🐛 Nikto: Support v2.5.0 format

[manuel-sommer]

see issue #9274

[dryrunsecurity]

Contextual Security Analysis

As DryRun Security performs checks, we’ll summarize them here. You can always dive into the detailed results in the section below for checks.

Status	DryRun Security Check
✅	AI-powered Sensitive Function Check
✅	Configured Sensitive Files Check
✅	AI-powered Sensitive Files Check

Chat with your AI-powered Security Buddy by typing @dryrunsecurity followed by your question into a comment.
Example: @dryrunsecurity What are common security issues with web application cookies?

Install and configure more repositories at DryRun Security

[manuel-sommer]

@mtesauro: The new Nikto findings are all "info" findings by default. Should we keep those or raise the severity if the vulnerability scanner does not support any severity / criticality classification?

[mtesauro]

@manuel-sommer Hmm. I think it's better to report at info and let people move it up to Low (or whatever) based on how they rate issues internally. That's probably better then potentially inflating the severity of a finding.

[mtesauro]

Approved.

I'm a fan of making the parser smarter so it handles multiple formats from a tool so thanks for doing that. Much better than YASTP (Yet Another Same Tool Parser)

[manuel-sommer]

@manuel-sommer Hmm. I think it's better to report at info and let people move it up to Low (or whatever) based on how they rate issues internally. That's probably better then potentially inflating the severity of a finding.

This could also be a usecase for this: #9250
If you give me a hint on how to advance the api and parse the value there to the finding parser, I could make a PR and advance nikto in a way to have:

• default setting == severity Info
• api setting == severity is adaptable through a meta field in the api while import or reimport.

But I would do this in an extra PR.

[Maffooch]

Reducing duplicated code

[Maffooch]

Thanks @manuel-sommer :)