|
| 450 | - |
|---|
| 451 | 01.08.2002 |
|---|
| 452 | Nikto 1.015 |
|---|
| 453 | - Fixed a bug (?) in Libwhisker PR4 (will check v1 code...) |
|---|
| 454 | - Corrected an error which caused a few false-positives (404 really IS not found :) |
|---|
| 455 | 01.07.2002 |
|---|
| 456 | Nikto 1.014 |
|---|
| 457 | - Removed comment filtering from lines in scan_database.db to accommodate SSI includes |
|---|
| 458 | - Fixed quoting removal for data portions in checks (so " is valid). |
|---|
| 459 | - |
|---|
| 460 | 01.06.2002 |
|---|
| 461 | Nikto 1.013 |
|---|
| 462 | - Made major globabl variable changes, moved tons of them to hashes |
|---|
| 463 | - Wrote some basic plugin writing documentation & added 'docs' directory |
|---|
| 464 | - |
|---|
| 465 | 01.03.2002 |
|---|
| 466 | Nikto 1.012 |
|---|
| 467 | - Added extended output for scan archival reasons (suggested by Steve Saady) |
|---|
| 468 | - Changed host auth failure to a warning, not stoppage |
|---|
| 469 | - Added "data" portion to scan_database.db |
|---|
| 470 | - Added @IP and @HOSTNAME substitutions for scan_database.db checks (will be replaced by actual IP/hostname) |
|---|
| 471 | - in case they are needed in the future. |
|---|
| 472 | - Added JUNK() to scan_database.db checks to facilitate future buffer-overflows (non-DoS), and future DoS plugins |
|---|
| 473 | - Added Proxy-agent as valid the same as Server result strings |
|---|
| 474 | - Changed -l to -n ("nolookup") to be more accurate |
|---|
| 475 | - |
|---|
| 476 | 01.02.2002 |
|---|
| 477 | Nikto 1.011 |
|---|
| 478 | - Added proxy auth for db update requests (oops). |
|---|
| 479 | - Started .xxx version numbering scheme to make life easier |
|---|
| 480 | - Fixed href tags in HTM output (< and > encoding and target host/ip) |
|---|
| 481 | - Added "caseless" WWW-Authenticate finding (for iPlanet Proxy) |
|---|
| 482 | - |
|---|
| 483 | 12.31.2001 |
|---|
| 484 | Nikto 1.01 |
|---|
| 485 | - Added regex to remove comments from scan_database.db in case they ever exist |
|---|
| 486 | - Fixed extra 'Host:' line being sent to server (duh). |
|---|
| 487 | - Fixed non 'GET' request data posting (duh). |
|---|
| 488 | - Added -timeout option |
|---|
| 489 | - |
|---|
| 490 | 12.27.2001 |
|---|
| 491 | Nikto 1.00 |
|---|
| 492 | - Finalized beta version for release |
|---|
