# Nmap Changelog ($Id: CHANGELOG 35510 2015-12-09 19:54:03Z dmiller $); -*-text-*-

Nmap 7.01 [2015-12-09]

o Switch to using gtk-mac-bundler and jhbuild for building the OS X installer.
  This promises to reduce a lot of the problems we've had with local paths and
  dependencies using the py2app and macports build system. [Daniel Miller]

o The Windows installer is now built with NSIS 2.47 which features LoadLibrary
  security hardening to prevent DLL hijacking and other unsafe use of temporary
  directories. Thanks to Stefan Kanthak for reporting the issue to NSIS and to
  us and the many other projects that use it.

o Updated the OpenSSL shipped with our binary builds (Windows, OS X, and RPM)
  to 1.0.2e.

o [Zenmap] [GH#235] Fix several failures to launch Zenmap on OS X. The new
  build process eliminates these errors:
    IOError: [Errno 2] No such file or directory: '/Applications/Zenmap.app/Contents/Resources/etc/pango/pangorc.in'
    LSOpenURLsWithRole() failed for the application /Applications/Zenmap.app with error -10810.

o [NSE] [GH#254] Update the TLSSessionRequest probe in ssl-enum-ciphers to
  match the one in nmap-service-probes, which was fixed previously to correct a
  length calculation error. [Daniel Miller]

o [NSE] [GH#251] Correct false positives and unexpected behavior in http-*
  scripts which used http.identify_404 to determine when a file was not found
  on the target. The function was following redirects, which could be an
  indication of a soft-404 response. [Tom Sellers]

o [NSE] [GH#241] Fix a false-positive in hnap-info when the target responds
  with 200 OK to any request. [Tom Sellers]

o [NSE] [GH#244] Fix an error response in xmlrpc-methods when run against a
  non-HTTP service. The expected behavior is no output. [Niklaus Schiess]

o [NSE] Fix SSN validation function in http-grep, reported by Bruce Barnett.

Nmap 7.00 [2015-11-19]

o This is the most important release since Nmap 6.00 back in May 2012!
  For a list of the most significant improvements and new features,
  see the announcement at: https://nmap.org/7

o [NSE] Added 6 NSE scripts from 6 authors, bringing the total up to 515!
  They are all listed at https://nmap.org/nsedoc/, and the summaries are below
  (authors are listed in brackets):

  + targets-xml extracts target addresses from previous Nmap XML results files.
    [Daniel Miller]

  + [GH#232] ssl-dh-params checks for problems with weak, non-safe, and
    export-grade Diffie-Hellman parameters in TLS handshakes. This includes the
    LOGJAM vulnerability (CVE-2015-4000). [Jacob Gajek]

  + nje-node-brute does brute-forcing of z/OS JES Network Job Entry node names.
    [Soldier of Fortran]

  + ip-https-discover detectings support for Microsoft's IP over HTTPS
    tunneling protocol. [Niklaus Schiess]

  + [GH#165] broadcast-sonicwall-discover detects and extracts information from
    SonicWall firewalls. [Raphael Hoegger]

  + [GH#38] http-vuln-cve2014-8877 checks for and optionally exploits a
    vulnerability in CM Download Manager plugin for Wordpress. [Mariusz Ziulek]

o [Ncat] [GH#151] [GH#142] New option --no-shutdown prevents Ncat from shutting
  down when it reads EOF on stdin. This is the same as traditional netcat's
  "-d" option. [Adam Saponara]

o [NSE] [GH#229] Improve parsing in http.lua for multiple Set-Cookie headers in
  a single response.  [nnposter]

Nmap 6.49BETA6 [2015-11-03]

o Integrated all of your IPv6 OS fingerprint submissions from April to October
  (only 9 of them!). We are steadily improving the IPv6 database, but we need
  your submissions. The classifier added 3 new groups, bringing the new total
  to 93. Highlights: http://seclists.org/nmap-dev/2015/q4/61 [Daniel Miller]

o Integrated all of your IPv4 OS fingerprint submissions from February to
  October (1065 of them). Added 219 fingerprints, bringing the new total to
  4985. Additions include Linux 4.1, Windows 10, OS X 10.11, iOS 9, FreeBSD
  11.0, Android 5.1, and more. Highlights:
  http://seclists.org/nmap-dev/2015/q4/60 [Daniel Miller]

o Integrated all of your service/version detection fingerprints submitted from
  February to October (800+ of them). The signature count went up 2.5% to
  10293. We now detect 1089 protocols, from afp, bitcoin, and caldav to
  xml-rpc, yiff, and zebra. Highlights: http://seclists.org/nmap-dev/2015/q4/62
  [Daniel Miller]

o [NSE] Added 10 NSE scripts from 5 authors, bringing the total up to 509!
  They are all listed at http://nmap.org/nsedoc/, and the summaries are below
  (authors are listed in brackets):

  + knx-gateway-discover and knx-gateway-info scripts gather information from
    multicast and unicast KNX gateways, which connect home automation systems
    to IP networks. [Niklaus Schiess, Dominik Schneider]

  + http-ls parses web server directory index pages with optional recursion.
    [Pierre Lalet]

  + xmlrpc-methods perfoms introspection of xmlrpc services and lists methods
    and their descriptions. [Gyanendra Mishra]

  + http-fetch can be used like wget or curl to fetch all files, specific
    filenames, or files that match a given pattern. [Gyanendra Mishra]

  + http-svn-enum enumerates users of a Subversion repository by examining
    commit logs. [Gyanendra Mishra]

  + http-svn-info requests information from a Subversion repository, similar to
    the "svn info" command. [Gyanendra Mishra]

  + hnap-info detects and outputs info for Home Network Administration Protocol
    devices. [Gyanendra Mishra]

  + http-webdav-scan detects WebDAV servers and reports allowed methods and
    directory listing. [Gyanendra Mishra]

  + tor-consensus-checker checks the target's address with the Tor directory
    authorities to determine if a target is a known Tor node. [Jiayi Ye]

o [NSE] Several scripts have been split, combined, or renamed:

  + [GH#171] smb-check-vulns has been split into:
    * smb-vuln-conficker
    * smb-vuln-cve2009-3103
    * smb-vuln-ms06-025
    * smb-vuln-ms07-029
    * smb-vuln-regsvc-dos
    * smb-vuln-ms08-067
    The scripts now use the vulns library, and the "unsafe" script-arg has been
    replaced by putting the scripts into the "dos" category. [Paulino Calderon] 

  + http-email-harvest was removed, as the new http-grep does email address
    scraping by default. [Gyanendra Mishra]

  + http-drupal-modules was renamed to http-drupal-enum. Extended to enumerate
    both themes and modules of Drupal installaions. [Gyanendra Mishra]

o [Ncat] [GH#193] Fix Ncat listen mode over Unix sockets (named pipes) on OS X.
  This was crashing with the error:
    Ncat: getnameinfo failed: Undefined error: 0 QUITTING.
  Fixed by forcing the name to "localhost" [Michael Wallner]

o [Zenmap] Fix a crash in Zenmap when using Compare Results:
    AttributeError: 'NoneType' object has no attribute 'get_nmap_output'
  [Daniel Miller]

o [NSE] [GH#194] Add support for reading fragmented TLS messages to
  ssl-enum-ciphers. [Jacob Gajek]

o [GH#51] Added IPv6 support to nmap_mass_rdns, improved reverse DNS cache,
  and refactored DNS code to improve readability and
  extensibility. All in all, this makes the rDNS portion of IPv6 scans
  much faster. [Gioacchino Mazzurco]

o [NSE] Added NTLM brute support to http-brute. [Gyanendra Mishra]

o [NSE] Added NTLM authentication support to http.lua and a related function to create
  an ntlm v2 session response in smbauth.lua. [Gyanendra Mishra]

o [NSE] [GH#106] Added a new NSE module, ls.lua, for accumulating and
  outputting file and directory listings. The afp-ls, nfs-ls, and smb-ls
  scripts have been converted to use this module. [Pierre Lalet]

o [NSE] bacnet-info.nse and s7-info.nse were added to the version category.
  [Paulino Calderon] 

o [NSE] Added 124 new identifiers to bacnet-info.nse vendor database.
  [Paulino Calderon] 

o [NSE] Fixed bacnet-info.nse to bind to the service port detected 
  during scan instead of fixed port. [Paulino Calderon] 

o [NSE] Enhanced reporting of elliptic curve names and strengths in
  ssl-enum-ciphers. The name of the curve is now reported instead of just "ec"
  [Brandon Paulsen]

o [GH#75] Normalize Makefile targets to use the same verb-project format, e.g.
  build-ncat, check-zenmap, install-nping, clean-nsock [Gioacchino Mazzurco]

o [NSE] Added builtin pattern and multiple pattern search to http-grep. [Gyanendra Mishra]

o [NSE] http-crossdomainxml is now http-cross-domain-policy and supports client
  access policies and uses the new SLAXML parser. [Gyanendra Mishra]

o [NSE] Added a patch for vulns lib that allows list of tables to be submitted
  to fields in the vulns report. [Jacob Gajek]

o [NSE] Added additional checks for successful PUT request in http-put.
  [Oleg Mitrofanov]

o [NSE] Added an update for http-methods that checks all possible methods not in
  Allow or Public header of OPTIONS response. [Gyanendra Mishra]

o [NSE] Added SLAXML, an XML parser in Lua originally written by Gavin Kistner
  (a.k.a. Phrogz). [Gyanendra Mishra]

o [NSE] [GH#122] Update the snmp-brute and other snmp-* scripts to use the
  creds library to store brute-forced snmp community strings. This allows Nmap
  to use the correct brute-forced string for each host. [Gioacchino Mazzurco]

o Several improvements to TLS/SSL detection in nmap-service-probes. A new
  probe, TLSSessionReq, and improvements to default SSL ports should help speed
  up -sV scans. http://seclists.org/nmap-dev/2015/q2/17 [Daniel Miller]

o [Nsock] Clean up the API so that nsp_* calls are now nsock_pool_* and nsi_*
  are nsock_iod_*. Simplify Nsock SSL init API, and make logging global to the
  library instead of associated with a nspool. [Henri Doreau]

o [GH#181] The configure script now prints a summary of configured options.
  Most importantly, it warns if OpenSSL was not found, since most users will
  want this library compiled in. [Gioacchino Mazzurco]

o Define TCP Options for SYN scan in nmap.h instead of literally throughout.
  This string is used by p0f and other IDS to detect Nmap scans, so having it a
  compile-time option is a step towards better evasion. [Daniel Miller]

o [GH#51] Nmap's parallel reverse-DNS resolver now handles IPv6 addresses. This
  should result in faster -6 scans. The old behavior is available with
  --system-dns. [Gioacchino Mazzurco]

o [NSE] Fix a couple odd bugs in NSE command-line parsing. Most notably,
  --script broadcast-* will now work (generally, wildcards with scripts whose
  name begins with a category name were not working properly). [Daniel Miller]

o [NSE] [GH#113] http-form-fuzzer will now stop increasing the size of a
  request when an HTTP 413 or 414 error indicates the web server will not
  accept a larger request. [Gioacchino Mazzurco]

o [NSE] [GH#159] Add the ability to tag credentials in the creds library with
  freeform text for easy retrieval. This gives necessary granularity to track
  credentials to multiple web apps on a single host+port. [Gioacchino Mazzurco]

Nmap 6.49BETA5 [2015-09-25]

o Work around a bug which could cause Nmap to hang when running
  multiple instances at once on Windows. The actual bug appears to be
  in the WinPCAP driver in that it hanges when accessed via
  OpenServiceA by multiple processes at once. So for now we have added
  a mutex to prevent even multiple Nmap processes from making
  concurrent calls to this part of WinPcap. We've received the reports
  from multiple users on Windows 8.1 and Windows Server 2012 R2 and
  this fix seems to resolve the hang for them. [Daniel Miller]

o [GH#212][NSE] Fix http.get_url function which was wrongly attempting
  non-SSL HTTP requests first when passed https URLs. [jah]

o [GH#201] Fix Ndiff interpreter path problems in the OS X .dmg
  installer which could prevent Ndiff (and the related Zenmap "compare
  results" window) from working on OS X in some cases. [Daniel Miller]

o Fix Nmap's DTD, which did not recognize that the script element
  could contain character data when a script returns a number or a
  boolean.  [Jonathan Daugherty]

o [GH#172][NSE] Fix reporting of DH parameter sizes by
  ssl-enum-ciphers. The number shown was the length in bytes, not bits
  as it should have been.  Reported by Michael Staruch. [Brandon
  Paulsen]

o Our Windows Nmap packages are now compiled with the older platform
  toolset (v120_xp rather than v120) and so they may work with Windows
  XP again for the dwindling number of users still on that operating
  system.

o [GH#34] Disable TPACKET_V3 in our included libpcap. This version of
  the Linux kernel packet ring API has problems that result in lots of
  lost packets. This patch falls back to TPACKET_V2 or earlier
  versions if available. [nnposter]

o [NSE] Check for socket errors in iscsi.lua. This was causing the
  iscsi-info script to crash against some services. [Daniel Miller]

o [NSE] Fix http-useragent-tester, which was using cached HTTP
  responses instead of testing new User-Agent strings. [Daniel Miller]

o Output a warning when deprecated options are used, and suggest the
  preferred option. Currently deprecated: -i -o -m -sP -P0 -PN -oM
  -sR. The warning is only visible with -v. [Daniel Miller]

o Add a fatal error for options like -oG- which is interpreted as the
  deprecated -o option, outputting to a file named "G-", instead of
  the expected behavior of -oG - (Grepable output to stdout). [Daniel
  Miller]

o [GH#196] Fix raw packet sending on FreeBSD 10.0 and later. FreeBSD
  changed byte order of the IPv4 stack, so SYN scan and other raw
  packet functions were broken. [Edward Napierała] Also reported in
  [GH#50] by Olli Hauer.

o [GH#183] Fix compilation on Visual Studio 2010, which failed with
  error: "service_scan.cc(2559): error C2065: 'EOPNOTSUPP' :
  undeclared identifier" [Daniel Miller]

o [GH#115][NSE] ssl-enum-ciphers will still produce output if OpenSSL
  (required for certificate parsing) is not available. In cases where
  handshake strength depends on the certificate, it will be reported
  as "unknown". [jrchamp]

Nmap 6.49BETA4 [2015-07-06]

o Fix a hang on OS X in Zenmap's Topology page with error
  "zenmap_wrapper.py[857]: GError: Couldn't recognize the image file format for
  file '/Applications/Zenmap.app/Contents/MacOS/../Resources/share/zenmap/pixmaps/radialnet/padlock.png'
  http://seclists.org/nmap-dev/2015/q3/8 [Daniel Miller]

o Fix a small memory leak for each target specified as a hostname which fails
  to resolve. [Daniel Miller]

o Allow 'make check' to succeed when Nmap is configured without OpenSSL
  support. This was broken due to our NSE unittest library expecting to be able
  to load every library without error. [Daniel Miller]

o [NSE] Enable ssl-enum-ciphers to safely scan servers with a long handshake
  intolerance issue which resulted in incomplete results when the handshake was
  greater than 255 bytes. [Jacob Gajek, Daniel Miller]

o [Ncat] Fix a write overrun in Ncat that could cause a segfault if the -g
  (source route) option was given too many times. [Daniel Miller]

o [NSE] [GH#168] Allow ssl-enum-ciphers to run on non-typical ports when it is
  selected by name. It will now send a service detection probe if the port is
  not a typical SSL port and version scan (-sV) was not used. [Daniel Miller]

Nmap 6.49BETA3 [2015-06-25]

o [GH#166] Fix Ncat listen mode on Solaris and other platforms where struct sockaddr
  does not have a sa_len member. This also affected use of the -p and -s
  options. Brandon Haberfeld reported the crash. [Daniel Miller]

o [GH#164] Fix a Zenmap failure ot open on OS X with the error:
  "dyld: Symbol not found: _iconv Referenced from: /usr/lib/libcups.2.dylib"
  We had to remove the DYLD_LIBRARY_PATH environment variable from
  zenmap_wrapper.py. Reported by Robert Strom. [Daniel Miller]

o Report our https URL (https://nmap.org) in more places rather than
  our non-SSL one. [David Fifield]

o [NSE] Fix Diffie-Hellman parameter extraction in tls.lua. [Jacob Gajek]

Nmap 6.49BETA2 [2015-06-16]

o [GH#154] Fix a crash (assertion error) when Nmap recieves an ICMP Host
  Unreachable message.

o [GH#158] Fix a configure failure when Python is not present, but no Python
  projects were requested. [Gioacchino Mazzurco]

o [GH#161] [Zenmap] Fix Zenmap on OS X which was failing with
  zipimport.ZipImportError due to architecture mismatch.

o [NSE] Remove ahbl.org checks from dnsbl.lua, since the service was shut down.
  [Forrest B.]

Nmap 6.49BETA1 [2015-06-03]

o Integrated all of your IPv4 OS fingerprint submissions from May 2014 to
  February 2015 (1900+ of them). Added 281 fingerprints, bringing the new total
  to 4766. Addtions include Linux 3.18, Windows 8.1, OS X 10.10, Android 5.0,
  FreeBSD 10.1, OpenBSD 5.6, and more. Highlights:
  http://seclists.org/nmap-dev/2015/q2/169 [Daniel Miller]

o Integrated all of your service/version detection fingerprints submitted from
  June 2013 to February 2015 (2500+ of them). The signature count soared over
  the 10000 mark, a 12% increase. We now detect 1062 protocols, from http,
  telnet, and ftp to jute, bgp, and slurm. Highlights:
  http://seclists.org/nmap-dev/2015/q2/171 [Daniel Miller]

o Integrated all of your IPv6 OS fingerprint submissions from June 2013 to
  April 2015 (only 97 of them!). We are steadily improving the IPv6 database,
  but we need your submissions. The classifier added 9 new groups, bringing the
  new total to 90. Highlights: http://seclists.org/nmap-dev/2015/q2/170 [Daniel
  Miller]

o Nmap now has an official bug tracker! We are using Github Issues, which you
  can reach from http://issues.nmap.org/. We welcome your bug reports,
  enhancement requests, and code submissions via the Issues and Pull Request
  features of Github (https://github.com/nmap/nmap), though the repository
  itself is just a mirror of our authoritative Subversion repository.

o [Zenmap] New Chinese-language (zh) translation from Jie Jiang, new Hindi (hi)
  translation by Gyanendra Mishra, and updated translations for German (de,
  Chris Leick), Italian (it, Jan Reister), Polish (pl, Jacek Wielemborek), and
  French (fr, MaZ)

o Added options --data <hex string> and --data-string <string> to send custom
  payloads in scan packet data. [Jay Bosamiya]

o --reason is enabled for verbosity > 2, and now includes the TTL of received
  packets in Normal output (this was already present in XML) [Jay Bosamiya]

o Fix ICMP Echo (-PE) host discovery for IPv6, broken since 6.45, caused by
  failing to set the ICMP ID for outgoing packets which is used to match
  incoming responses. [Andrew Waters]

o Solve a crash on Windows (reported on Windows 8.1 on Surface Pro 3) caused by
  passing a NULL pointer to a WinPcap function that then tries to write an
  error message to it. [Peter Malecka]

o Enhance Nmap's tcpwrapped service detection by using a shorter timeout for
  the tcpwrapped designation. This prevents falsely labeling services as
  tcpwrapped which merely have a read timeout shorter than 6 seconds. Full
  discussion: http://issues.nmap.org/39 [nnposter, Daniel Miller]

o All nmap.org pages are now available SSL-secured to improve privacy
  and ensure your binaries can't be tampered with in transit. So be
  sure to download from https://nmap.org/download.html . We will soon
  remove the non-SSL version of the site. We still offer GPG-signed
  binaries as well: https://nmap.org/book/install.html#inst-integrity

o [NSE] Added 25 NSE scripts from 17 authors, bringing the total up to 494!
  They are all listed at https://nmap.org/nsedoc/, and the summaries are below
  (authors are listed in brackets):

  + bacnet-info gets device information from SCADA/ICS devices via BACnet
    (Building Automation and Control Networks) [Stephen Hilt, Michael Toecker]

  + docker-version detects and fingerprints Docker [Claudio Criscione]

  + enip-info gets device information from SCADA/ICS devices via EtherNet/IP
    [Stephen Hilt]

  + fcrdns performs a Forward-confirmed Reverse DNS lookup and reports
    anomalous results. [Daniel Miller]

  + http-avaya-ipoffice-users enumerates users in Avaya IP Office 7.x systems.
    [Paulino Calderon]

  + http-cisco-anyconnect gets version and tunnel information from Cisco SSL
    VPNs. [Patrik Karlsson]

  + http-crossdomainxml detects overly permissive crossdomain policies and
    finds trusted domain names available for purchase. [Paulino Calderon]

  + http-shellshock detects web applications vulnerable to Shellshock
    (CVE-2014-6271). [Paulino Calderon]

  + http-vuln-cve2006-3392 exploits a file disclosure vulnerability in Webmin.
    [Paul AMAR]

  + http-vuln-cve2014-2126, http-vuln-cve2014-2127, http-vuln-cve2014-2128 and
    http-vuln-cve2014-2129 detect specific vulnerabilities in Cisco AnyConnect
    SSL VPNs. [Patrik Karlsson]

  + http-vuln-cve2015-1427 detects Elasticsearch servers vulnerable to remote
    code execution. [Gyanendra Mishra]

  + http-vuln-cve2015-1635 detects Microsoft Windows systems vulnerable to
    MS15-034. [Paulino Calderon]

  + http-vuln-misfortune-cookie detects the "Misfortune Cookie" vulnerability
    in Allegro RomPager 4.07, commonly used in SOHO routers for TR-069 access.
    [Andrew Orr]

  + http-wordpress-plugins was renamed http-wordpress-enum and extended to
    enumerate both plugins and themes of Wordpress installations and their
    versions. http-wordpress-enum is now http-wordpress-users. [Paulino Calderon]

  + mikrotik-routeros-brute performs password auditing attacks against
    Mikrotik's RouterOS API. [Paulino Calderon]

  + omron-info gets device information from Omron PLCs via the FINS service.
    [Stephen Hilt]

  + s7-info gets device information from Siemens PLCs via the S7 service,
    tunneled over ISO-TSAP on TCP port 102. [Stephen Hilt]

  + snmp-info gets the enterprise number and other information from the
    snmpEngineID in an SNMPv3 response packet. [Daniel Miller]

  + ssl-ccs-injection detects whether a server is vulnerable to the SSL/TLS
    CCS Injection vulnerability (CVE-2014-0224) [Claudiu Perta]

  + ssl-poodle detects the POODLE bug in SSLv3 (CVE-2014-3566) [Daniel Miller]

  + supermicro-ipmi-conf exploits Supermicro IPMI/BMC controllers. [Paulino
    Calderon]

  + targets-ipv6-map4to6 generates target IPv6 addresses which correspond to
    IPv4 addresses mapped within a particular IPv6 subnet. [Raúl Fuentes]

  + targets-ipv6-wordlist generates target IPv6 addresses from a wordlist made
    of hexadecimal characters. [Raúl Fuentes]

o Update our Windows build system to VS 2013 on Windows 8.1. Also, we now build
  our included OpenSSL with DEP, ASLR, and SafeSEH enabled. [Daniel Miller]

o Our OS X installer is now built for a minimum supported version of 10.8
  (Mountain Lion), a much-needed update from 10.5 (Leopard). Additionally,
  OpenSSL is now statically linked, allowing us to distribute the latest from
  Macports instead of being subjected to the 0.9.8 branch still in use as of
  10.9. [Daniel Miller]

o Add 2 more ASCII-art configure splash images to be rotated randomly with the
  traditional dragon image. New ideas for other images to use here may be sent
  to dev@nmap.org. [Jay Bosamiya, Daniel Miller]

o Solve a crash on Windows (reported on Windows 8.1 on Surface Pro 3) caused by
  passing a NULL pointer to a WinPcap function that then tries to write an
  error message to it. [Peter Malecka]

o Fix compilation and several bugs on AIX. [Daniel Miller]

o Fix a bug in libdnet-stripped on Solaris that resulted in the wrong MAC
  address being detected for all interfaces.
  http://seclists.org/nmap-dev/2015/q2/1 [Daniel Miller]

o New features for the IPv6 OS detection engine allow for better classification
  of systems: IPv6 guessed initial hop limit (TTL) and ratio of TCP initial
  window size to maximum segment size. [Alexandru Geana]

o [NSE] Rework ssl-enum-ciphers to actually score the strength of the SSL/TLS
  handshake, including certificate key size and DH parameters if applicable.
  This is similar to Qualys's SSL Labs scanner, and means that we no longer
  maintain a list of scores per ciphersuite. [Daniel Miller]

o [NSE] Improved http-form-brute autodetection and behavior to handle more
  unusual-but-valid HTML syntax, non-POST forms, success/failure testing on
  HTTP headers, and more. [nnposter]

o [NSE] Reduce many NSE default timeouts and base them on Nmap's detected
  timeouts for those hosts from the port scan phase. Scripts which take timeout
  script-args can now handle 's' and 'ms' suffixes, just like Nmap's own
  options. [Daniel Miller]

o [NSE] Remove db2-discover, as its functionality was performed by service
  version detection since the broadcast portion was separated into
  broadcast-db2-discover. http://seclists.org/nmap-dev/2014/q3/415 [Daniel
  Miller]

o Cache dnet names not found on Windows when enumerating interfaces in the
  Windows Registry. Reduces startup times. [Elon Natovich]

o [NSE] Make smb-ls able to leverage results from smb-enum-shares or list of
  shares specified on command line. [Pierre Lalet]

o [NSE] Fix X509 cert date parsing for dates after 2049. Reported by Teppo
  Turtiainen. [Daniel Miller]

o Handle a bunch of socket errors that can result from odd ICMP Type 3
  Destination Unreachable messages received during service scanning. The crash
  reported was "Unexpected error in NSE_TYPE_READ callback.  Error code: 92
  (Protocol not available)" [Daniel Miller]

o Fixed a crash (NULL pointer dereference) in PortList::isTCPwrapped when using
  -sV and -O on an unknown service not listed in nmap-services. [Pierre Lalet]

o Fixed a benign TOCTOU race between stat() and open() in mmapfile().
  Reported by Camille Mougey. [Henri Doreau]

o Reduce CPU consumption when using nsock poll engine with no registered FD,
  by actually calling Poll() for the time until timeout, instead of directly
  returning zero and entering the loop again. [Henri Doreau]

o Change the URI for the fingerprint submitter to its new location at
  https://nmap.org/cgi-bin/submit.cgi

o [NSE] Added a check for Cisco ASA version disclosure, CVE-2014-3398, to
  http-enum in the 'security' category [Daniel Miller]

o Fixed a bug that caused Nmap to fail to find any network interface when a
  Prism interface is in monitor mode. The fix was to define the
  ARP_HRD_IEEE80211_PRISM header identifier in the libdnet-stripped code.
  [Brad Johnson]

o Added a version probe for Tor. [David Fifield]

o [NSE] Add support to citrix-enum-apps-xml for reporting if Citrix
  published applications in the list are enforcing/requiring the level
  of ICA/session data encryption shown in the script result.
  [Tom Sellers]

o [NSE] Updated our Wordpress plugin list to improve the
  http-wordpress-enum NSE script. We can now detect 34,077 plugins,
  up from 18,570. [Danila Poyarkov]

o [NSE] Add the signature algorithm that was used to sign the target port's
  x509 certificate to the output of ssl-cert.nse [Tom Sellers]

o [NSE] Fixed a bug in the sslcert.lua library that was triggered against
  certain services when version detection was used. [Tom Sellers]

o [NSE] vulns.Report:make_output() now generates XML structured output
  reports automatically. [Paulino Calderon]

o [NSE] Add port.reason_ttl, host.reason, host.reason_ttl for use in scripts
  [Jay Bosamiya]

o [NSE] If a version script is run by name, nmap.version_intensity() returns
  the maximum value (9) for it [Jay Bosamiya]

o [NSE] shortport.version_port_or_service() takes an optional rarity parameter
  now to run only when version intensity > rarity [Jay Bosamiya]

o [NSE] Added nmap.version_intensity() function so that NSE version scripts
  can use the argument to --version-intensity (which can be overridden by the
  script arg 'script-intensity') in order to decide whether to run or not
  [Jay Bosamiya]

o Improve OS detection; If a port is detected to be 'tcpwrapped', then it will
  not be used for OS detection. This helps in cases where a firewall might be
  the port to be 'tcpwrapped' [Jay Bosamiya]

o [Zenmap] Reduce noise generated in Topology View due to anonymous
  hops [Jay Bosamiya]

o Added option --exclude-ports to Nmap so that some ports can be excluded from
  scanning (for example, due to policy) [Jay Bosamiya]

o [Zenmap] Catch the MemoryError caused in Zenmap due to large Nmap Output,
  and display a more helpful error message [Jay Bosamiya]

o Catch badly named output files (such as those unintentionally caused by
  "-oX -sV logfile.xml") [Jay Bosamiya]

o [Zenmap] Improved NmapParser to increase speed in opening scans. Large scans
  now open in seconds instead of hours. [Jay Bosamiya]

o Modify the included libpcap configure script to disable certain unused
  features: bluetooth, usb, usb-can, and dbus sniffing. Dbus support caused a
  build problem on CentOS 6.5. [Daniel Miller]

o Updated the bundled libpcap from 1.2.1 to 1.5.3 [Jay Bosamiya]

o Correct the Target MAC Address in Nmap's ARP discovery to conform to what IP
  stacks in currently popular operating systems use. [Jay Bosamiya]

o Fixed a bug which caused Nmap to be unable to have any runtime interaction
  when called from sudo or from a shell script. [Jay Bosamiya]

o Improvements to whois-ip.nse: fix an unhandled error when a referred-to
  response could not be understood; add a new pattern to recognise a
  LACNIC "record not found" type of response and update the way ARIN is
  queried. [jah]

Nmap 6.47 [2014-08-23]

o Integrated all of your IPv4 OS fingerprint submissions since June 2013
  (2700+ of them). Added 366 fingerprints, bringing the new total to 4485.
  Additions include Linux 3.10 - 3.14, iOS 7, OpenBSD 5.4 - 5.5, FreeBSD 9.2,
  OS X 10.9, Android 4.3, and more. Many existing fingerprints were improved.
  Highlights: http://seclists.org/nmap-dev/2014/q3/325 [Daniel Miller]

o (Windows, RPMs) Upgraded the included OpenSSL to version 1.0.1i. [Daniel Miller]

o (Windows) Upgraded the included Python to version 2.7.8. [Daniel Miller]

o Removed the External Entity Declaration from the DOCTYPE in Nmap's XML. This
  was added in 6.45, and resulted in trouble for Nmap XML parsers without
  network access, as well as increased traffic to Nmap's servers. The doctype
  is now:
  <!DOCTYPE nmaprun>

o [Ndiff] Fixed the installation process on Windows, which was missing the
  actual Ndiff Python module since we separated it from the driver script.
  [Daniel Miller]

o [Ndiff] Fixed the ndiff.bat wrapper in the zipfile Windows distribution,
  which was giving the error, "\Microsoft was unexpected at this time." See
  https://support.microsoft.com/kb/2524009 [Daniel Miller]

o [Zenmap] Fixed the Zenmap .dmg installer for OS X. Zenmap failed to launch,
  producing this error:
    Could not import the zenmapGUI.App module:
    'dlopen(/Applications/Zenmap.app/Contents/Resources/lib/python2.6/lib-dynload/glib/_glib.so, 2):
    Library not loaded: /Users/david/macports-10.5/lib/libffi.5.dylib\n
    Referenced from:
    /Applications/Zenmap.app/Contents/Resources/lib/python2.6/lib-dynload/glib/_glib.so\n
    Reason: image not found'.

o [Ncat] Fixed SOCKS5 username/password authentication. The password length was
  being written in the wrong place, so authentication could not succeed.
  Reported with patch by Pierluigi Vittori.

o Avoid formatting NULL as "%s" when running nmap --iflist. GNU libc converts
  this to the string "(null)", but it caused segfault on Solaris. [Daniel Miller]

o [Zenmap][Ndiff] Avoid crashing when users have the antiquated PyXML package
  installed. Python tries to be nice and loads it when we import xml, but it
  isn't compatible. Instead, we force Python to use the standard library xml
  module. [Daniel Miller]

o Handle ICMP admin-prohibited messages when doing service version detection.
  Crash reported by Nathan Stocks was: Unexpected error in NSE_TYPE_READ
  callback.  Error code: 101 (Network is unreachable) [David Fifield]

o [NSE] Fix a bug causing http.head to not honor redirects. [Patrik Karlsson]

o [Zenmap] Fix a bug in DiffViewer causing this crash:
     TypeError: GtkTextBuffer.set_text() argument 1 must be string or read-only
     buffer, not NmapParserSAX
  Crash happened when trying to compare two scans within Zenmap. [Daniel Miller]

Nmap 6.46 [2014-04-18]

o [NSE] Made numerous improvements to ssl-heartbleed to provide
  more reliable detection of the vulnerability.

o [Zenmap] Fixed a bug which caused this crash message:
     IOError: [Errno socket error] [Errno 10060] A connection attempt failed
     because the connected party did not properly respond after a period of
     time, or established connection failed because connected host has
     failed to
     respond
  The bug was caused by us adding a DOCTYPE definition to Nmap's XML
  output which caused Python's XML parser to try and fetch the DTD
  every time it parses an XML file.  We now override that DTD-fetching
  behavior. [Daniel Miller]

o [NSE] Fix some bugs which could cause snmp-ios-config and
  snmp-sysdescr scripts to crash
  (http://seclists.org/nmap-dev/2014/q2/120) [Patrik Karlsson]

o [NSE] Improved performance of citrix.lua library when handling large XML
  responses containing application lists. [Tom Sellers]

Nmap 6.45 [2014-04-11]

o Idle scan now supports IPv6. IPv6 packets don't usually come with
  fragments identifiers like IPv4 packets do, so new techniques had to
  be developed to make idle scan possible. The implementation is by
  Mathias Morbitzer, who made it the subject of his master's thesis.

o When doing a ping scan (-sn), the --open option will prevent down hosts from
  being shown when -v is specified. This aligns with similar output for other
  scan types. [Daniel Miller]

o Fixed some syntax problems in nmap-os-db that were caused by some automated
  merging of fingerprints (http://seclists.org/nmap-dev/2013/q4/68) [Daniel
  Miller]

o New service probes and fingerprints for Quake1, TeamSpeak3, xmlsysd,
  Freelancer game server, All-Seeing Eye, AndroMouse, and AirHD.

o Update included WinPcap to version 4.1.3 [Rob Nicholls]

o [NSE] Convert many more scripts to emit structured XML output
  (https://nmap.org/book/nse-api.html#nse-structured-output) [Daniel Miller]

o [NSE] Added 24 NSE scripts from 12 authors, bringing the total up to 470.
  They are all listed at https://nmap.org/nsedoc/, and the summaries are
  below (authors are listed in brackets):

  + allseeingeye-info gathers information from games using this query protocol.
    A version detection probe was also added. [Marin Maržić]

  + freelancer-info gathers information about the Freelancer game server. Also
    added a related version detection probe and UDP protocol payload for
    detecting the service. [Marin Maržić]

  + http-csrf detects Cross Site Request Forgeries (CSRF) vulnerabilities by
    searching for CSRF tokens in HTML forms. [George Chatzisofroniou]

  + http-devframework finds out the technology behind the target website based
    on HTTP headers, static URLs, and other content and resources. [George
    Chatzisofroniou]

  + http-dlink-backdoor detects DLink routers with firmware backdoor allowing
    admin access over HTTP interface. [Patrik Karlsson]

  + http-dombased-xss finds potential DOM-based Cross-site Scripting (XSS)
    vulnerabilities by searching for specific patterns in JavaScript resources.
    [George Chatzisofroniou]

  + http-errors crawls for URIs that return error status codes (HTTP 400 and
    above). [George Chatzisofroniou]

  + http-feed crawls a web site for Atom and RSS feeds. [George Chatzisofroniou]

  + http-iis-short-name-brute detects Microsoft IIS servers vulnerable to a
    file/folder name disclosure and a denial of service vulnerability. The
    script obtains the "shortnames" of the files and folders in the webroot
    folder. [Paulino Calderon]

  + http-mobileversion-checker checks for mobile versions of web pages by
    setting an Android User-Agent header and checking for HTTP redirects.
    [George Chatzisofroniou]

  + http-ntlm-info gets server information from Web servers that require NTLM
    authentication. [Justin Cacak]

  + http-referer-checker finds JavaScript resources that are included from other
    domains, increasing a website's attack surface. [George Chatzisofroniou]

  + http-server-header grabs the Server header as a last-ditch effort to get a
    software version. This can't be done as a softmatch because of the need to
    match non-HTTP services that obey some HTTP requests. [Daniel Miller]

  + http-useragent-tester checks for sites that redirect common Web spider
    User-Agents to a different page than browsers get. [George Chatzisofroniou]

  + http-vuln-cve2013-7091 (released as http-vuln-zimbra-lfi) looks for
    CVE-2013-7091, a LFI vulnerability in Zimbra. [Paul AMAR, Ron Bowes]

  + http-xssed searches the xssed.com database of Cross-site Scripting
    vulnerabilities for previously-reported XSS vulnerabilities in the target.
    [George Chatzisofroniou]

  + qconn-exec tests the QNX QCONN service for remote command execution.
    [Brendan Coles]

  + quake1-info retrieves server and player information from Quake 1 game
    servers. Reports potential DoS amplification factor.  [Ulrik Haugen]

  + rfc868-time gets the date and time from an RFC 868 Time server. [Daniel
    Miller]

  + ssl-heartbleed detects the Heartbleed bug in OpenSSL CVE-2014-0160 [Patrik
    Karlsson]

  + sstp-discover discovers Microsoft's Secure Socket Tunnelling Protocol
    (http://msdn.microsoft.com/en-us/library/cc247338.aspx) [Niklaus Schiess]

  + unittest runs unit tests found in NSE libraries. The corresponding
    unittest.lua library has examples. Run `nmap --script=unittest
    --script-args=unittest.run -d` to run the tests. [Daniel Miller]

  + weblogic-t3-info detects the T3 RMI protocol used by Oracle/BEA Weblogic
    and extracts the Weblogic version. [Alessandro Zanni, Daniel Miller]

  + whois-ip and whois-domain replace the whois script, which previously could
    only collect whois info for IP addresses. [George Chatzisofroniou]

o [NSE] Fixed an error-handling bug in socks-open-proxy that caused it to fail
  when scanning a SOCKS4-only proxy. Reported on IRC by Husky. [Daniel Miller]

o [NSE] Improved ntp-info script to handle underscores in returned
  data. [nnposter]

o [NSE] Add unicode library for decoding and encoding UTF-8, UTF-16, CP437 and
  other character sets to Unicode code points. Scripts that previously just
  added or skipped nulls in UTF-16 data can use this to support non-ASCII
  characters. [Daniel Miller]

o Significant code and documentation cleanup effort, fixing file encodings,
  trailing whitespace, indentation, spelling mistakes, NSEdoc formatting
  issues, PEP 8 compliance for Python, deprecation cleanup under python -3,
  cleanup of warnings from LLVM's AddressSanitizer.  [Daniel Miller]

o [Ncat] Added support for socks5 and corresponding regression tests.
  [Marek Lucaszuk, Petr Stodulka]

o Added TCP support to dns.lua. [John Bond]

o Added safe fd_set operations. This makes nmap fail gracefully instead of
  crashing when the number of file descriptors grows over FD_SETSIZE. Jacek
  Wielemborek reported the crash. [Henri Doreau]

o [NSE] Added tls library for functions related to SSLv3 and TLS messages.
  Existing ssl-enum-ciphers, ssl-date, and tls-nextprotoneg scripts were
  updated to use this library. [Daniel Miller]

o Added NSE and Zenmap unit tests to "make check" [Daniel Miller]

o [NSE] Enable http-enum to use the large Nikto fingerprint database at runtime
  if provided by the user. For licensing reasons, we do not distribute this
  database, but the integration effort has the blessing of the Nikto folks.
  [George Chatzisofroniou]

o Updated bundled liblua from 5.2.2 to 5.2.3 (bugfix release) [Daniel Miller]

o Added version detection signatures and probes for a bunch of Android
  remote mouse/keyboard servers, including AndroMouse, AirHID,
  Wifi-mouse, and RemoteMouse. [Paul Hemberger]

o [Ncat] Fixed compilation when --without-liblua is specified in
  configure (an #include needed an ifdef guard). [Quentin Glidic]

o Fixed a bug in libdnet with handling interfaces with AF_LINK addresses on
  FreeBSD >9 reported by idwer on IRC. Likely affected other *BSDs. Handled by
  skipping these non-network addresses. [Daniel Miller]

o Fixed a bug with UDP checksum calculation. When the UDP checksum is zero
  (0x0000), it must be transmitted as 1's-complement -0 (0xffff) to avoid
  ambiguity with +0, which indicates no checksum was calculated. This affected
  UDP on IPv4 only. Reported by Michael Weber. [Daniel Miller]

o [NSE] Removed a fixed value (28428) which was being set for the Request ID in
  the snmpWalk library function; a value based on nmap.clock_ms will now be set
  instead. [jah]

o The ICMP ID of ICMP probes is now matched against the sent ICMP ID,
  to reduce the chance of false matches. Patch by Chris Johnson.

o [NSE] Made telnet-brute support multiple parallel guessing threads,
  reuse connections, and support password-only logins. [nnposter]

o [NSE] Made the table returned by ssh1.fetch_host_key contain a "key"
  element, like that of ssh2.fetch_host_key. This fixed a crash in the
  ssh-hostkey script reported by Dan Farmer and Florian Pelgrim. The
  "key" element of ssh2.fetch_host_key now is base64-encoded, to match
  the format used by the known_hosts file. [David Fifield]

o [Nsock] Handle timers and timeouts via a priority queue (using a heap)
  for improved performance. Nsock now only iterates over events which are
  completed or expired instead of inspecting the entire event set at each
  iteration. [Henri Doreau]

o [NSE] Update dns-cache-snoop script to use a new list of top 50
  domains rather than a 2010 list. [Nicolle Neulist]

o [Zenmap] Fixed a crash that would happen when you entered a search
  term starting with a colon: "AttributeError:
  'FilteredNetworkInventory' object has no attribute 'match_'".
  Reported by Kris Paernell. [David Fifield]

o [Ncat] Added NCAT_PROTO, NCAT_REMOTE_ADDR, NCAT_REMOTE_PORT, NCAT_LOCAL_ADDR
  and NCAT_LOCAL_PORT environment variables being set in all --*-exec child
  processes.

Nmap 6.40 [2013-07-29]

o [Ncat] Added --lua-exec. This feature is basically the equivalent of 'ncat
  --sh-exec "lua <scriptname>"' and allows you to run Lua scripts with Ncat,
  redirecting all stdin and stdout operations to the socket connection. See
  https://nmap.org/book/ncat-man-command-options.html [Jacek Wielemborek]

o Integrated all of your IPv4 OS fingerprint submissions since January
  (1,300 of them). Added 91 fingerprints, bringing the new total to 4,118.
  Additions include Linux 3.7, iOS 6.1, OpenBSD 5.3, AIX 7.1, and more.
  Many existing fingerprints were improved. Highlights:
  http://seclists.org/nmap-dev/2013/q2/518. [David Fifield]

o Integrated all of your service/version detection fingerprints submitted
  since January (737 of them)! Our signature count jumped by 273 to 8,979.
  We still detect 897 protocols, from extremely popular ones like http, ssh,
  smtp and imap to the more obscure airdroid, gopher-proxy, and
  enemyterritory. Highlights:
  http://seclists.org/nmap-dev/2013/q3/80. [David Fifield]

o Integrated your latest IPv6 OS submissions and corrections. We're still
  low on IPv6 fingerprints, so please scan any IPv6 systems you own or
  administer and submit them to https://nmap.org/submit/.  Both new
  fingerprints (if Nmap doesn't find a good match) and corrections (if Nmap
  guesses wrong) are useful. [David Fifield]

o [Nsock] Added initial proxy support to Nsock. Nmap version detection
  and NSE can now establish TCP connections through chains of one or
  more CONNECT or SOCKS4 proxies. Use the Nmap --proxies option with a
  chain of one or more proxies as the argument (example:
  http://localhost:8080,socks4://someproxy.example.com). Note that
  only version detection and NSE are supported so far (no port
  scanning or host discovery), and there are other limitations
  described in the man page. [Henri Doreau]

o [NSE] Added 14 NSE scripts from 6 authors, bringing the total up to 446.
  They are all listed at https://nmap.org/nsedoc/, and the summaries are
  below (authors are listed in brackets):

  + hostmap-ip2hosts finds hostnames that resolve to the target's IP address
    by querying the online database at http://www.ip2hosts.com (uses Bing
    search results) [Paulino Calderon]

  + http-adobe-coldfusion-apsa1301 attempts to exploit an authentication
    bypass vulnerability in Adobe Coldfusion servers (APSA13-01:
    http://www.adobe.com/support/security/advisories/apsa13-01.html) to
    retrieve a valid administrator's session cookie. [Paulino Calderon]

  + http-coldfusion-subzero attempts to retrieve version, absolute path of
    administration panel and the file 'password.properties' from vulnerable
    installations of ColdFusion 9 and 10. [Paulino Calderon]

  + http-comments-displayer extracts and outputs HTML and JavaScript
    comments from HTTP responses. [George Chatzisofroniou]

  + http-fileupload-exploiter exploits insecure file upload forms in web
    applications using various techniques like changing the Content-type
    header or creating valid image files containing the payload in the
    comment. [George Chatzisofroniou]

  + http-phpmyadmin-dir-traversal exploits a directory traversal
    vulnerability in phpMyAdmin 2.6.4-pl1 (and possibly other versions) to
    retrieve remote files on the web server. [Alexey Meshcheryakov]

  + http-stored-xss posts specially crafted strings to every form it
    encounters and then searches through the website for those strings to
    determine whether the payloads were successful. [George Chatzisofroniou]

  + http-vuln-cve2013-0156 detects Ruby on Rails servers vulnerable to
    object injection, remote command executions and denial of service
    attacks. (CVE-2013-0156) [Paulino Calderon]

  + ike-version obtains information (such as vendor and device type where
    available) from an IKE service by sending four packets to the host.
    This scripts tests with both Main and Aggressive Mode and sends multiple
    transforms per request. [Jesper Kueckelhahn]

  + murmur-version detects the Murmur service (server for the Mumble voice
    communication client) versions 1.2.X. [Marin Maržić]

  + mysql-enum performs valid-user enumeration against MySQL server using a
    bug discovered and published by Kingcope
    (http://seclists.org/fulldisclosure/2012/Dec/9). [Aleksandar Nikolic]

  + teamspeak2-version detects the TeamSpeak 2 voice communication server
