SQL Direct Reporting

SQL Direct (sqld) inserts scan findings into a MySQL/MariaDB or PostgreSQL database over DBI as the scan runs. Unlike -Format sql (which writes SQL insert statements to a file), sqld does not need -output and writes rows directly.

Quick start

1. Create the table from the schema in the Nikto tree (documentation/nikto_schema_mysql.sql or documentation/nikto_schema_postgresql.sql).
2. Uncomment and set the DB_* values in nikto.conf (see below).
3. Set NIKTO_DB_USER and NIKTO_DB_PASS in the environment.
4. Install the Perl DB modules for your database.
5. Run Nikto with -Format sqld.

nikto.pl -h https://example.com -Format sqld

You can combine formats; only file-based formats need -output:

nikto.pl -h https://example.com -Format sqld,txt -output report.txt

nikto.conf settings

These are commented out in nikto.conf.default. Rename/copy to nikto.conf and uncomment to enable:

# SQL Direct Database Reporting
# Database type: mysql or postgresql
DB_TYPE=mysql
DB_HOST=localhost
DB_PORT=3306
DB_NAME=nikto
DB_TABLE=nikto_table
# NOTE: -> Set credentials in environment vars: NIKTO_DB_USER and NIKTO_DB_PASS

Variable	Required	Description
DB_TYPE	yes	mysql or postgresql
DB_HOST	yes	Database hostname or IP. For MySQL, localhost is rewritten to 127.0.0.1 so TCP + port are used instead of a Unix socket.
DB_PORT	no	Defaults to 3306 (MySQL) or 5432 (PostgreSQL)
DB_NAME	yes	Database name (letters, digits, underscore only)
DB_TABLE	no	Table name (default nikto_table)

Credentials are not stored in nikto.conf. They must come from environment variables.

Environment variables

Variable	Required	Description
NIKTO_DB_USER	yes	Database username
NIKTO_DB_PASS	yes	Database password

Nikto looks up these names case-insensitively (helpful on Windows where set nikto_db_pass=... may not match a case-sensitive %ENV lookup).

Linux / macOS (bash/zsh)

Current shell session:

export NIKTO_DB_USER=nikto
export NIKTO_DB_PASS='your-password'
./nikto.pl -h https://example.com -Format sqld

One-shot prefix (does not persist):

NIKTO_DB_USER=nikto NIKTO_DB_PASS='your-password' ./nikto.pl -h https://example.com -Format sqld

To persist for login shells, add the export lines to ~/.bashrc, ~/.zshrc, or a dedicated env file you source before scanning.

Windows Command Prompt

set NIKTO_DB_USER=nikto
set NIKTO_DB_PASS=your-password
nikto.pl -h https://example.com -Format sqld

Those set values last for that CMD window only. For a process-only override in one line:

set NIKTO_DB_USER=nikto&& set NIKTO_DB_PASS=your-password&& nikto.pl -h https://example.com -Format sqld

Windows PowerShell

$env:NIKTO_DB_USER = "nikto"
$env:NIKTO_DB_PASS = "your-password"
perl nikto.pl -h https://example.com -Format sqld

Session-only. For the current user permanently (new shells):

[System.Environment]::SetEnvironmentVariable("NIKTO_DB_USER", "nikto", "User")
[System.Environment]::SetEnvironmentVariable("NIKTO_DB_PASS", "your-password", "User")

Perl modules

Required for all sqld use:

• DBI

Plus a driver for the chosen DB_TYPE:

• MySQL/MariaDB: DBD::MariaDB (preferred) or DBD::mysql
• PostgreSQL: DBD::Pg

Example installs:

cpan DBI DBD::MariaDB
cpan DBI DBD::Pg

If a driver fails to load, run with -Display V to see the underlying error (common when an XS module was built against a different Perl).

Schema

Create the table before scanning. Nikto checks that DB_TABLE exists and exits if it does not (it does not auto-create the table).

Schemas ship in:

• documentation/nikto_schema_mysql.sql
• documentation/nikto_schema_postgresql.sql

See Export Formats for column descriptions. The ip column is varchar(45) to allow IPv6. Request/response bodies are base64-encoded and truncated to about 48KB / 12MB raw respectively for compatibility.

What gets inserted

• A host-start row when scanning begins (testid 999958, banner or “Host scan started”)
• An SSL/TLS info row when applicable (testid 000137)
• One row per finding (with optional request/response)

Failures to insert a single row are logged; a lost DB connection disables further inserts for that run.

Troubleshooting

• Missing DB_* or env vars → Nikto exits with a configuration error before scanning.
• Table missing → Nikto exits and points at the schema files.
• Auth/network errors → check DSN host/port, firewall, and that NIKTO_DB_* match a DB user with INSERT on the table.
• MySQL socket surprises → avoid relying on localhost Unix sockets; Nikto forces TCP via 127.0.0.1 when DB_HOST=localhost.