forked from nmap/nmap
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathCHANGELOG
5966 lines (4568 loc) · 261 KB
/
CHANGELOG
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# Nmap Changelog ($Id$); -*-text-*-
o There are now binary installers of Nmap and Zenmap for Mac OS X.
http://nmap.org/download.html#macosx
Thanks to Benson Kalahar and Vlad Alexa for extensive testing.
o The NSE HTTP library now uses the host name specified on the command
line when making requests, which improves script scanning against web
servers with virtual hosts. Thanks to Sven Klemm for the patch.
o Removed a superfluous test for the existence of the C++ compiler in the
configure script. The test was not robust when configured with
CXX="ccache g++". Thanks to Rainer Müller for the report.
o Fixed a bug in nmap_dns.cc where the endian of the platform that nmap
ran on might negitivly effect how efficiently nmap stores cache values
in a hash table. [Michael]
o Fixed the nmap_command_path bug in Zenmap. The variable now actually
accesses the nmap_command_path in zenmap.conf file. It is accessed
by a new class in UmitConf called PathsConfig, which represents the
[paths] section in zenmap.conf. [Jurand Nogiec]
o Nmap now reports scan start and end times for individual hosts
within a larger scan. The information is added to the XML host
element like so: [host starttime="1198292349" endtime="1198292370"]
(but of couse with angle brackets rather than square ones). It is
also printed in normal output if -d or "-v -v" are
specified. [Brandon, Kris, Fyodor]
o "make uninstall" now uninstalls Zenmap as well. The uninstall_zenmap
script now deletes directories that were installed. [David]
o Fixed a bug which caused Nmap to send bad checksums on Solaris 10
x86. This was due to a workaround for an Ancient Solaris 2.1 bug
which activated when the OS string matched "solaris2.1*". The
problem has now been resolved until Solaris 20 comes out and hits
our "solaris2.2*" bug workarounds. Thanks to Nathan Bills for the
problem report. Fixed by Fyodor.
o We now compile in IPv6 support on Windows. In order to use this,
you need to have IPv6 set up. It is installed by default on Vista,
but must be downloaded from MS for XP. See
http://www.microsoft.com/technet/network/ipv6/ipv6faq.mspx . [Kris]
o Nmap now understands the RFC 4007 percent syntax for IPv6 Zone IDs.
On Windows, this ID has to be a numeric index. On Linux and some
other OS's, this ID can instead be an interface name. Some examples
of this syntax:
fe80::20f:b0ff:fec6:15af%2
fe80::20f:b0ff:fec6:15af%eth0
[Kris]
o The Zenmap installer and uninstaller are more careful about escaping
filenames and dealing with an installation root (DESTDIR). [David]
o Since assert() calls are used for various security-related tests,
their safety is now ensured by keeping NDEBUG undefined throughout
Nmap, Nbase and Nsock. [Kris]
o Fix a couple bugs in the way the Nmap built system checked for an
existing LUA library. A bashism caused one test to fail on system
which don't use bash as /bin/sh, and another bug fixed --with-liblua
configure option for specifying your own liblua. [Daniel
Roethlisberger]
o Changed SSLv2-support.nse so that it only enumerates the list of
available ciphers with a verbosity level of at least two or with
debugging enabled. [Kris]
o Removed mswindowsShell.nse as there is a version detection NULL probe
match which accomplishes the same thing. [Brandon, Fyodor, Kris]
Nmap 4.62 [5/3/08]
o Added a new --min-rate option that allows specifying a minimum rate
at which to send packets. This allows you to override Nmap's
congestion control algorithms and request that Nmap try to keep at
least the rate you specify. The rate is given in packets per
second. Read more in the Nmap man page
(http://nmap.org/book/man-performance.html) [David]
o Create /nmap/macosx directory in SVN with files necessary to build
binary Mac OS X Nmap/Zenmap packages. We are trying to create
binary installer packages which are as useful and easy to use as the
Windows installer. This has involved a lot of work by David. We
aren't quite yet distributing the results on the Nmap download page,
but testing our beta versions is useful. You can find the latest
universal (PPC and Intel) binary test version by looking at David
Fifield's posts at http://seclists.org/nmap-dev/2008/q2/author.html .
You can also read /nmap/macosx/README in svn for more info.
o Nmap 2008 Summer of Code students have began working (though full
time doesn't start until late May). Learn about the winners and their
projects at http://seclists.org/nmap-dev/2008/q2/0132.html .
o Brandon added/modified a whole bunch of version detection signatures
based on systems discovered when scanning UCSD's network.
o Reformat Nmap COPYING file (e.g. remove C comment markers, reduce
line length) during Nmap windows build so that it looks much better
when presented by the Windows executable (NSIS) installer. Thanks
to Jah for the patch, which was modified slightly by Fyodor.
o Added NSE Datafiles library which reads and parses Nmap's nmap-*
data files for scripts. The functions (parse_protocols(),
parse_rpc() and parse_services()) return tables with numbers
(e.g. port numbers) indexing names (e.g. service names). The
rpcinfo.nse script was also updated to use this library. [Kris]
o Fixed a bug in the nbase random number generator (and the way it
interacted with Nmap and MS Windows) which caused duplicates in some
instances. Thanks to Jah for reporting the problem and working with
Brandon Enright, Fyodor and Kris to fix it.
o It turns out that hours have 60 minutes, not 24. Fixed a scan
status message which was rolling over the hours column
prematurely. [David]
o Added scripting options to Zenmap profile editor and command wizard
to make use of NSE. [David]
o Zenmap now prints an exception message rather than segfaulting when it
can't open a display (such as when trying to connect to an X server as
an unauthorized user). Thanks to Aaron Leininger for the initial
report and Guilherme Polo for suggesting the fix.
o Now ports in the "unfiltered" state can be selected for attention by
NSE scripts. [Kris]
o Nbase random number generation system now avoids having a high-bit
of zero in every other byte on Windows due to Windows having such a
low RAND_MAX. [Jah]
o Added release dates for each Nmap version to this CHANGELOG going
back to Nmap 3.00 (July 31, 2002). Dates are in MM/DD/YY format.
If someone wants to track down dates for the last 22% of the file
(pre-3.00), you are welcome to do so and send a patch. Searching
Google for the version number and site:seclists.org seems to work
well. [Fyodor]
o Nmap RPM builds now use the versions of libdnet, libpcap, libpcre,
and liblua rather than whatever happens to be installed on the build
system. [David]
o Zenmap can now be installed in and run in directories with a space
in the name. [David]
o Fixed an assertion failure ("Target.cc:396: void
Target::stopTimeOutClock(const timeval*): Assertion
'htn.toclock_running == true' failed.")caused when a host had NSE
scripts in multiple runlevels. This also fixes --host-timeout
behavior in NSE. [Kris]
o Reduce the maximum number of socket descriptors which Nmap is
allowed to open concurrently. This resoles a bug which could cause
"Too many open files" error on Mac OS X when not running as
root. [David]
o Canonicalized service names between nmap-service-probes (version
detection DB) and nmap-services (port scanning DB). [Kris]
o Removed the "class" attribute from the tcpsequence element in XML
output. For a long time it had always been "unknown class" because
Nmap doesn't calculate a class anymore. The XML output version has
been increased from 1.01 to 1.02. [David]
o Fixed a bug on Win32 which caused an infinite loop when Nmap
encountered certain broadcast addresses. [Dudi Itzhakov]
o Fix MingW compilation by adding a signal.h include to
main.cc. [Gisle Vanem]
o Fix the test in our build system to determine if liblua is already
available or not. For example, the test needed to link with -lm
since some systems require that. [David].
o Added TIMEVAL_BEFORE and TIMEVAL_AFTER macros to test whether one
timeval is earlier than another while avoiding possible integer
overflows in a naive approach we were using previously. [David]
o Adjusted a bunch of code to avoid compilation warning messages on
some Linux machines. [Andrew J. Bennieston]
o Fixed the NmapArpCache so that it actually works. Previously, Nmap
was always falling back to the system ARP cache. Of course this
raises the question of whether NmapArpCache is needed in the first
place. [Daniel Roethlisberger]
o Fix a Zenmap bug which could cause the error message
"zenmapCore.NmapOptions.OptionNotFound: No option named '' found!"
if you create a new profile without checking any options then try to
edit it. [David]
o Zenmap now shows a more helpful error message when there is an error
in executing Nmap. [David]
o Zenmap now creates the directory ~/.zenmap-etc to store
automatically generated GTK+ and Pango files. They used to go in the
application bundle but that doesn't work on a read-only filesystem or
disk image. This is what Wireshark does (~/.wireshark-etc), although
the directory could be called anything. It doesn't have to persist
across sessions.
o Added a mechanism in Zenmap for including extra executable search
paths on specific platforms, so we can include /usr/local/bin in
PATH on Mac OS X by default and add the Nmap install directory on
Windows. [David]
o We now use --no-strip when building Zenmap Mac OS X packages to
prevent many mysterious warnings which occur when the binary is
stripped. [David]
o When Zenmap invokes Nmap, it now copies the whole environment for
the Nmap invocation rather than just providing $PATH. Windows may
need this to do proper name resolution. [David]
o Corrected uptime parsing and reporting in SNMPsysdesr.nse for an
uptime of less than 46 hours. [Kris]
o Modified the use of CXXFLAGS, CFLAGS, and CPPFLAGS in Nmap build
system to work better when building Mac OS X universal
binaries. [David]
o Added many additional PCRE option flags to the list returned by the
NSE pcre.flags() function. [Kris]
o Changed the NSE function nmap.set_port_state() so that it checks to
see if the requested port is already in the requested state. This
prevents "Duplicate port" messages during the script scan and the
inaccurate "script-set" state reason. [Kris]
o Canonicalize NSE script license text--more than half did not even
spell license correctly. They all still say that they are under Nmap's
license, just with consistent capitalization and spelling, and now a
link to Nmap legal page at http://nmap.org/man/man-legal.html.
o Updated ripeQuery.nse to not print extraneous whitespace. [Kris]
o Switched telnet brute force password cracking NSE (bruteTelnet.nse)
to vulnerability category so it isn't executed by default. It can
take too long to run. [Eddie]
o NSE status messages now print host name and IP, rather than just the
host name (which was blank when Nmap didn't know it). [Jah]
o Allocate 128 characters for the idle scan ScanProgressMeter title. Previously
it was 32 characters. The "idle scan against " and the \0 terminator take up 19
characters, leaving only 13, which isn't enough to represent all IP addresses,
let alone host names. Bug reported by Stephan Fijneman, fixed by David.
Nmap 4.60 [3/15/08]
o Nmap has moved. Everything at http://insecure.org/nmap/ can now be
found at http://nmap.org . That should save your fingers from a
little bit of typing. Even though transparent redirectors are in
place for the old URLs, please update your links and bookmarks. And
if you don't have a link to Nmap on your web site, now is a good
time to add one :).
o All of your OS detection fingerprints up until March 10, 2008 have
now been integrated by David. The second generation database has
grown from 1,085 fingerprints representing 421 operating
systems/devices, to 1,304 fingerprints representing 478 systems.
That is an increase of more than 20%. New fingerprints were added
for Mac OS X Tiger, iPod Touch, the La Fonera WAP, FreeBSD 7.0,
Linux 2.6.24, Windows 2008, Vista, OpenBSD 4.2, and of course
hundreds of broadband routers, VoIP phones, printers, some crazy
oscilloscope, etc. We get a ton of new fingerprint submissions, but
not as many corrections. Please remember to visit
http://nmap.org/submit/ if Nmap gives you bad results, whether they
are completely wrong or just a slight mistake (like Nmap says Linux
2.6.20-2.6.23, but you're running 2.6.24). Of course you need to be
certain you know exactly what is running on the target before you do
this.
o All of your service fingerprints and corrections submitted until
January 14, 2008 have now been integrated by Doug. As usual, he has
documented his adventures at http://hcsw.org/blog.pl/33 . More than
a hundred signatures were added, growing the database to 4,645
signatures for 457 services. Corrections are welcome for service
detection too -- visit http://nmap.org/submit/ if you get incorrect results.
o Nmap now saves the target name (if any) specified on the command
line, since this can differ from the reverse DNS results. It can be
particularly important when doing HTTP tests against virtual hosts.
The data can be accessed from target->TargetName() from Nmap proper
and host.targetname from NSE scripts. The NSE HTTP library now uses
this for the Host header. Thanks to Sven Klemm for adding this
useful feature.
o Added NSE HTTP library which allows scripts to easily fetch URLs
with http.get_url() or create more complex requests with
http.request(). There is also an http.get() function which takes
components (hostname, port, and path) rather than a URL. The
HTTPAuth, robots, and showHTMLTitle NSE scripts have been updated to
use this library. Sven Klemm wrote all of this code.
o Fixed an integer overflow in the DNS caching code that caused nmap
to loop infinitely once it had expunging the cache of older
entries. Thanks to David Moore for the report, and Eddie Bell for
the fix.
o Fixed another integer overflow in the DNS caching code which caused
infinite loops. [David]
o Added IPv6 host support to the RPC scan. Attempting this before
(via -sV) caused a segmentation fault. Thanks to Will Cladek for
the report. [Kris]
o Fixed an event handling bug in NSE that could cause execution of
some in-progress scripts to be excessively delayed. [Marek]
o A new NSE table library (tab.lua) allows scripts to deliver better
formatted output. The Zone transfer script (zoneTrans.nse) has been
updated to use this new facility. [Eddie]
o Rewrote HTTPpasswd.nse to use Sven's excellent HTTP library and to
do some much-needed cleaning up. [Kris]
o Added a new MsSQL version detection probe and a bunch of match lines
developed by Tom Sellers.
o Added a new service detection probe and signatures for the memcached
service [Doug]
o Added new service detection probes and signatures for the Beast
Trojan and Firebird RDBMS. [Brandon Enright]
o Fixed a crash in Zenmap which occurred when attempting to edit or
create a new profile based on an existing one when there wasn't one
selected. The error message was:
'NoneType' object has no attribute 'toolbar'
Now a new Profile Editor is opened. Thanks to D1N (d1n@inbox.com)
for the report. [Kris]
o Fixed another crash in Zenmap which occurred when exiting the
Profile Editor (while editing an existing profile) by clicking the
"X", then going to edit the same profile again. The error message
was: "No option named '' found!". Now the same window that appears
when clicking Cancel comes up when clicking "X". Thanks to David
for reporting this bug. [Kris]
o Another Zenmap bug was fixed: ports consolidated into "extra ports"
groups are now counted and shown in the "Host Details" tab. The
closed, filtered and scanned port counts in this tab didn't contain
this information before so they were usually very inaccurate. [Kris]
o Another Zenmap bug was fixed: the --scan-delay and --max-scan-delay
buttons ("amount of time between probes") under the Advanced tab in
the Profile Editor were backwards. [Kris]
o Added the UDP Scan (-sU) and IPProto Ping (-PO) to Zenmap's Profile
Editor and Command Wizard. [Kris]
o Reordered the UDP port selection for Traceroute: a closed port is
now chosen before an open one. This is because an open UDP port is
usually due to running version detection (-sV), so a Traceroute
probe wouldn't elicit a response. [Kris]
o Add Famtech Radmin remote control software probe and signatures to
the Nmap version detection DB. [Tom Sellers, Fyodor]
o Add "Conection: Close" header to requests from HTTP NSE scripts so
that they finish faster. [Sven Klemm]
o Update SSLv2-support NSE script to run against more services which
are likely SSL. [Sven Klemm]
o A bunch of service name canonicalization was done in the Nmap
version detection file by Brandon Enright (e.g. capitalizing D-Link
and Netgear consistently).
o Upgraded the shipped LibPCRE from version 7.4 to 7.6. [Kris]
o Updated to latest (as of 3/15) autoconf config.sub/config.guess
files from http://cvs.savannah.gnu.org/viewvc/config/?root=config .
o We now escape newlines, carriage returns, and tabs (\n\r\t) in XML
output. While those are allowed in XML attributes, they get
normalized which can make formatting the output difficult for
applications which parse Nmap XML. [Joao Medeiros, David, Fyodor]
o The Zenmap man page is now installed on Unix when "make install" is
run. This was supposed to work before, but didn't. [Kris]
o Fixed a man page bug related to our DocBook to Nroff translation
software producing incorrect Nroff output. The man page no longer
uses the ".nse" string which was being confused with the Nroff
no-space mode command. [Fyodor]
o Fixed a bug in which some NSE error messages were improperly escaped
so that a message including "c:\nmap" would end up with a newline
between "c:" and "map".
o Updated IANA assignment IP list for random IP (-iR)
generation. [Kris]
o The DocBook XML source code to the Nmap Scripting Engine docs
(http://nmap.org/nse/) is now in SVN under docs/scripting.xml .
4.53 [1/12/08]
o Impoved Windows executable installer by making uninstall work better
on systems which changed the default install path. The shortcut is
also now deleted properly on Vista. [Rob Nicholls]
o Windows installer is now generated using NSIS 2.34 rather than
2.13. [Fyodor]
o Added UPnP-info NSE script by Thomas Buchanan. It gathers
information from the UPnP service (UDP port 1900) which listens on
many network devices such as routers, printers, and networked media
players.
o Fixed a --traceroute bug (assertion failure crash) which occured
when the first hop of the first host in a tracegroup (reference
trace) times out. Thanks to Sebastián García for the bug report and
testing, and Eddie for the patch.
o Fix a problem which prevented proper port number matching in
NSE scripts (port_or_service function) due to a variable
shadowing bug. [Sven Klemm]
o Improved rpcinfo.nse to better sort and display available RPC
services. [Sven Klemm]
4.52 [1/1/08]
o Fixed Nmap Winpcap installer to use CurrentVersion registry key on
Windows rather than VersionNumber to more reliably detect Vista
machines. This should prevent the XP version of Packet.dll from
being installed on Vista. [Rob Nicholls]
o The Nmap Scripting Engine (NSE) now supports run-time interaction
and the Nmap --host-timeout option. [Doug]
o Added nmap.fetchfile() function for scripts so they can easily find
Nmap's nmap-* data files (such as the OS/version detection DBs, port
number mapping, etc.) [Kris]
o Updated rpcinfo.nse to use nmap.fetchfile() to read from nmap-rpc
instead of having a huge table of RPC numbers. This reduced the
script's size by nearly 75%. [Kris]
o Fixed multiple NSE scripts that weren't always properly closing their
sockets. The error message was:
"bad argument #1 to 'close' (nsock expected, got no value)" [Kris]
o Added a new version detection probe for the Trend Micro OfficeScan
product line. [Tom Sellers, Doug]
4.51BETA [12/21/07]
o We now have a detailed Zenmap Guide at http://nmap.org/zenmapguide/ .
Thanks to David for writing it.
o Added rpcinfo.nse script, which contacts a listening RPC portmapper
and reports the listening services and port information (like
rpcinfo -p does). The script was written by Sven Klemm. Fyodor
then enhanced the RPC number list with all of the entries from
nmap-rpc.
o Added a new NSE script (MySQLinfo) which prints MySQL server information
such as the protocol and version numbers, status, thread id, capabilities,
and password salt. [Kris]
o Nmap's output options (-oA, -oX, etc.) now support strftime()-like
conversions in the filename. %H, %M, %S, %m, %d, %y, and %Y are
all the same as in strftime(). %T is the same as %H%M%S, %R is the
same as %H%M, and %D is the same as %m%d%y. A % followed by any
other character just yields that character (%% yields a %). This
means that "-oX 'scan-%T-%D.xml'" uses an XML file in the form of
"scan-144840-121307.xml". [Kris]
o Fixed Winpcap installer to install the right version of Packet.dll
on Windows Vista. [Fyodor]
o Fixed our Winpcap installer so that it waits for a Winpcap uninstall
(if needed) to complete before trying to install the new Winpcap.
[Jah]
o Fix a bunch of warning/error messages which contained an extra
newline. [Brandon Enright]
o Fixed an error when attempting to scan localhost as an unprivileged
user on Windows (nmap --unprivileged localhost). The error was:
"Skipping SYN Stealth Scan against localhost (127.0.0.1) because
Windows does not support scanning your own machine (localhost) this
way."
Now connect scan is used instead of SYN scan. [David]
o Fixed a bug that prevented the --resume option from working on
Windows. The error message was:
..\utils.cc(996): CreateFileMapping(), file 'testresume', length 103,
mflags 000 00006: The parameter is incorrect.(87)
[Fixed by David, reported by Rob Nicholls]
o Zenmap's new web page (http://nmap.org/zenmap/) is now shown in the
Zenmap about dialogue.
o On Windows, paths beginning with \ are now considered absolute when
used with the --script option. jah (jah(a)zadkiel.plus.com) suggested
this. [David]
o Zenmap no longer double-spaces its output (by inadvertently
duplicating newlines) when viewing scan results that were saved to a
file. [Joao Medeiros]
o Upgraded the shipped LibPCRE from version 7.2 to 7.4. [Kris]
o Fixed Zenmap crash that occurred when selecting Help from the Compare
Results window. [Kris]
o Updated robots.nse to prevent printing robots.txt comments. [Kris]
o Many version detection match lines were improved to match even when
newlines appear in binary data returned by the service. [Fixed by
Doug, suggested by Lionel Cons]
4.50 [12/13/07]
o Bumped up the version number to the big 10th anniversary 4.50
release! See http://insecure.org/stf/Nmap-4.50-Release.html .
4.49RC7 [12/10/07]
o A Zenmap crash was fixed. Scanning once, then scanning another target
on the same scan tab caused an ImportError ("list index out of range")
in zenmapGUI/ScanNotebook.py. Joao Medeiros reported the
bug. [David]
o Updated a couple of version detection signatures due to problem
reports by Lionel Cons. [Doug]
4.49RC6 [12/8/07]
o NSE scripts can now be specified by absolute path to the --script
option. This was supposed to work before, but didn't. [David]
o Insert a path separator in returned paths in init_scandir on
Windows. Otherwise options such as "--scripts=scripts" (where
scripts is a directory) were failing with error messages about being
unable to access things like "C:\Nmap\scriptsanonFTP.nse" (should be
"C:\Nmap\scripts\anonFTP.nse"). [David]
o Add some "local" declarations to xamppDefaultPass.nse to avoid
errors like: "SCRIPT ENGINE: [string "Global Access"]:1: Attempted
to change the global 'socket' ..." [David]
o NSE "shortports" function now by default matches ports in the
"open|filtered" state as well as "open" ones. [Diman]
o Nsock msevent_new and msevent_delete calls fixed to handle NULL I/O
descriptors. This should fix a reported bus error crash. [Diman]
o Prevent old bit.dll and pcre.dll files from being installed in
nselib directory by Windows executable installer. Bit.dll is still
installed in nselib-bin where it belongs. Thanks to Rob Nicholls for
reporting the problem. [Fyodor]
4.49RC5 [12/8/07]
o Don't install the orphaned and incomplete Zenmap HTML documentation.
Instead point to the Nmap documentation site, which is provides more
comprehensive and up-to-date Nmap docs. We're rapidly improving the
online Zenmap docs as well. Of course the Nmap and (new!) Zenmap
man pages are still installed on Unix. [Fyodor]
o Fix mswin32/Makefile so that the new nselib-bin directory is
properly included in the Nmap win32 zipfile distribution. Thanks
to Rob Nicholls for reporting the problem. [Fyodor]
o Fix host reason reported when the target is found to be "down" due
to no response. Nmap now reports "no-response" rather than
"unknown-reason" [Kris]
4.49RC4 [12/7/07]
o David did a huge OS fingerprint integration marathon, going through
all of your submissions (more than 1600) since August 20. The 2nd
generation database has grown more than 30% to 1,085 entries! Many
of the existing fingerprints were improved as well. Notable new or
greatly improved entries include the iPhone, iPod Touch, Mac OS X
Leopard FreeBSD 7.0, Linux 2.6.23, Nokia cell phones (E61, E65, E70,
E90, N95), and OpenBSD 4.2. Of course there were all manner of new
printers, cable/DSL routers, switches, enterprise routers, IP
phones, cell phones and a heap of obscure equipment such as the
BeaconMedaes medical gas alarm. Windows Vista fingerprints were
also improved significantly. Please keep those OS fingerprint
submissions and corrections coming!
o Doug integrated all of your version detection fingerprints and
corrections since October 4. The DB now has an incredible 4,542
signatures for 449 service protocols. The service protocols with
the most signatures are http (1,473), telnet (459), ftp (423), smtp
(327), pop3 (188), http-proxy (111), ssh (104), imap (103), irc (46)
and nntp (44).
o Included the netbios-smb-os-discovery.nse script which uses NetBIOS
and SMB queries to guess OS version. This script was written by
Judy Novak and contributed by Sourcefire.
o Canonicalized the interface type numbers used internally by
libdnet. Also Libdnet now recognizes devices with type
INTF_TYPE_IEEE80211 as Ethernet devices. This ought to make
wireless network scanning work on Windows Vista. For more background
see http://seclists.org/nmap-dev/2007/q4/0391.html. [David]
o Documented the "--script all" option in the man page and NSE
article. This option executes all scripts in the NSE database
regardless of category. [Fyodor]
o NSE scripts can now be specified by name without the .nse
extension. So instead of using "--script
bruteTelnet.nse,HTTPpasswd.nse,SQLInject.nse,robots.nse", you can
just pass "--script bruteTelnet,HTTPpasswd,SQLInject,robots". [Kris]
o Removed some auto-generated files from the new nselib-bin directory
as they could cause compatibility problems. Also updated
mswin32/Makefile to reflect the new nselib-bin DLL location [David]
o ripeQuery.nse was updated to avoid printing some useless
information. [Kris]
o Compatibility with systems that have the pcre.h header file in its
own pcre directory should now be fixed for real. [Fyodor]
o Enhanced the radmind service detection signature and added a
deprecated radmind port to nmap-services. [Matt Selsky]
o Zenmap now gives better errors to stdout when it can't even pop up a
dialog box (such as when PyGTK can't be loaded). [David]
o Fixed a Zenmap crash which occurred on Mac OS X and possibly other
platforms. The error message aid: "object of type
'ScanHostDetailsPage' has no len()". [David]
o Fixed a crash which occurred when an NSE script called
set_port_version() at times that version scanning was not
enabled. [Diman]
o Fixed the NSIS installer so that it does not include some excess
files (mswin32/* and .svn). Thanks to Alan Jones for reporting the
problem. [Fyodor]
o Renamed some Zenmap Python packages to allow Zenmap and Umit to be
installed at the same time. [David]
o Updated nmap-mac-prefixes with the latest IEEE data. Also added
back Cooperative Linux virtual NIC which was inadvertently removed in
a previous release. [Fyodor]
4.23RC3 [11/27/07]
o Zenmap now has a man page! It isn't very long yet, but covers the
basics. Thanks to David for writing this.
o A new NSE script, promiscuous.nse, scans devices on a local network
looking for sniffers (devices running in promiscuous mode). This
script is from Marek Majkowski and is the first to use the NSE pcap
extension system (which he also wrote). The script is only in the
discovery category for now so it does not run by default. Specify
it by name for now. We may make it default after the upcoming
stable release.
o Nmap can now handle IP aliases on Windows. A given device such as
eth0 might have several IP addresses. Nmap will use the primary
address, so you need to use -S if you want to specify a different
one. [David]
o An exception (rather than luaL_argerror) is now thrown when an SSL
connection is attempted but OpenSSL isn't available. [David]
o There is now an nmap.have_ssl NSE function so you can avoid doing
NSE probes when SSL isn't available. [David]
o Zenmap gives clearer error messages when an import error occurs or
Zenmap's dump files aren't found. [David]
o Zenmap now looks for its data files relative to the directory of the
zenmap script to allow running from the build/svn directory. [David]
o NSE C modules are now installed into an nselib-bin directory. This
was needed to make the dns-test-open-recursion and zoneTrans NSE
scripts work properly, since they use the NSE bit library
(bit.so). [Diman, Fyodor]
o Axillary autoconf scripts such as config.guess, config.sub,
depcomp, install-sh, and ltmain.sh were deleted from Nmap
subdirectories because configure is smart enough to use the ones from
the parent directory. This decreases the Nmap source tarball and svn
checkout sizes. [David]
o Nmap now compiles on systems which have the libPCRE include file in
pcre/pcre.h rather than just pcre.h. Thanks to Lionel Cons for the
report. [Fyodor]
o Nmap binary is now stripped again, but it now uses -x to avoid
stripping dynamically loaded NSE functions on Mac OS X. [David]
o Normalized Zenmap's handling of results files specified on the
command line. In some cases, Zenmap would ignore specified results
files just because some unrelated options were used. [David]
o configure.ac now uses literal directory names rather than variable
references in calls to AC_CONFIG_SUBDIRS. This removes an annoying
warning message which has existed for years when you regenerate
configure. [David]
o Fixed a configure.ac error which prevented you from specifying an
alternative libnsock directory. [David]
o Check for Python in configure only if Zenmap is requested, and bail
out if Zenmap is explicitly requested (--with-zenmap) and Python is
not available. [David]
o Removed some unimplemented Zenmap command-line options and function
calls. [David]
4.23RC2 [11/18/07]
o Static code analysis company Coverity generously offered to scan the
Nmap code base for flaws, and Kris volunteered to go through their
report and fix the ones which were actual/possible problems rather
than false positives. Their system proved quite useful, and about a
dozen potential problems were fixed. For details, see Kris'
11/15/07 SVN commits.
o Improved the Zenmap RPM file so that it should work on either Python
2.4 or Python 2.5 machines. It should also work on any platform (x86,
x86_64, etc.) [David]
o WinPcap updated from version 4.0.1 to the new 4.0.2 release. [David]
o Added PPTP version detection NSE script (PPTPversion.nse) from
Thomas Buchanan. Nmap now ships with 38 NSE scripts.
o A number of Solaris compilation fixes were added. Hopefully it
works for more Solaris users now. We also fixed an alignment issue
which could cause a bus error on Solaris. [David]
o When an NSE script changes the state of a port (e.g. from
open|filtered to open), the --reason flag is now changed to
"script-set". Also, the port state reason is now available to NSE
scripts through a "reason" element in the port-table. Thanks to
Matthew Boyle for the patch.
o When version detection changes the state of a port, the reason field
is now updated as well (to udp-response or tcp-response as
applicable). Thanks to Thomas Buchanan for the patch.
o Reworded an error message after a woman reported that it was "highly
offensive and sexist". She also noted that "times have changed and
many women now use your software" and "a sexist remark like the one
above should have no place in software." The message was: "TCP/IP
fingerprinting (for OS scan) requires root privileges. Sorry,
dude.". I checked svn blame to call out the insensitive,
chauvinistic jerk who wrote that error message, but it was me :).
o We received a bug report through Debian entitled "Nmap is a
clairvoyant" because when you run it with -v on September 1 1970, it
reports "Happy -27th Birthday to Nmap, may it live to be 73!". We
have decided that clairvoyance is a feature and ignored the report.
o We no longer strip the Nmap binary before installing it, as that was
leading to a runtime error on Mac OS X: "lazy symbol binding failed:
Symbol not found: _luaL_openlib". Unfortunately, the unstripped
Nmap binary can be much larger (e.g. 4MB vs. 800KB) so we are
working on a better fix which allows us to continue stripping the
binary on other platforms.
o Zenmap configuration/customization files renamed from ~/.umit to
~/.zenmap and umit.conf to zenmap.conf, etc. [David]
o Fixed a Zenmap bug where if you try to edit a profile and then
click cancel, that profile ends up deleted. [Luis A. Bastiao]
o The NSE shortport rules now allow for multiple matching states
(e.g. open or open|filtered) to be specified. This silently failed
before. [Eddie]
o Regenerate configure scripts with Autoconf 2.61 and update
config.guess and config.sub files with the latest versions from
http://cvs.savannah.gnu.org/viewvc/config/?root=config . [David]
4.23RC1 [11/10/07]
o NmapFE is now gone. It had a good run as the default Nmap GUI
for more than 8 years (since April 1999). But after two years of
development, Zenmap is ready to take its place. Zenmap is portable
and provides a much better interface to executing and (especially)
viewing and analyzing Nmap results. David did the honors of
removing NmapFE.
o We have lost another old friend as well: 1st generation OS
detection system. Nmap revolutionized OS detection when this was
released in October 1998 and it served us well for more than 9 years
as the database grew to 1,684 fingerprints. But the 2nd generation
system incorporates everything we learned during all those years and
has proven itself even more effective. I couldn't bear to kill this
myself, so David did the dirty work.
o There is no longer any artificial limit on the number of ports or
protocols that can be used for host discovery. Port lists for ping
scan now use the same syntax as the -p option except that T:, U:,
and P: are not allowed. This means that you can do
nmap -PS1-1000 target
nmap -PAhttp,https target
nmap -PU'[-]' target
[David]
o Zenmap is now available packaged in RPM format. Since Zenmap is
written in Python, we no longer have to have separate x86 and x86_64
versions like we did with NmapFE (and like we still do with
Nmap). [David]
o Fixed a crash (assertion failure) which could occur during ARP Ping
scan [Kris]
o Fixed Zenmap so that it can handle asterisks in the command line
(e.g. "nmap 192.168.*.*" or "nmap -phttp* localhost") [David]
o Change the Zenmap bug report dialogue to now give instructions for
reporting issues to nmap-dev. [David]
o Modified higwidgets/higdialogs.py for compatibility with old
versions of PyGTK. [David]
o Updated IANA assignment IP list for random IP (-iR)
generation. [Kris]
o Fixed a number of spelling errors in the Reference Guide (man page)
[Doug]
4.22SOC8 [10/28/07]
o Removed the old massping() system, since the functionality has now
been migrated into the existing ultra_scan() system (which is used
for port scanning too). Thanks to David for doing the migration,
which involved a lot of work and testing. The new system is
frequently faster and more accurate than massping(), and some of the
new algorithms benefit port scans too.
o Renamed Umit to Zenmap to reduce confusion between the version we
ship with Nmap as the integrated GUI and the version maintained
separately at umit.sourceforge.net. We are excited about Zenmap and
expect to remove NmapFE in the near future
o Integrated all of your Q3 service detection submissions! We have
now surpassed 4500 signatures and are approaching 500 service
protocols. Wow! Thanks to Doug for doing the integration. His
notes on the crazy and interesting services discovered this quarter
are at http://hcsw.org/blog.pl/31 .
o Added a new ping type: IPProto Ping. Use -PO (that is the letter O
as in prOtOcOl, not a zero). This is similar to protocol scan (-sO)
in that it sends IP headers with different protocols in the hope of
eliciting a response from targets. The default is to send with
protocols 1 (ICMP), 2 (IGMP), and 4 (IP-in-IP tunnel), but you can
specify different protocol numbers on the command line the same way
you specify TCP/UDP ports to -PS or -PU. To reduce confusion, we now
recommend that -PN be used when you don't want pings done rather
than using the old -P0 (zero). [Kris]
o The SMTPcommands.nse script was updated to support the HELP query in
addition to EHLO [Jason DePriest]
o Added --ttl support for connect() scans (-sT). [Kris]
o Combine the Zenmap setup scripts into one portable setup.py rather
than having separate versions for Windows, Unix, and Mac OS X.
o Removed a bunch of unnecessary/incomplete code and data files from
Zenmap. [ David]
o In Nbase, switched from GNU's getopt() replacement functions to
Ben Sittler's BSD-licensed (but GNU compatible) functions. [Kris]
o Include nmap.h in portreasons.h. This fixes a compilation problem
reported on OpenBSD. [David]
o Change PCRE from an NSELib module back to statically linked code due
to OpenBSD compilation problems. See
http://seclists.org/nmap-dev/2007/q4/0085.html [David]
o Fix a problem with --reason printing the wrong host discovery
reasons when ICMP destination unreachable packets arrived. [Kris]
o Nmap has better dependency tracking now such that it no longer
builds the executable every time you type 'make'. This was causing
problems where 'make; sudo make install' would create a root-owned
nmap executable because it was rebuilt as part of 'make
install'. [David]
4.22SOC7 [10/11/07]
o Integrated all of your OS detection new fingerprint submissions and
correction reports. The grew more DB more than 18% to 825
fingerprints. Keep those submissions coming! [David]
o Made a number of significant improvements to host discovery
algorithms for better performance and reliability. [David]
o Fixed a bug which prevented the first OS detection guess from being
included in XML output. This only applies when no exact matches
were found. Thanks to Martyn Tovey of Netcraft for reporting the
problem and helping to track it down in the code.
o Improve the script scan scheduling system to prevent the system from
running out of sockets by executing too many scripts concurrently
during large scans. Thanks to Brandon Enright for finding the bug
and Stoiko for fixing it.
o Added nmap.verbosity() and nmap.debugging() functions for scripts to
determine the Nmap verbosity/debugging level. [Kris]
o Fixed a crash (assertion error) which occurred when the first hop of
the first system (reference trace) times out. [Eddie]
o UMIT no longer rewrites a bunch of script files to replace variables
such as VERSION and REVISION in the SVN working directory. [David,
Adriano]
o UMIT icon loading code simplified and made platform
independent. [David]
o Removed PIL dependency from UMIT package generation system. We now
use GTK to put the version number in the splash screen. [Adriano]
o UMIT no longer crashes just because documentation files are
missing. [Adriano]
o Removed unnecessary recent_scans.txt and target_list.txt files from
UMIT. Some unnecessary copies of Nmap data files were removed as
well. [David, Adriano]
o Updated the *.dmp preprocessed Nmap data files used by UMIT, and
also updated the scripts used to create them. [David]
o Winpcap installer was updated so that on Windows Vista it uses a
different Packet.dll and omits WanPacket.dll. [Eddie]
o Unix installation now places NSELib dynamic libraries in 'libexec'
rather than 'share' directories, since they are architecture
dependent. Thanks to Christoph J. Thompson for the patch.
o Fix bug related to users providing custom libpcre location to
configure (reported by Daniel Johnson, fixed by Stoiko). A patch
from Marek Majkowski which caps the number of sockets opened by NSE
scripts was also applied.
o The UMIT version number is automatically updated to be the same as
the Nmap version number rather than always being 0.9.4. [David]
o UMIT now sorts port numbers numerically rather than alphabetically
[Adriano]
o Three UMIT data files (options.xml, profile_editor.xml, and
wizard.xml) are installed in the shared UMIT data directory
(e.g. /usr/share/umit/misc) rather than in every user's ~/.umit
directory. [David]
o Added HTTPtrace demo NSE script by Kris, who also updated his
HTTPpasswd script.
o A bunch of capitalization/spelling canonicalization changes were
made to Nmap output. For example: ftp to FTP and idlescan to
idle scan.
o Made some improvements to the nmap.xsl stylesheet for converting
Nmap XML results to HTML reports. It now does a better job at
removing empty sections and headers. Thanks to Henrik Lund Kramshoej
for the patch.
o Updated nmap-mac-prefixes with the latest IEEE data.
o Disabled auto-generation of libpcre/pcre_chartables.c because that
was useless for our purposes and could also cause some version
control related problems. [David]
o Updated IANA assignment IP list for random IP (-iR)
generation. [Kris]
4.22SOC6 [8/29/07]
o Included David's major massping migration project. The same
underlying engine is now uses for ping scanning as for port
scanning. We hope this will lead to better performance and
accuracy, as well as helping to de-bloat Nmap. Please test it out
and report your results to nmap-dev! For more details, see
http://seclists.org/nmap-dev/2007/q3/0277.html
o Fixed UMIT bug which occurred when installing to a non-standard
directory (e.g. a home directory). This caused Python to not be able
to find the necessary files. [Kris]
o Added an NSE script (HTTPpasswd.nse) for finding directory traversal
problems and /etc/password files on web servers. [Kris]