Nmap 5.00 Released

July 16, 2009 -- Insecure.Org is pleased to announce the immediate,free availability of the Nmap Security Scanner version 5.00fromhttps://nmap.org/. This is thefirst stable release since 4.76 (last September), and the first majorrelease since the 4.50 release in 2007. Dozens of developmentreleases led up to this.

Considering all thechanges, we considerthis the most important Nmap release since 1997, and we recommend thatall current users upgrade.

About Nmap

Nmap ("Network Mapper") is a free and open source(license) utility fornetwork exploration or security auditing. Many systems and networkadministrators also find it useful for tasks such as networkinventory, managing service upgrade schedules, and monitoring host orservice uptime. Nmap uses raw IP packets in novel ways to determinewhat hosts are available on the network, what services (applicationname and version) those hosts are offering, what operating systems(and OS versions) they are running, what type of packetfilters/firewalls are in use, and dozens of other characteristics. Itwas designed to rapidly scan large networks, but works fine againstsingle hosts. Nmap runs on all major computer operating systems, andofficial binary packages are available for Linux, Windows, and Mac OSX. In addition to the classic command-line Nmap executable, the Nmapsuite includes an advanced GUI and results viewer(Zenmap), a flexible datatransfer, redirection, and debugging tool(Ncat), and a utility forcomparing scan results (Ndiff).

Nmap was named “Security Product of the Year” by LinuxJournal, Info World, LinuxQuestions.Org, and Codetalker Digest. Itwas even featured ineightmovies, includingThe Matrix Reloaded,Die Hard 4, andThe Bourne Ultimatum.

As free software, we don't have any sort of advertising budget. So please spread the word that Nmap 5.00 is now available!

Top 5 Improvements in Nmap 5

Before we go into thedetailed changes, hereare the top 5 improvements in Nmap 5:

1. The newNcat tool aims to beyourSwissArmy Knife for data transfer, redirection, and debugging. Wereleased awholeusers' guidedetailing security testing and network administration tasks made easy with Ncat.

2. The addition of theNdiff scancomparison tool completes Nmap's growth into a whole suite ofapplications which work together to serve network administrators andsecurity practitioners. Ndiff makes it easy to automatically scanyour network daily and report on any changes (systems coming up orgoing down or changes to the software services they are running). Theother two tools now packaged with Nmap itself are Ncat andthemuch improved Zenmap GUI and resultsviewer.

3. Nmap performance hasimproveddramatically. We spent last summer scanning much of the Internetand merging that data with internal enterprise scan logs to determinethe most commonly open ports. This allows Nmap to scan fewer ports bydefault while finding more open ports. We also added a fixed-ratescan engine so you can bypass Nmap's congestion control algorithms andscan at exactly the rate (packets per second) you specify.

4. We releasedNmap NetworkScanning, the official Nmap guide to network discovery and securityscanning. From explaining port scanning basics for novices todetailing low-level packet crafting methods used by advanced hackers,this book suits all levels of security and networking professionals. A42-page reference guide documents every Nmap feature and option, whilethe rest of the book demonstrates how to apply those features toquickly solve real-world tasks. More than half the bookisavailable in the freeonline edition.

5. TheNmap ScriptingEngine (NSE) is one of Nmap's most powerful and flexiblefeatures. It allows users to write (and share) simple scripts toautomate a wide variety of networking tasks. Those scripts are thenexecuted in parallel with the speed and efficiency you expect fromNmap. All existing scripts have been improved, and 32 new ones added.New scripts include a whole bunch of MSRPC/NetBIOS attacks, queries,and vulnerability probes; open proxy detection; whois and AS numberlookup queries; brute force attack scripts against the SNMP and POP3protocols; andmany more. All NSE scriptsand modules are described in thenewNSE documentation portal.

News articles and reviews

Pleasemail Fyodor if you see (or write) reviews/articles on the Nmap 5.00 release. Here are the ones seen so far:Reasonably detailed (or with many comments) English articles:

• ITWire:Nmap Turns Five
• Slashdot:Nmap 5.00 Released, With Many Improvements
• SecurityFocus:Nmap gets a major upgrade,
• LoveMyTool:Exclusive Review of Nmap 5.0 (by Tim O'Neill)
• Reddit:Nmap 5.00 Released, considered by maintainers as most important release since 1997
• Ed Skoudis:Nmap 5.00 Initial Impressions - Niiiice!
• Hacker News:Nmap 5.00 Released
• Risky Business:Nmap Reloaded: Biggest Release Since 1997
• Linux Weekly News:Nmap 5.00 Released
• InternetNews.com:Nmap 5 improves open source network security auditing
• Michael Rash (Cipherdyne):Nmap-5.00, Zenmap, and ndiff
• IronGeek.Com added a new video:NDiff: Comparing two Nmap 5 scans to find changes in your network
• Twitter has literallythousands of tweets about 5.00 (you may need to page back to July 16).
• AllVoices:Powerful network security tool Nmap reaches version 5.00
• The H:Version 5.0 of the Nmap network scanner released
• Sans Internet Storm Center:Nmap 5.0 Released
• Linuxologist:Nmap 5.0 Released: Most Important Since 1997!

Brief mentions:Wireshark.Org,Securiteam,Dark Reading,Linux Today,CGISecurity.Com,Security4All,Help Net Security,Red Gecko,Peter Van Eeckhoutte,Security Database,Owl Linux,Priveon Labs

Non-English articles:
Arabic:Linux AC,iSecur1ty.org
Czech:ABC Linuxu,Root.cz
Chinese:Solidot,Netsecurity.51cto.com
Dutch:Tweakers.net,Security.nl
French:Silicon.fr,LinuxFR.org
German:Golem.de,Heise online,Pro-Linux.de,PC Welt,Menzer.net,Secorvo Security News (PDF)
Russian:OpenNet.ru,Xakep.ru,Linux.org.ru
Spanish:Viva Linux,Barrapunto,menéame,Linux Maya,Iniqua,A por Linux,Portal Chileno de Seguridad Informatica
Others:Version 2 (Danish),hup.hu (Hungarian),BR-Linux.Org (Portuguese),IDG.se (Swedish)

Journalists (anyone writing about the Nmap release) are welcome touse any of the text or screen shots on this page.

Example run and screen shots

Nmap 5.00 provides a wealth of information about remote systems, as shown in this sample scan:

# nmap -A -T4 scanme.nmap.org 207.68.200.30Starting Nmap 5.00 ( https://nmap.org ) at 2009-07-13 16:22 PDTInteresting ports on scanme.nmap.org (64.13.134.52):Not shown: 994 filtered portsPORT      STATE  SERVICE VERSION22/tcp    open   ssh     OpenSSH 4.3 (protocol 2.0)|  ssh-hostkey: 1024 03:5f:d3:9d:95:74:8a:d0:8d:70:17:9a:bf:93:84:13 (DSA)|_ 2048 fa:af:76:4c:b0:f4:4b:83:a4:6e:70:9f:a1:ec:51:0c (RSA)53/tcp    open   domain  ISC BIND 9.3.470/tcp    closed gopher80/tcp    open   http    Apache httpd 2.2.2 ((Fedora))|_ html-title: Go ahead and ScanMe!113/tcp   closed auth31337/tcp closed EliteDevice type: general purposeRunning: Linux 2.6.XOS details: Linux 2.6.20-1 (Fedora Core 5)Interesting ports on 207.68.200.30:Not shown: 991 filtered portsPORT      STATE SERVICE      VERSION53/tcp    open  domain       Microsoft DNS 6.0.600188/tcp    open  kerberos-sec Microsoft Windows kerberos-sec135/tcp   open  msrpc        Microsoft Windows RPC139/tcp   open  netbios-ssn389/tcp   open  ldap445/tcp   open  microsoft-ds Microsoft Windows 2003 microsoft-ds464/tcp   open  kpasswd5?49158/tcp open  ncacn_http   Microsoft Windows RPC over HTTP 1.049175/tcp open  msrpc        Microsoft Windows RPCRunning: Microsoft Windows 2008|VistaHost script results:|  smb-os-discovery: Windows Server (R) 2008 Enterprise 6001 Service Pack 1|  LAN Manager: Windows Server (R) 2008 Enterprise 6.0|  Name: MSAPPLELAB\APPLELAB2K8|_ System time: 2009-07-13 16:17:07 UTC-7|  nbstat: NetBIOS name: APPLELAB2K8, NetBIOS user:, NetBIOS MAC: 00:1a:a0:9a:a3:96|  Name: APPLELAB2K8<00>      Flags:|_ Name: MSAPPLELAB<00>       Flags:TRACEROUTE (using port 135/tcp)HOP RTT    ADDRESS[Cut first 8 lines for brevity]9   36.88  ge-10-0.hsa1.Seattle1.Level3.net (4.68.105.6)10  36.61  unknown.Level3.net (209.245.176.2)11  41.21  207.68.200.30Nmap done: 2 IP addresses (2 hosts up) scanned in 120.26 seconds# (Note: some output was modified to fit results on screen)

Here are some Nmap and Zenmap 5.00 screen shots (click thumbnails for full resolution):

Classic command-line Nmap	Zenmap's new network topology graphing mode
Zenmap showing all discovered HTTP services	Zenmap displaying Nmap output

TheNmap Changelogdescribes nearly 600 significant improvements since our last majorrelease(4.50).Here are the highlights:

TheNmap ScriptingEngine (NSE) is one of Nmap's most powerful and flexiblefeatures. It allows users to write (and share) simple scripts toautomate a wide variety of networking tasks. Those scripts are thenexecuted in parallel with the speed and efficiency you expect fromNmap. It existed in Nmap 4.50, but has been dramatically improved:

• Every script has been improved, and the number of scripts has grown nearly 50% to 59.

• Ron Bowes embarked on a massive MSRPC/NETBIOS project to allowNmap to interrogate Windows machines much more completely. He added six NSE libraries (msrpc,msrpcperformance,msrpctypes,netbios,smb, andsmbauth) and 14 scripts (p2p-conficker,smb-brute,smb-check-vulns,smb-enum-domains,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-os-discovery,smb-pwdump,smb-security-mode,smb-server-stats, andsmb-system-info). He also wrote adetailed paper on the new scripts.

• Nmap was one of the first scanners toremotely detect the Conficker worm thanks tosmb-check-vulns, andp2p-conficker.

• Other new scripts include:
  asn-query—Maps IP addresses to autonomous system (AS) numbers.
  auth-spoof—Checks for an identd (auth) server which is spoofing its replies.
  banner—A simple banner grabber which connects to an open TCP port and prints out anything sent by the listening service within five seconds.
  dns-random-srcport—Checks a DNS server for the predictable-port recursion vulnerability. Predictable source ports can make a DNS server vulnerable to cache poisoning attacks (see CVE-2008-1447).
  dns-random-txid—Checks a DNS server for the predictable-TXID DNS recursion vulnerability. Predictable TXID values can make a DNS server vulnerable to cache poisoning attacks (see CVE-2008-1447).
  ftp-bounce—Checks to see if an FTP server allows port scanning using the FTP bounce method.
  http-iis-webdav-vuln—Checks for a vulnerability in IIS 5.1/6.0 that allows arbitrary users to access secured WebDAV folders by searching for a password-protected folder and attempting to access it. This vulnerability was patched inMicrosoft Security Bulletin MS09-020.
  http-passwd—Checks if a web server is vulnerable to directory traversal by attempting to retrieve /etc/passwd using various traversal methods such as requesting ../../../../etc/passwd.
  imap-capabilities—Retrieves IMAP email server capabilities.
  mysql-info—Connects to a MySQL server and prints information such as the protocol and version numbers, thread ID, status, capabilities, and the password salt.
  pop3-brute—Tries to log into a POP3 account by guessing usernames and passwords.
  pop3-capabilities—Retrieves POP3 email server capabilities.
  rpcinfo—Connects to portmapper and fetches a list of all registered programs.
  snmp-brute—Attempts to find an SNMP community string by brute force guessing.
  socks-open-proxy—Checks if an open socks proxy is running on the target.
  upnp-info—Attempts to extract system information from the UPnP service.
  whois—Queries the WHOIS services of Regional Internet Registries (RIR) and attempts to retrieve information about the IP Address Assignment which contains the Target IP Address.

• The set of new libraries is equally impressive. Modules arealllisted here (scroll down to"Modules").

• Introduced theNSEDocumentation Portal which documents every NSE script and libraryincluded with Nmap. It is generatedfromNSEDoc commentsembedded in scripts. Scripts are available for download on this siteas well. We also dramatically improvedtheNSE Guide.

• NSE now supports run-time interaction so you know when it willcomplete, and the --host-timeout option so you can define when itcompletes. Support for -S (source IP address) and --ip-options hasbeen added to the NSE and version detection subsystems.

• Added Boolean Operators for --script. You may now use ("and","or", or "not") combined with categories, filenames, and wildcardedfilenames to match a set of files. Anewdefaultcategory includes the scripts which run by default when NSE isrequested.

• NSE can now be used in combination with ping scan (e.g. "-sP--script") so that you can execute host scripts without needing toperform a port scan.

Zenmap is across-platform (Linux, Windows, Mac OS X, etc.) Nmap GUI and resultsviewer which supports all Nmap options. It aims to make Nmap easy forbeginners to use while providing advanced features for experiencedNmap users. Frequently used scans can be saved as profiles to makethem easy to run repeatedly. A command creator allows interactivecreation of Nmap command lines. Scan results can be saved and viewedlater. Saved scan results can be compared with one another to see howthey differ. The results of recent scans are stored in a searchabledatabase. While Zenmap already existed in Nmap 4.50, it has improved dramatically since then:

• 

  While Nmap stands for “Network Mapper”, it hasn't beenable to actually draw you a map of the network—until now! ThenewZenmap NetworkTopology feature provides an interactive, animated visualizationof the hosts on a network and connections between them. The scansource is (initially) in the center, with other hosts on a series ofconcentric circles which represent the number of hops away they arefrom the source. Nodes are connected by lines representing discovered paths between them. Read the full details (and oogle the pretty pictures)in our articleonSurfing theNetwork Topology. Topology views can be saved as a PNG, postscript, PDF, or SVG image.

• Thescanaggregation feature allows you to combine the results of many Nmapscans into one view. When one scan is finished, you may start anotherin the same window. Results of the new scan are seamlessly mergedinto one view.

• Zenmap has been internationalized and translated by volunteersinto four languages (French, German, Brazilian Portuguese, andCroatian). We have instructionsonusing an existingtranslation and we're always looking for volunteerstotranslateZenmap into your native language.

• Overhauled the default list of scan profiles to provide a much more diverse and useful set of default profile options. If users don't like any of these canned scan commands, they can easily create their own in the Profile Editor.

• Added a context-sensitive help system to the Profile Editor. Mouse-over options to learn more about what they do and their argument syntax.

• Addedadvanced search functionality to Zenmap so that you can locate previous scans using criteria such as which ports were open, keywords in the target names, OS detection results, etc. Try it out with Ctrl-F or "Tools->Search Scan Results".

• The “Compare Results” feature now uses our newNdiff scan comparison tool.

• And more: An animated throbber has been added to indicate that a scan is running, and a new cancel button lets you stop a scan in its track. The Nmap output window now scrolls automatically, and ports are colored based on open/closed state.

• David wrote an exceptionalusers' guide, which also became a chapter ofNmap Network Scanning.

  .       .         \`-"'"-'/          } 6 6 {          ==. Y ,==           /^^^\  .         /     \  )       (  )-(  )/     _  -""---""---   /  /   Ncat    \_/  (     ____         \_.=|____E

Nmap 5 introducesNcat, ageneral-purpose command-line tool for reading, writing, redirecting,and encrypting data across a network. It aims to be yournetworkSwissArmy knife, handling a wide variety of security testing andadministration tasks. Ncat is suitable for interactive use or as anetwork-connected back end for other tools. Ncat can:

• Act as a simple TCP/UDP/SSL client for interacting with webservers, telnet servers, mail servers, and other TCP/IP networkservices. Often the best way to understand a service (for fixingproblems, finding security flaws, or testing custom commands) is tointeract with it using Ncat. This lets you you control every charactersent and view the raw, unfiltered responses.

• Act as a simple TCP/UDP/SSL server for offering services toclients, or simply to understand what existing clients are up to bycapturing every byte they send.

• Redirect or proxy TCP/UDP traffic to other ports or hosts. Thiscan be done using simple redirection (everything sent to a port isautomatically relayed somewhere else you specify in advance) or byacting as a SOCKS or HTTP proxy so clients specify their owndestinations. In client mode, Ncat can connect to destinations througha chain of anonymous or authenticated proxies.

• Run on all major operating systems. We distribute Linux,Windows, and Mac OS X binaries, and Ncat compiles on most othersystems. A trusted tool must be available whenever you need it, nomatter what computer you're using.

• Encrypt communication with SSL, and transport it over IPv4 orIPv6.

• Act as a network gateway for execution of system commands, withI/O redirected to the network. It was designed to work like the Unixutility cat, but for the network.

• Act as a connection broker, allowing two (or far more) clientsto connect to each other through a third (brokering) server. Thisenables multiple machines hidden behind NAT gateways to communicatewith each other, and also enables the simple Ncat chat mode.

These capabilities become even more powerful and versatile when combined.

Ncat is our modern reinvention of the venerable Netcat (nc) toolreleased by Hobbit in 1996. While Ncat is similar to Netcat in spirit,they don't share any source code. Instead, Ncat makes use of Nmap'swell optimized and tested networking libraries. Compatibility with theoriginal Netcat and some well known variants is maintained where itdoesn't conflict with Ncat's enhancements or cause usabilityproblems. Ncat adds many capabilities not found in Hobbit's originalnc, including SSL support, proxy connections, IPv6, and connectionbrokering. The original nc contained a simple port scanner, but weomitted that from Ncat because we have a preferred tool for thatfunction.

Ncat is extensively documented initsUsers'Guide,man page,andhome page.

Nmap has been doing host discovery and port scanning since its release in '97, but we continue to improve this core functionality. We've added many new features and dramatically improved performance! Here are the biggest enhancements since 4.50:

• Nmap now scans the most common 1,000 ports by default in either protocol (UDP scan is still optional). These were determined by spending months scanning tens of millions of IPs on the Internet. This makes Nmap faster (used to scan 1,715 TCP ports by default) and yet more comprehensive since the smaller number of ports are better chosen.

• Nmap fast scan (-F) now scans the top 100 ports by default ineither protocol. This is a decrease from 1,276 (TCP) and 1,017 (UDP)in Nmap 4.68. Port scanning time with -F is generally an order ofmagnitude faster than before, making -F worthy of its "fast scan"moniker.

• The --top-ports option lets you specify the number of ports youwish to scan in each protocol, and will pick the most popular portsfor you based on the new frequency data. For both TCP and UDP, thetop 10 ports gets you roughly half of the open ports. The top 1,000(out of 65,536 possible) finds roughly 93% of the open TCP ports andmore than 95% of the open UDP ports.

• Added a new --min-rate option that allows specifying a minimumrate at which to send packets. This allows you to override Nmap'scongestion control algorithms and request that Nmap try to keep atleast the rate you specify. A complementary --max-rate option wasadded as well. Theyaredocumentedhere.

• AddedSCTP port scanning support to Nmap. Stream control transmission protocol is a layer 4 protocol used mostly for telephony related applications. This brings the following new features:

  • SCTP INIT chunk port scan (-sY): open ports return an INIT-ACK chunk, closed ones an ABORT chunk. This is the SCTP equivalent of a TCP SYN stealth scan.
  • SCTP COOKIE-ECHO chunk port scan (-sZ): open ports are silent, closed ports return an ABORT chunk.
  • SCTP-specific IP protocol scan (-sO -p sctp).
  • SCTP-specific traceroute support (--traceroute).
  • The serverscanme.csnc.chhasbeen set up for your SCTP scan testing pleasure. But note thatSCTP doesn't pass through most NAT devices.

• David spent more than a month on algorithms to improve port scan performance while retaining or improving accuracy. The changes,described here, reduce our "benchmark scan time" (which involves many different scan types from many source networks to many targets) from 1879 seconds to 1321 without harming accuracy. That is a 30% time reduction! Fyodor made a number of performance improvements as well.

• The host discovery (ping probe) defaults have been enhanced to include twice as many probes. The default is now "-PE -PS443 -PA80 -PP". In exhaustive testing of 90 different probes, this emerged as the best four-probe combination, finding 14% more Internet hosts than the previous default, "-PE -PA80". The default for non-root users is -PS80,443, replacing the previous default of -PS80. In addition, ping probes are now sent in order of effectiveness (-PE first) so that less effective probes may not have to be sent. ARP ping is still the default on local ethernet networks.

• Fixed an integer overflow which prevented a target specification of "*.*.*.*" from working. Support for the CIDR /0 is now also available for those times you wish to scan the entire Internet.

• When Nmap finds a probe during ping scan which elicits aresponse, it now saves that information for the port scan and laterphases. It can then "ping" the host with that probe as necessary tocollect timing information even if the host is not responding to thenormal port scan packets. Previously, Nmap's port scan timing pingscould only use information gathered during that port scan itself. Anumber of other "port scan ping" system improvements were made at thesame time to improve performance against firewalled hosts(fulldetails).

Fyodor releasedNmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning. From explaining port scanning basics for novices to detailing low-level packet crafting methods used by advanced hackers, this book suits all levels of security and networking professionals. A 42-page reference guide documents every Nmap feature and option, while the rest of the book demonstrates how to apply those features to quickly solve real-world tasks. It was briefly the #1 selling computer book on Amazon. More than half of the book is alreadyfree online.

A German translationis available from Open Source Press; Korean and Brazilian Portuguese translations areforthcoming.

Thanks to fingerprint submissions from thousands of Nmap usersaround the world, the2ndgeneration OS detection database has nearly doubled in size since4.50 to 2,003 entries. These include the latest versions of Windows,Linux, and Mac OS X as well as more specialized entries such asoscilloscopes, ATM machines, employee timeclocks, DVRs, game consoles,and much more. Keep those submissions coming!

In addition to doubling the database size, we enhanced the OSdetection engine and its tests to improve accuracy. For example, weadded a new SEQ.CI test (IP ID sequence generation from closed TCPport) and removed the U1.RUL, U1.TOS, IE.DLI, IE.SI, and IE.TOSItests.

Nmap'sversion detectionsystem interrogates open ports to determine what service(e.g. http, smtp) is running and often the exact application name andversion number. The version detection database grew by nearly athousand signatures. It grew from 4,558 signatures representing 449protocols in Nmap 4.50 to 5,512 signatures for 511 protocols in5.00. You can read about Doug's signature creationadventureshere,here,andhere. The serviceprotocols with the most signatures are http (1,868), telnet (584), ftp(506), smtp (363), pop3 (209), http-proxy (136), ssh (123), imap(122), and irc (48). Among the protocols with just one signaturearenetrek,gopher-proxy,ncat-chat,andmetasploit.

The new Ndiff utility compares the results of two Nmap scans and describes the new/removed hosts, newly open/closed ports, changed operating systems, or application versions, etc. This makes it trivial to scan your networks on a regular basis and create a report (XML or text format) on all the changes. See the Ndiffman page andhome page for more information. Ndiff is included in our binary packages and built by default, though you can prevent it from being built by specifying the --without-ndiff configure flag.

Here are excerpts from an Ndiff comparison between two scans for theFacebook network:

> ndiff -v facebook-vscan-1237136401.xml facebook-vscan-1237395601.xml-Nmap 4.85BETA3 at 2009-03-15 10:00+Nmap 4.85BETA4 at 2009-03-18 10:00+arborvip.tfbnw.net (69.63.179.23):+Host is up.+Not shown: 100 filtered ports www2.02.07.facebook.com (69.63.180.12): Host is up. Not shown: 98 filtered ports PORT    STATE SERVICE  VERSION-80/tcp  open  http     Apache httpd 1.3.41.fb2+80/tcp  open  http     Apache httpd 1.3.41.fb1 443/tcp open  ssl/http Apache httpd 1.3.41.fb2

And here is a trivialcron script demonstrating how easy it is to scan a network daily and mail yourself the changes (and full results in this case):

#!/bin/shdate=`date "+%s"`cd /hack/facebook/scripts/nmap -T4 -F -sV -O --osscan-limit --osscanguess -oA facebook-${date} [netblocks] > /dev/nullndiff facebook-old.xml facebook-${date}.xml > facebook-diff-${date}cp facebook-${date}.xml facebook-old.xmlecho "\n********** NDIFF RESULTS **********\n"cat facebook-vscan-diff-${date}echo "\n********** SCAN RESULTS **********\n"cat facebook-vscan-${date}.nmap

You could do a similar thing using Windows'scheduled tasks.

IronGeek has created anNdiff 5 introductory video demonstrating command-line Ndiff plus its use withinZenmap.

WhileNmap Network Scanning maybe the most exciting documentation news for this release, we did makemany other important web site and documentation changes:

• Added German and Russian translations oftheNmap Reference Guide (ManPage). You can choose from all 16 available languages fromtheNmap docs page.

• Nmap has moved. Everything at http://insecure.org/nmap/ can now be found at https://nmap.org . That should save your fingers from a little bit of typing.

• A copy of the Nmap public svn repository (/nmap, plus its zenmap, nsock, nbase, and ncat externals) is now available at https://nmap.org/svn/. We update this regularly, but it may be slightly behind the SVN version. It is particularly useful when you need to link to files in the tree, since browsers generally don't handle svn:// repository links.

Nmap's dramatic improvements are of little value if it doesn't runon your system. Fortunately, portability has always been a highpriority. Nmap 5.00 runs on all major operating systems, plus theAmiga. Portability improvements in this release include:

• A Mac OS X Nmap/Zenmap installer is now available from the Nmapdownload page. It is rather straightforward,butdetailedinstructions are available anyway. As a universal installer, itworks on both Intel and PPC Macs. It is distributed as a disk imagefile (.dmg) containing an mpkg package. The installed Nmap includeOpenSSL support and also supports Authorization Services so thatZenmap can run as root when necessary.

• Nmap's special WinPcap installer now handles 64-bit Windowsmachines by installing the proper 64-bit npf.sys.

• The Nmap installer was updated to handle the Windows 7 release candidate.

• The Windows version of Nmap (both .zip and executableinstaller) now supports OpenSSL, as do the Linux RPM binaries wedistribute. The UNIX source tarball has supported OpenSSL for years.

• We now compile in IPv6 support on Windows. In order to usethis, you need to have IPv6 set up. It is installed by default onVista, but mustbemanually installed for XP.

• The compile-time Nmap ASCII dragon is now more ferocious thanks to better teeth alignment:

    (  )   /\   _                 (         \ |  (  \ ( \.(               )                      _____  \  \ \  `  `   ) \             (  ___                 / _   \ (_`    \+   . x  ( .\            \/   \____-----------/ (o)   \_- .-               \+  ;          (  O                           \____                          )        \_____________  `              \  /(__                +- .( -'.-<. - _  VVVVVVV VV V\                \/(_____            ._._:<_ -<- _  (--_AAAAAAA__A_/                |  .    /./.+-  . .- /  +--  - .     \______________//_              \_______  (__ ' /x  / x _/ (                                  \___'          \     / , x / ( '  . / .  /                                      |           \   /    /  /  _/ /    +                                      /              \/   '  (__/                                             /                  \             NMAP IS A POWERFUL TOOL -- USE CAREFULLY AND RESPONSIBLY

• The new --stats-every option takes a time interval thatcontrols how often timing status updates are printed. It is usefulwhen Nmap is run by another program as a subprocess, or if you justlike frequent timing updates.

• Completion time estimates provided in verbose mode or when you hit akey during scanning are now more accurate.

• The nmap-dev and nmap-hackers mailing list RSS feeds atSecLists.Org now include message excerpts to make it easier to identify interesting messages and speed the process of reading through the list. Feeds for all other mailing lists archived at SecLists.Org have been similarly augmented (details).

• Fixed an integer overflow in the scan progress meter. As anNmap user, few things are more discouraging than seeing your estimatedcompletion time rise so high that it goes negative.

• Nmap's output options (-oA, -oX, etc.) now supportstrftime()-like conversions in the filename. %H, %M, %S, %m, %d, %y,and %Y are all the same as in strftime(). %T is the same as %H%M%S,%R is the same as %H%M, and %D is the same as %m%d%y. So means that"-oX 'scan-%T-%D.xml'" uses an XML file in the form of"scan-144840-121307.xml".

• Removed Brazilian poetry/lyrics from Zenmap source code (NmapOutputViewer.py). We've seen enough of it in the debug logs. "E nao se entrega, nao". We also removed a code comment which declared /*WANKER ALERT!*/ for no good reason.

• Nmap and Nmap-WinPcap silent installation now works on Windows. Nmap can be silently installed with the /S option to the installer. If you install Nmap from the zip file, you can install just WinPcap silently with the /S option to that installer.

• --traceroute is now faster and more effective because it uses the timing ping probe saved from host discovery and port scanning. The timing ping probe is always the best probe Nmap knows about for eliciting a response from a target.

• We now have apublicTODO list describing our future plans and tasks which need work.

• Google sponsored 6 college/grad students for Summer of Code 2009.They and their ongoing projectsareintroducedhere.

• Nmap now builds withthe_FORTIFY_SOURCE=2define. With modern versions of GCC, this adds extra buffer overflowprotection and other security checks.

• Nmap was discovered in its eighth movie. In the Russian film Khottabych, teenage hacker Gena uses Nmap (and telnet) to hack Microsoft. In response, MS sends a pretty female hacker to flush him out (more details and screen shots).

• To better support users with attention deficit disorder, we created anNmap Twitter feed. We still recommend that all users subscribe to the low-trafficnmap-hackers announcement mailing list.

• Nmap won LinuxQuestions.Org Network Security Application of the Year for thesixth year in a row.

• These release notes mostly discuss new features, but we alsomade many performance enhancements and fixed a large number of bugswhich could lead to crashes, compilation failures, or othermisbehavior.

These are just highlights from the full list of changes you canfind inour CHANGELOG.

Moving Forward

With this stable version out of the way, we are diving headfirstinto the next development cycle. Many exciting features are in thequeue, including:

• Ncrack, a high speed network authentication cracker
• Nping, a raw packet network probing tool
• High speed port scanning through http or socks proxies (or chains of proxies)
• NSE scripts for web application fingerprinting, HTTP spidering, and whatever else developers think up.
• We're working a new survey to redo our top security tools list atSecTools.Org. We have other web projects in mind as well.

You can read more of our short-term and longer-term plans fromourpublic TODO list.

For the latest Insecure.Org and Nmap announcements, join the68,000-member Nmap-hackers announcement list. Traffic rarelyexceeds one message per month.subscribe hereorread the archives at SecLists.Org. To participate in Nmapdevelopment, join the (high traffic)nmap-dev list. You can alsofollow us on Twitter.

Acknowledgments

A free open source scanner as powerful as Nmap is only possiblethanks to the help of hundreds of developers and other contributors.We would like to acknowledge and thank the many people who contributedideas and/or code since Nmap 4.50. Special thanks go out to:

4N9e Gutek,Aaron Leininger,Adriano Monteiro Marques,Allison Randal,Andrew J. Bennieston,Andy Lutomirski,Angico,Arturo Buanzo,Arturo Buanzo Busleiman,Benson Kalahar,Bill Pollock,Brandon Enright,Brian Hatch,Busleiman,Chad Loder,Chris Clements,Chris Gibson,Chris Leick,,Daniel Roethlisberger,David Fifield,David Moore,Diman Todorov,Diman Todorov,,Dinu Gherman,Doug Hoyte,Dragos Ruiu,Dudi Itzhakov,Eddie Bell,Emma Jane Hogbin,Fabio Pedretti,Felix Leder,Gisle Vanem,Gisle Vanem,,Guilherme Polo,Guz Alexander,HD Moore,Henri Doreau,Henri Doreau,,Henry Gebhardt,Ithilgore,Jabra,Jah,James Messer,Jason DePriest,Jeff Nathan,Jesse Burns,Joao Correa,Joao Medeiros,Josh Marlow,Jurand Nogiec,Kris Katterjohn,Lamont Jones,Lance Spitzner,Leslie Hawthorn,Lionel Cons,Marius Sturm,Martin Macok,Matt Selsky,Max Schubert,Michael Pattrick,Michal Januszewski,Mike Frysinger,Mixter,Nathan Bills,Patrick Donnelly,Philip Pickering,Pieter Bowman,Rainer Müller,Raven Alder,Robert Mead,Rob Nicholls,Ron Bowes,Sebastián García,Simple Nomad,Solar Designer,Stephan Fijneman,Steve Christensen,Sven Klemm,Tedi Heriyanto,Thomas Buchanan,Thorsten Holz,Tillmann Werner,Tim Adam,Tom Duffy,Tom Sellers,Trevor Bain,Tyler Reguly,Valerie Aurora,van Hauser,Venkat Sanaka,Vlad Alexa,Vladimir Mitrovic,Vlatko Kosturjak,Will Cladek,William McVey,Zhao Lei

We would also like to thank the thousands of people whohave submitted OS and service/version fingerprints, as well aseveryone who has found and reported bugs or suggested features.

Download and Updates

Nmap is available for download fromhttps://nmap.org/download.htmlin source and binary form. Nmap is free, open source software (license).

To learn about Nmap announcements as they happen, subscribe to nmap-hackers!It is a very low volume (7 messages in 2008),moderated list for announcements about Nmap, Insecure.org, and relatedprojects. You can join the 65,000 current subscribers by submittingyour e-mail address here:

Nmap-hackers is archived atSeclists.org and has anRSS feed. You can also follow theNmap Twitter feed.

Brandon Enright andUCSD havegenerously mirrored the Nmap binaries to handle the deluge of trafficexpected as users download this release.

Direct questions or comments to Fyodor(fyodor@nmap.org) .Report any bugsasdescribed here.