Nmap Security Scanner 7.99 + на Русском

[Windows] Updated the bundled Npcap from 0.91 to 0.93, fixing several issues with installation and compatibility with the Windows 10 Creators Update.
[NSE][GH#910] NSE scripts now have complete SSH support via libssh2, including password brute-forcing and running remote commands, thanks to the combined efforts of three Summer of Code students: [Devin Bjelland, Sergey Khegay, Evangelos Deirmentzoglou]
[NSE] Added 14 NSE scripts from 6 authors, bringing the total up to 579! They are all listed at https://nmap.org/nsedoc/, and the summaries are below:
ftp-syst sends SYST and STAT commands to FTP servers to get system version and connection information. [Daniel Miller]
[GH#916] http-vuln-cve2017-8917 checks for an SQL injection vulnerability affecting Joomla! 3.7.x before 3.7.1. [Wong Wai Tuck]
iec-identify probes for the IEC 60870-5-104 SCADA protocol. [Aleksandr Timorin, Daniel Miller]
[GH#915] openwebnet-discovery retrieves device identifying information and number of connected devices running on openwebnet protocol. [Rewanth Cool]
puppet-naivesigning checks for a misconfiguration in the Puppet CA where naive signing is enabled, allowing for any CSR to be automatically signed. [Wong Wai Tuck]
[GH#943] smb-protocols discovers if a server supports dialects NT LM 0.12 (SMBv1), 2.02, 2.10, 3.00, 3.02 and 3.11. This replaces the old smbv2-enabled script. [Paulino Calderon]
[GH#943] smb2-capabilities lists the supported capabilities of SMB2/SMB3 servers. [Paulino Calderon]
[GH#943] smb2-time determines the current date and boot date of SMB2 servers. [Paulino Calderon]
[GH#943] smb2-security-mode determines the message signing configuration of SMB2/SMB3 servers. [Paulino Calderon]
[GH#943] smb2-vuln-uptime attempts to discover missing critical patches in Microsoft Windows systems based on the SMB2 server uptime. [Paulino Calderon]
ssh-auth-methods lists the authentication methods offered by an SSH server. [Devin Bjelland]
ssh-brute performs brute-forcing of SSH password credentials. [Devin Bjelland]
ssh-publickey-acceptance checks public or private keys to see if they could be used to log in to a target. A list of known-compromised key pairs is included and checked by default. [Devin Bjelland]
ssh-run uses user-provided credentials to run commands on targets via SSH. [Devin Bjelland]
[NSE] Removed smbv2-enabled, which was incompatible with the new SMBv2/3 improvements. It was fully replaced by the smb-protocols script.
[Ncat][GH#446] Added Datagram TLS (DTLS) support to Ncat in connect (client) mode with --udp --ssl. Also added Application Layer Protocol Negotiation (ALPN) support with the --ssl-alpn option. [Denis Andzakovic, Daniel Miller]
Updated the default ciphers list for Ncat and the secure ciphers list for Nsock to use "!aNULL:!eNULL" instead of "!ADH". With the addition of ECDH ciphersuites, anonymous ECDH suites were being allowed. [Daniel Miller]
[NSE][GH#930] Fix ndmp-version and ndmp-fs-info when scanning Veritas Backup Exec Agent 15 or 16. [Andrew Orr]
[NSE][GH#943] Added new SMB2/3 library and related scripts. [Paulino Calderon]
[NSE][GH#950] Added wildcard detection to dns-brute. Only hostnames that resolve to unique addresses will be listed. [Aaron Heesakkers]
[NSE] FTP scripts like ftp-anon and ftp-brute now correctly handle TLS-protected FTP services and use STARTTLS when necessary. [Daniel Miller]
[NSE][GH#936] Function url.escape no longer encodes so-called "unreserved" characters, including hyphen, period, underscore, and tilde, as per RFC 3986. [nnposter]
[NSE][GH#935] Function http.pipeline_go no longer assumes that persistent connections are supported on HTTP 1.0 target (unless the target explicitly declares otherwise), as per RFC 7230. [nnposter]
[NSE][GH#934] The HTTP response object has a new member, version, which contains the HTTP protocol version string returned by the server, e.g. "1.0". [nnposter]
[NSE][GH#938] Fix handling of the objectSID Active Directory attribute by ldap.lua. [Tom Sellers]
[NSE] Fix line endings in the list of Oracle SIDs used by oracle-sid-brute. Carriage Return characters were being sent in the connection packets, likely resulting in failure of the script. [Anant Shrivastava]
[NSE][GH#141] http-useragent-checker now checks for changes in HTTP status (usually 403 Forbidden) in addition to redirects to indicate forbidden User Agents. [Gyanendra Mishra]

правильно писать это Zenmap, форк nmap

Zenmap is the official Nmap Security Scanner GUI.

[Windows] Updated the bundled Npcap from 0.78 to 0.91, with several bugfixes for WiFi connectivity problems and stability issues. [Daniel Miller, Yang Luo]
Integrated all of your service/version detection fingerprints submitted from September to March (855 of them). The signature count went up 2.9% to 11,418. We now detect 1193 protocols from apachemq, bro, and clickhouse to jmon, slmp, and zookeeper. Highlights: http://seclists.org/nmap-dev/2017/q2/140
[NSE] Added 14 NSE scripts from 12 authors, bringing the total up to 566! They are all listed at https://nmap.org/nsedoc/, and the summaries are below:
[GH#743] broadcast-ospf2-discover discovers OSPF 2 routers and neighbors. OSPFv2 authentication is supported. [Emiliano Ticci]
[GH#671] cics-info checks IBM TN3270 services for CICS transaction services and extracts useful information. [Soldier of Fortran]
[GH#671] cics-user-brute does brute-force enumeration of CICS usernames on IBM TN3270 services. [Soldier of Fortran]
[GH#669] http-cookie-flags checks HTTP session cookies for HTTPOnly and Secure flags. [Steve Benson]
http-security-headers checks for the HTTP response headers related to security given in OWASP Secure Headers Project, giving a brief description of the header and its configuration value. [Vinamra Bhatia, ?caro Torres]
[GH#740][GH#759] http-vuln-cve2017-5638 checks for the RCE bug in Apache Struts2. [Seth Jackson]
[GH#876] http-vuln-cve2017-5689 detects a privilege escalation vulnerability (INTEL-SA-00075) in Intel Active Management Technology (AMT) capable systems. [Andrew Orr]
http-vuln-cve2017-1001000 detects a privilege escalation vulnerability in Wordpress 4.7.0 and 4.7.1 (CVE-2017-1001000) [Vinamra Bhatia]
[GH#713] impress-remote-discover attempts to pair with the LibreOffice Impress presentation remote service and extract version info. Pairing is PIN-protected, and the script can optionally brute-force the PIN. New service probe and match line also added. [Jeremy Hiebert]
[GH#854] smb-double-pulsar-backdoor detects the Shadow Brokers-leaked Double Pulsar backdoor in Windows SMB servers. [Andrew Orr]
smb-vuln-cve-2017-7494 detects a remote code execution vulnerability affecting Samba versions 3.5.0 and greater with writable shares. [Wong Wai Tuck]
smb-vuln-ms17-010 detects a critical remote code execution vulnerability affecting SMBv1 servers in Microsoft Windows systems (ms17-010). The script also reports patched systems. [Paulino Calderon]
[GH#686] tls-ticketbleed checks for the Ticketbleed vulnerability (CVE-2016-9244) in F5 BIG-IP appliances. [Mak Kolybabi]
vmware-version queries VMWare SOAP API for version and product information. Submitted in 2011, this was mistakenly turned into a service probe that was unable to elicit any matches. [Aleksey Tyurin]
[Ncat] A series of changes and fixes based on feedback from the Red Hat community:
[GH#157] Ncat will now continue trying to connect to each resolved address for a hostname before declaring the connection refused, allowing it to fallback from IPv6 to IPv4 or to connect to names that use DNS failover. [Jaromir Koncicky, Michal Hlavinka]
The --no-shutdown option now also works in connect mode, not only in listen mode.
Made -i/--idle-timeout not cause Ncat in server mode to close while waiting for an initial connection. This was also causing -i to interfere with the HTTP proxy server mode. [Carlos Manso, Daniel Miller]
[GH#773] Ncat in server mode properly handles TLS renegotiations and other situations where SSL_read returns a non-fatal error. This was causing SSL-over-TCP connections to be dropped. [Daniel Miller]
Enable --ssl-ciphers to be used with Ncat in client mode, not only in server (listen) mode. [Daniel Miller]
[NSE][GH#266][GH#704][GH#238][GH#883] NSE libraries smb and msrpc now use fully qualified paths. SMB scripts now work against all modern versions of Microsoft Windows. [Paulino Calderon]
[NSE] smb library's share_get_list now properly uses anonymous connections first before falling back authenticating as a known user.
New service probes and matches for Apache HBase and Hadoop MapReduce. [Paulino Calderon]
Extended Memcached service probe and added match for Apache ZooKeeper. [Paulino Calderon]
[NSE] New script argument "vulns.short" will reduce vulns library script output to a single line containing the target name or IP, the vulnerability state, and the CVE ID or title of the vulnerability. [Daniel Miller]
[NSE][GH#862] SNMP scripts will now take a community string provided like `--script-args creds.snmp=private`, which previously did not work because it was interpreted as a username. [Daniel Miller]
[NSE] Resolved several issues in the default HTTP redirect rules:
[GH#826] A redirect is now cancelled if the original URL contains embedded credentials
[GH#829] A redirect test is now more careful in determining whether a redirect destination is related to the original host
[GH#830] A redirect is now more strict in avoiding possible redirect loops
[nnposter]
[NSE][GH#766] The HTTP Host header will now include the port unless it is the default one for a given scheme. [nnposter]
[NSE] The HTTP response object has a new member, fragment, which contains a partially received body (if any) when the overall request fails to complete. [nnposter]
[NSE][GH#866] NSE now allows cookies to have arbitrary attributes, which are silently ignored (in accordance with RFC 6265). Unrecognized attributes were previously causing HTTP requests with such cookies to fail. [nnposter]
[NSE][GH#844] NSE now correctly parses a Set-Cookie header that has unquoted whitespace in the cookie value (which is allowed per RFC 6265). [nnposter]
[NSE][GH#731] NSE is now able to process HTTP responses with a Set-Cookie header that has an extraneous trailing semicolon. [nnposter]
[NSE][GH#708] TLS SNI now works correctly for NSE HTTP requests initiated with option any_af. As an added benefit, option any_af is now available for all connections via comm.lua, not just HTTP requests. [nnposter]
[NSE][GH#781] There is a new common function, url.get_default_port(), to obtain the default port number for a given scheme. [nnposter]
[NSE][GH#833] Function url.parse() now returns the port part as a number, not a string. [nnposter]
No longer allow ICMP Time Exceeded messages to mark a host as down during host discovery. Running traceroute at the same time as Nmap was causing interference. [David Fifield]
[NSE][GH#807] Fixed a JSON library issue that was causing long integers to be expressed in the scientific/exponent notation. [nnposter]
[NSE] Fixed several potential hangs in NSE scripts that used receive_buf(pattern), which will not return if the service continues to send data that does not match pattern. A new function in match.lua, pattern_limit, is introduced to limit the number of bytes consumed while searching for the pattern. [Daniel Miller, Jacek Wielemborek]
[Nsock] Handle any and all socket connect errors the same: raise as an Nsock error instead of fatal. This prevents Nmap and Ncat from quitting with "Strange error from connect:" [Daniel Miller]
[NSE] Added several commands to redis-info to extract listening addresses, connected clients, active channels, and cluster nodes. [Vasiliy Kulikov]
[NSE][GH#679][GH#681] Refreshed script http-robtex-reverse-ip, reflecting changes at the source site (www.robtex.com). [aDoN]
[NSE][GH#620][GH#715] Added 8 new http-enum fingerprints for Hadoop infrastructure components. [Thomas Debize, Varunram Ganesh]
[NSE][GH#629] Added two new fingerprints to http-default-accounts (APC Management Card, older NetScreen ScreenOS) [Steve Benson, nnposter]
[NSE][GH#716] Fix for oracle-tns-version which was sending an invalid TNS probe due to a string escaping mixup. [Alexandr Savca]
[NSE][GH#694] ike-version now outputs information about supported attributes and unknown vendor ids. Also, a new fingerprint for FortiGate VPNs was submitted by Alexis La Goutte. [Daniel Miller]
[GH#700] Enabled support for TLS SNI on the Windows platform. [nnposter]
[GH#649] New service probe and match lines for the JMON and RSE services of IBM Explorer for z/OS. [Soldier of Fortran]
Removed a duplicate service probe for Memcached added in 2011 (the original probe was added in 2008) and reported as duplicate in 2013 by Pavel Kankovsky.
New service probe and match line for NoMachine NX Server remote desktop. [Justin Cacak]
[Zenmap] Fixed a recurring installation problem on OS X/macOS where Zenmap was installed to /Applications/Applications/Zenmap.app instead of /Applications/Zenmap.app.
[Zenmap][GH#639] Zenmap will no longer crash when no suitable temporary directory is found. Patches contributed by [Varunram Ganesh] and [Sai Sundhar]
[Zenmap][GH#626] Zenmap now properly handles the -v0 (no output) option, which was added in Nmap 7.10. Previously, this was treated the same as not specifying -v at all. [lymanZerga11]
[GH#630] Updated or removed some OpenSSL library calls that were deprecated in OpenSSL 1.1. [eroen]
[NSE] Script ssh-hostkey now recognizes and reports Ed25519 keys [nnposter]
[NSE][GH#627] Fixed script hang in several brute scripts due to the "threads" script-arg not being converted to a number. Error message was "nselib/brute.lua:1188: attempt to compare number with string" [Arne Beer]

[Windows] Updated the bundled Npcap from 0.10r9 to 0.78r5, with an improved installer experience, driver signing updates to work with Windows 10 build 1607, and bugfixes for WiFi connectivity problems. [Yang Luo, Daniel Miller]
Integrated all of your IPv4 OS fingerprint submissions from April to September (568 of them). Added 149 fingerprints, bringing the new total to 5,336. Additions include Linux 4.6, macOS 10.12 Sierra, NetBSD 7.0, and more. Highlights: http://seclists.org/nmap-dev/2016/q4/110 [Daniel Miller]
Integrated all of your service/version detection fingerprints submitted from April to September (779 of them). The signature count went up 3.1% to 11,095. We now detect 1161 protocols, from airserv-ng, domaintime, and mep to nutcracker, rhpp, and usher. Highlights: http://seclists.org/nmap-dev/2016/q4/115 [Daniel Miller]
Fix reverse DNS on Windows which was failing with the message "mass_dns: warning: Unable to determine any DNS servers." This was because the interface GUID comparison needed to be case-insensitive. [Robert Croteau]
[NSE] Added 12 NSE scripts from 4 authors, bringing the total up to 552! They are all listed at https://nmap.org/nsedoc/, and the summaries are below:
cics-enum enumerates CICS transaction IDs, mapping to screens in TN3270 services. [Soldier of Fortran]
cics-user-enum brute-forces usernames for CICS users on TN3270 services. [Soldier of Fortran]
fingerprint-strings will print the ASCII strings it finds in the service fingerprints that Nmap shows for unidentified services. [Daniel Miller]
[GH#606] ip-geolocation-map-bing renders IP geolocation data as an image via Bing Maps API. [Mak Kolybabi]
[GH#606] ip-geolocation-map-google renders IP geolocation data as an image via Google Maps API. [Mak Kolybabi]
[GH#606] ip-geolocation-map-kml records IP geolocation data in a KML file for import into other mapping software [Mak Kolybabi]
nje-pass-brute brute-forces the password to a NJE node, given a valid RHOST and OHOST. Helpfully, nje-node-brute can now brute force both of those values. [Soldier of Fortran]
[GH#557] ssl-cert-intaddr will search for private IP addresses in TLS certificate fields and extensions. [Steve Benson]
tn3270-screen shows the login screen from mainframe TN3270 Telnet services, including any hidden fields. The script is accompanied by the new tn3270 library. [Soldier of Fortran]
tso-enum enumerates usernames for TN3270 Telnet services. [Soldier of Fortran]
tso-brute brute-forces passwords for TN3270 Telnet services. [Soldier of Fortran]
vtam-enum brute-forces VTAM application IDs for TN3270 services. [Soldier of Fortran]
[NSE][GH#518] Brute scripts are faster and more accurate. New feedback and adaptivity mechanisms in brute.lua help brute scripts use resources more efficiently, dynamically changing number of threads based on protocol messages like FTP 421 errors, network errors like timeouts, etc. [Sergey Khegay]
[GH#353] New option --defeat-icmp-ratelimit dramatically reduces UDP scan times in exchange for labeling unresponsive (and possibly open) ports as "closed|filtered". Ports which give a UDP protocol response to one of Nmap's scanning payloads will be marked "open". [Sergey Khegay]
[NSE][GH#533] Removed ssl-google-cert-catalog, since Google shut off that service at some point. Reported by Brian Morin.
[NSE][GH#606] New NSE library, geoip.lua, provides a common framework for storing and retrieving IP geolocation results. [Mak Kolybabi]
[Ncat] Restore the connection success message that Ncat prints with -v. This was accidentally suppressed when not using -z.
[GH#316] Added scan resume from Nmap's XML output. Now you can --resume a canceled scan from all 3 major output formats: -oN, -oG, and -oX. [Tudor Emil Coman]
[Ndiff][GH#591] Fix a bug where hosts with the same IP but different hostnames were shown as changing hostnames between scans. Made sort stable with regard to hostnames. [Daniel Miller]
[NSE][GH#540] Add tls.servername script-arg for forcing a name to be used for TLS Server Name Indication extension. The argument overrides the default use of the host's targetname. [Bertrand Bonnefoy-Claudet]
[GH#505] Updated Russian translation of Zenmap by Alexander Kozlov.
[NSE][GH#588] Fix a crash in smb.lua when using smb-ls due to a floating-point number being passed to os.time ("bad argument"). [Dallas Winger]
[NSE][GH#596] Fix a bug in mysql.lua that caused authentication failures in mysql-brute and other scripts due to including a null terminator in the salt value. This bug affects Nmap 7.25BETA2 and later releases. [Daniel Miller]
The --open option now implies --defeat-rst-ratelimit. This may result in inaccuracies in the numbers of "Not shown:" closed and filtered ports, but only in situations where it also speeds up scan times. [Daniel Miller]
[NSE] Added known Diffie-Hellman parameters for haproxy, postfix, and IronPort to ssl-dh-params. [Frank Bergmann]
Added service probe for ClamAV servers (clam), an open source antivirus engine used in mail scanning. [Paulino Calderon]
Added service probe and UDP payload for Quick UDP Internet Connection (QUIC), a secure transport developed by Google and used with HTTP/2. [Daniel Miller]
[NSE] Enabled resolveall to run against any target provided as a hostname, so the resolveall.hosts script-arg is no longer required. [Daniel Miller]
[NSE] Revised script http-default-accounts in several ways [nnposter]:
Added 21 new fingerprints, plus broadened 5 to cover more variants.
[GH#577] It can now can test systems that return status 200 for non-existent pages.
[GH#604] Implemented XML output. Layout of the classic text output has also changed, including reporting blank usernames or passwords as "<blank>", instead of just empty strings.
Added CPE entries to individual fingerprints (where known). They are reported only in the XML output.
[NSE][GH#573] Updated http.lua to allow processing of HTTP responses with malformed header names. Such header lines are still captured in the rawheader list but skipped otherwise. [nnposter]
[GH#416] New service probe and match line for iperf3. [Eric Gershman]
[NSE][GH#555] Add Drupal to the set of web apps brute forced by http-form-brute. [Nima Ghotbi]

[Windows] Updated the bundled Npcap from 0.10r2 to 0.10r9, bringing increased stability, bug fixes, and raw 802.11 WiFi capture (unused by Nmap). Further details on these changes can be found at https://github.com/nmap/npcap/releases. [Yang Luo]
Fixed the way Nmap handles scanning names that resolve to the same IP. Due to changes in 7.30, the IP was only being scanned once, with bogus results displayed for the other names. The previous behavior is now restored. [Tudor Emil Coman]
[Nping][GH#559] Fix Nping's ability to use Npcap on Windows. A privilege check was performed too late, so the Npcap loading code assumed the user had no rights. [Yang Luo, Daniel Miller]
[GH#350] Fix an assertion failure due to floating point error in equality comparison, which triggered mainly on OpenBSD:
assertion "diff

[GH#376] Windows binaries are now code-signed with our "Insecure.Com LLC" SHA256 certificate. This should give our users extra peace-of-mind and avoid triggering Microsoft's ever-increasing security warnings.
[NSE] Upgraded NSE to Lua 5.3, adding bitwise operators, integer data type, a utf8 library, and native binary packing and unpacking functions. Removed bit library, added bits.lua, replaced base32, base64, and bin libraries. [Patrick Donnelly]
[NSE] Added 2 NSE scripts, bringing the total up to 534! They are both listed at https://nmap.org/nsedoc/, and the summaries are below:
oracle-tns-version decodes the version number from Oracle Database Server's TNS listener. [Daniel Miller]
clock-skew analyzes and reports clock skew between Nmap and services that report timestamps, grouping hosts with similar skews. [Daniel Miller]
Integrated all of your service/version detection fingerprints submitted from January to April (578 of them). The signature count went up 2.2% to 10760. We now detect 1122 protocols, from elasticsearch, fhem, and goldengate to ptcp, resin-watchdog, and siemens-logo. [Daniel Miller]
[Nsock][GH#148] New, very fast IOCP Nsock engine uses "Overlapped I/O" to improve performance of version scan and NSE against many targets on Windows. [Tudor Emil Coman]
[Zenmap][GH#449] Fix a crash when closing Zenmap due to a read-only zenmap.conf. User will be warned that config cannot be saved and that they should fix the file permissions. [Daniel Miller]
[NSE] Fix a crash when parsing TLS certificates that OpenSSL doesn't support, like DH certificates or corrupted certs. When this happens, ssl-enum-ciphers will label the ciphersuite strength as "unknown." Reported by Bertrand Bonnefoy-Claudet. [Daniel Miller]
[NSE] Fixed a bug in ssl-enum-ciphers and ssl-dh-params which caused them to not output TLSv1.2 info with DHE ciphersuites or others involving ServerKeyExchange messages. [Daniel Miller]
[NSE][GH#531] Fix two issues in sslcert.lua that prevented correct operations against LDAP services when version detection or STARTTLS were used. [Tom Sellers]
[Zenmap] Long-overdue Spanish language translation has been added! Muy bien! [Vincent Dumont, Marta Garcia De La Paz, Paulino Calderon, Patricio Castagnaro]
[GH#426] Remove a workaround for lack of selectable pcap file descriptors on Windows, which required including pcap-int.h and locking us to a single version of libpcap. The new method, using WaitForSingleObject should work with all versions of both WinPcap and Npcap. [Daniel Miller]
[NSE][GH#234] Added a --script-timeout option for limiting run time for every individual NSE script. [Abhishek Singh]
[Ncat][GH#444] Added a -z option to Ncat. Just like the -z option in traditional netcat, it can be used to quicky check the status of a port. Port ranges are not supported. [Abhishek Singh]
Fix checking of Npcap/WinPcap presence on Windows so that "nmap -A" and "nmap" with no options result in the same behaviors as on Linux (and no crashes) [Daniel Miller]
[NSE] ssl-enum-ciphers will now warn about 64-bit block ciphers in CBC mode, which are vulnerable to the SWEET32 attack.
[NSE][GH#117] tftp-enum now only brute-forces IP-address-based Cisco filenames when the wordlist contains "{cisco}". Previously, custom wordlists would still end up sending these extra 256 requests. [Sriram Raghunathan]
[GH#472] Avoid an unnecessary assert failure in timing.cc when printing estimated completion time. Instead, we'll output a diagnostic error message:
Timing error: localtime(n) is NULL
where "n" is some number that is causing problems. [Jean-Guilhem Nousse]
[NSE][GH#519] Removed the obsolete script ip-geolocation-geobytes. [Paulino Calderon]
[NSE] Added 9 new fingerprints for script http-default-accounts. (Motorola AP, Lantronix print server, Dell iDRAC6, HP StorageWorks, Zabbix, Schneider controller, Xerox printer, Citrix NetScaler, ESXi hypervisor) [nnposter]
[NSE] Completed a refresh and validation of almost all fingerprints for script http-default-accounts. Also improved the script speed. [nnposter]
[GH#98] Added support for decoys in IPv6. Earlier we supported decoys only in IPv4. [Abhishek Singh]
Various performance improvements for large-scale high-rate scanning, including increased ping host groups, faster probe matching, and ensuring data types can handle an Internet's-worth of targets. [Tudor Emil Coman]
[GH#484] Allow Nmap to compile on some older Red Hat distros that disable EC crypto support in OpenSSL. [Jeroen Roovers, Vincent Dumont]
[GH#439] Nmap now supports OpenSSL 1.1.0-pre5 and previous versions. [Vincent Dumont]
[Ncat] Fix a crash ("add_fdinfo() failed.") when --exec was used with --ssl and --max-conns, due to improper accounting of file descriptors. [Daniel Miller]
FTP Bounce scan: improved some edge cases like anonymous login without password, 500 errors used to indicate port closed, and timeouts for LIST command. Also fixed a 1-byte array overrun (read) when checking for privileged ports. [Daniel Miller]
[GH#140] Allow target DNS names up to 254 bytes. We previously imposed an incorrect limit of 64 bytes in several parts of Nmap. [Vincent Dumont]
[NSE] The hard limit on number of concurrently running scripts can now increase above 1000 to match a high user-set --min-parallelism value. [Tudor Emil Coman]
[NSE] Solved a memory corruption issue that would happen if a socket connect operation produced an error immediately, such as Network Unreachable. The event handler was throwing a Lua error, preventing Nsock from cleaning up properly, leaking events. [Abhishek Singh, Daniel Miller]
[NSE] Added the datetime library for performing date and time calculations, and as a helper to the clock-skew script.
[GH#103][GH#364] Made Nmap's parallel reverse DNS resolver more robust, fully handling truncated replies. If a response is too long, we now fall back to using the system resolver to answer it. [Abhishek Singh]
[Zenmap][GH#279] Added a legend for the Topography window. [Suraj Hande]

[NSE][GH#365] Added sslv2-drown for detecting vulnerability to the DROWN attack, including CVE-2016-0703 and CVE-2016-0704 that enable fast attacks on OpenSSL. [Bertrand Bonnefoy-Claudet]
[NSE] Added http-mcmp for detecting mod_cluster Management Protocol (MCMP) and dumping its configuration. [Frank Spierings]
[Nping] Nping is now fully compatible with Npcap. [Daniel Miller]
[GH#279][Zenmap] Added a legend for the Topography window. [Suraj Hande]
[NSE] Added clamav-exec to detect ClamAV servers vulnerable to unauthorized clamav command execution. [Paulino Calderon]
[NSE] Added http-aspnet-debug to detect ASP.NET applications with debugging enabled. Script submitted by Josh Amishav-Zlatin. [Paulino Calderon]
Nmap can now make full use of Npcap, the Nmap Project's packet sniffing library for Windows. Most notably, this enables SYN scan and OS detection against localhost. [Yang Luo]
[NSE] Fix a crash that happened when trying to print the percent done of 0 NSE script threads:
timing.cc:710 bool ScanProgressMeter::printStats(double, const timeval*): Assertion 'ltime' failed.
This would happen if no scripts were scheduled in a scan phase and the user pressed a key or specified a short --stats-every interval. Reported by Richard Petrie. [Daniel Miller]
[NSE] ssl-enum-ciphers will give a failing score to any server with an RSA certificate whose public key uses an exponent of 1. [Daniel Miller]
Update oldest supported Windows version to Vista (Windows 6.0). This enables the use of the poll Nsock engine. [Daniel Miller]
[GH#345][Zenmap] On Windows, save Zenmap's stderr output to a writeable location (%LOCALAPPDATA%\zenmap.exe.log or %TEMP%\zenmap.exe.log) instead of next to the zenmap.exe executable. This avoids a warning message when closing Zenmap if it produced any stderr output. [Daniel Miller]
[GH#379][NSE] Fix http-iis-short-name-brute to report non vulnerable hosts. Reported by alias1. [Paulino Calderon]
[GH#283][Nsock] Avoid "unknown protocol:0" debug messages and an "Unknown address family 0" crash on Windows and other platforms that do not set the src_addr argument to recvfrom for TCP sockets. [Daniel Miller]
[NSE][GH#371] Fix mysql-audit by adding needed library requires to the mysql-cis.audit file. The script would fail with "Failed to load rulebase" message. [Paolo Perego]
Retrieve the correct network prefix length for an adapter on Windows. If more than one address was configured on an adapter, the same prefix length would be used for both. This incorrect behavior is still used on Windows XP and earlier. Reported by Niels Bohr. [Daniel Miller]
[NSE] ssl-enum-ciphers will cap the score of an RC4-ciphersuite handshake at C and output a warning referencing RFC 7465.
Changed libdnet-stripped to avoid bailing completely when an interface is encountered with an unsupported hardware address type. Caused "INTERFACES: NONE FOUND!" bugs in Nmap whenever Linux kernel added new hardware address types. [Daniel Miller]
[NSE][GH#362] Added support for LDAP over udp to ldap-rootdse.nse. Also added version detection and information extraction to match the new LDAP LDAPSearchReq and LDAPSearchReqUDP probes. [Tom Sellers]
[GH#354] Added new version detection Probes for LDAP services, LDAPSearchReq and LDAPSearchReqUDP. The second is Microsoft Active Directory specific. The Probes will elicit responses from target services that allow better finger -printing and information extraction. Also added nmap-payload entry for detecting LDAP on udp. [Tom Sellers]
[NSE] Added vnc-title for logging in to VNC servers and grabbing the desktop title, geometry, and color depth. [Daniel Miller]
[NSE] More VNC updates: Support for VeNCrypt and Tight auth types, output of authentication sub-types in vnc-info, and all zero-authentication types are recognized and reported. [Daniel Miller]
[NSE] Update to enable smb-os-discovery to augment version detection for certain SMB related services using data that the script discovers. [Tom Sellers]
Improved version detection and descriptions for Microsoft and Samba SMB services. Also addresses certain issues with OS identification. [Tom Sellers]

[NSE] VNC updates including vnc-brute support for TLS security type and negotiating a lower RFB version if the server sends an unknown higher version. [Daniel Miller]
[NSE] Added STARTTLS support for VNC, NNTP, and LMTP [Daniel Miller]
Added new service probes and match lines for OpenVPN on UDP and TCP.

[NSE] Added 12 NSE scripts from 7 authors, bringing the total up to 527! They are all listed at https://nmap.org/nsedoc/, and the summaries are below (authors are listed in brackets):
[GH#322] http-apache-server-status parses the server status page of Apache's mod_status. [Eric Gershman]
http-vuln-cve2013-6786 detects a XSS and URL redirection vulnerability in Allegro RomPager web server. Also added a fingerprint for detecting CVE-2014-4019 to http-fingerprints.lua. [Vlatko Kosturjak]
[GH#226] http-vuln-cve2014-3704 detects and exploits the "Drupalgeddon" pre-auth SQL Injection vulnerability in Drupal. [Mariusz Ziulek]
imap-ntlm-info extracts hostname and sometimes OS version from NTLM-auth-enabled IMAP services. [Justin Cacak]
ipv6-multicast-mld-list discovers IPv6 multicast listeners with MLD probes. The discovery is the same as targets-ipv6-multicast-mld, but the subscribed addresses are decoded and listed. [Alexandru Geana, Daniel Miller]
ms-sql-ntlm-info extracts OS version and sometimes hostname from MS SQL Server instances via the NTLM challenge message. [Justin Cacak]
nntp-ntlm-info extracts hostname and sometimes OS version from NTLM-auth-enabled NNTP services. [Justin Cacak]
pop3-ntlm-info extracts hostname and sometimes OS version from NTLM-auth-enabled POP3 services. [Justin Cacak]
rusers retrieves information about logged-on users from the rusersd RPC service. [Daniel Miller]
[GH#333] shodan-api queries the Shodan API (https://www.shodan.io) and retrieves open port and service info from their Internet-wide scan data. [Glenn Wilkinson]
smtp-ntlm-info extracts hostname and sometimes OS version from NTLM-auth-enabled SMTP and submission services. [Justin Cacak]
telnet-ntlm-info extracts hostname and sometimes OS version from NTLM-auth-enabled Telnet services. [Justin Cacak]
Integrated all of your IPv4 OS fingerprint submissions from October to January (536 of them). Added 104 fingerprints, bringing the new total to 5089. Additions include Linux 4.2, more Windows 10, IBM i 7, and more. Highlights: http://seclists.org/nmap-dev/2016/q1/270 [Daniel Miller]
Integrated all of your service/version detection fingerprints submitted from October to January (508 of them). The signature count went up 2.2% to 10532. We now detect 1108 protocols, from icy, finger, and rtsp to ipfs, basestation, and minecraft-pe. Highlights: http://seclists.org/nmap-dev/2016/q1/271 [Daniel Miller]
Integrated all 12 of your IPv6 OS fingerprint submissions from October to January. The classifier added 3 new groups, including new and expanded groups for OS X, bringing the new total to 96. Highlights: http://seclists.org/nmap-dev/2016/q1/273 [Daniel Miller]
[NSE] Upgrade to http-form-brute allowing correct handling of token-based CSRF protections and cookies. Also, a simple database of common login forms supports Django, Wordpress, MediaWiki, Joomla, and others. [Daniel Miller]
[Zenmap] [GH#247] Remember window geometry (position and size) from the previous time Zenmap was run. [isjing]
New service probe for CORBA GIOP (General Inter-ORB Protocol) detection should elicit a not-found exception from GIOP services that do not respond to non-GIOP probes. [Quentin Hardy]
[GH#284] Fix retrieval of route netmasks on FreeBSD. IPv6 routes were given /32 netmasks regardless of actual netmask configured, resulting in failed routing. Reported by Martin Gysi. [Daniel Miller]
[GH#272][GH#269] Give option parsing errors after the usage statement, or avoid printing the usage statement in some cases. The options summary has grown quite large, requiring users to scroll to the top to see the error message. [Abhishek Singh]
[GH#249][Nsock] Avoid a crash on Windows reported by users using Zenmap's Slow Comprehensive Scan profile. In the case of unknown OpenSSL errors, ERR_reason_error_string would return NULL, which could not be printed with the "%s" format string. Reported by Dan Baxter. [Gisle Vanem, Daniel Miller]
[GH#293][Zenmap] Fix a regression in our build that caused copy-and-paste to not work in Zenmap on Windows.
Changed Nmap's idea of reserved and private IP addresses to include 169.254/16 (RFC3927) and remove 6/8, 7/8, and 55/8 networks. This list, in libnetutil's isipprivate function, is used to filter -iR randomly generated targets. The newly-valid address ranges belong to the U.S. Department of Defense, so users wanting to avoid those ranges should use their own exclusion lists with --exclude or --exclude-file. [Bill Parker, Daniel Miller]
Allow the -4 option for Nmap to indicate IPv4 address family. This is the default, and using the option doesn't change anything, but does make it more explicit which address family you want to scan. Using -4 with -6 is an error. [Daniel Miller]
[GH#265] When provided a verbosity of 0 (-v0), Nmap will not output any text to the screen. This happens at the time of argument parsing, so the usual meaning of "verbosity 0" is preserved. [isjing]
[NSE][GH#314] Fix naming of SSL2_RC2_128_CBC_WITH_MD5 and SSL2_RC2_128_CBC_EXPORT40_WITH_MD5 ciphers in sslv2 in order to match the draft specification from Mozilla. [Bertrand Bonnefoy-Claudet]
[NSE][GH#320] Add STARTTLS support to sslv2 to enable SSLv2 detection against services that are not TLS encrypted by default but that support post connection upgrade. This will enable more comprehensive detection of SSLv2 and DROWN (CVE-2016-0800) attack oracles. [Tom Sellers]
[NSE][GH#301] Added default credential checks for RICOH Web Image Monitor and BeEF to http-default-accounts. [nnposter]
Properly display Next-hop MTU value from ICMP Type 3 Code 4 Fragmentation Required messages when tracing packets or in Nping output. Improper offset meant we were printing the total IP length. [S?awomir Demeszko]
[NSE] Added support for DHCP options "TFTP server name" and "Bootfile name" to dhcp.lua and enabled checking for options with a code above 61 by default. [Mike Rykowski]
[NSE] whois-ip: Don't request a remote IANA assignments data file when the local filesystem will not permit the file to cached in a local file. [jah]
[NSE] Updated http-php-version hash database to cover all versions from PHP 4.1.0 to PHP 5.4.45. Based on scans of a few thousand PHP web servers pulled from Shodan API (https://www.shodan.io/) [Daniel Miller]
Use the same ScanProgressMeter for FTP bounce scan (-b) as for the other scan types, allowing periodic status updates with --stats-every or keypress events. [Daniel Miller]
[GH#274] Use a shorter pcap_select timeout on OpenBSD, just as we do for OS X, old FreeBSD, and Solaris, which use BPF for packet capture and do not have properly select-able fds. Fix by OpenBSD port maintainer [David Carlier]
Print service info in grepable output for ports which are not listed in nmap-services when a service tunnel (SSL) is detected. Previously, the service info ("ssl|unknown") was not printed unless the service inside the tunnel was positively identified. http://seclists.org/nmap-dev/2015/q4/260 [Daniel Miller]
[NSE] [GH#242] Fix multiple false-positive sources in http-backup-agent. [Tom Sellers]

The Windows installer is now built with NSIS 2.47 which features LoadLibrary security hardening to prevent DLL hijacking and other unsafe use of temporary directories. Thanks to Stefan Kanthak for reporting the issue to NSIS and to us and the many other projects that use it.
[NSE] [GH#254] Update the TLSSessionRequest probe in ssl-enum-ciphers to match the one in nmap-service-probes, which was fixed previously to correct a length calculation error.
[NSE] [GH#251] Correct false positives and unexpected behavior in http-* scripts which used http.identify_404 to determine when a file was not found on the target. The function was following redirects, which could be an indication of a soft-404 response.
[NSE] [GH#241] Fix a false-positive in hnap-info when the target responds with 200 OK to any request.
[NSE] [GH#244] Fix an error response in xmlrpc-methods when run against a non-HTTP service. The expected behavior is no output.
[NSE] Fix SSN validation function in http-grep

This is the most important release since Nmap 6.00 back in May 2012! For a list of the most significant improvements and new features, see the announcement at: https://nmap.org/7
[NSE] Added 6 NSE scripts from 6 authors, bringing the total up to 515! They are all listed at https://nmap.org/nsedoc/, and the summaries are below (authors are listed in brackets):
targets-xml extracts target addresses from previous Nmap XML results files. [Daniel Miller]
[GH#232] ssl-dh-params checks for problems with weak, non-safe, and export-grade Diffie-Hellman parameters in TLS handshakes. This includes the LOGJAM vulnerability (CVE-2015-4000). [Jacob Gajek]
nje-node-brute does brute-forcing of z/OS JES Network Job Entry node names. [Soldier of Fortran]
ip-https-discover detectings support for Microsoft's IP over HTTPS tunneling protocol. [Niklaus Schiess]
[GH#165] broadcast-sonicwall-discover detects and extracts information from SonicWall firewalls. [Raphael Hoegger]
[GH#38] http-vuln-cve2014-8877 checks for and optionally exploits a vulnerability in CM Download Manager plugin for Wordpress. [Mariusz Ziulek]
[Ncat] [GH#151] [GH#142] New option --no-shutdown prevents Ncat from shutting down when it reads EOF on stdin. This is the same as traditional netcat's "-d" option. [Adam Saponara]
[NSE] [GH#229] Improve parsing in http.lua for multiple Set-Cookie headers in a single response. [nnposter]

o Fix a crash in Zenmap when using Compare Results:
AttributeError: 'NoneType' object has no attribute 'get_nmap_output'
[Daniel Miller]

o [NSE] Fix http.get_url function when used with https scheme. Previously,
plaintext http to port 443 was attempted first. [jah]

o Use a mutex on Windows to avoid a hang when accessing WinPCAP driver.
Reported by multiple users on Windows 8.1 and Windows Server 2012 R2.
Nmap hangs when the WinPCAP driver is accessed via OpenServiceA by multiple
processes at once. Users report that this change, which uses a mutex to avoid
concurrent access, fixes the hang. [Daniel Miller]

o [NSE] Enhanced reporting of elliptic curve names and strengths in
ssl-enum-ciphers. The name of the curve is now reported instead of just "ec"
[Brandon Paulsen]

o [NSE] Added knx-gateway-discover and knx-gateway-info scripts for gathering
information from multicast and unicast KNX gateways, which connect home
automation systems to IP networks. [Niklaus Schiess, Dominik Schneider]

o Disable TPACKET_V3 in our included libpcap. This version of the Linux kernel
packet ring API has problems that result in lots of lost packets. This patch
falls back to TPACKET_V2 or earlier versions if available. [nnposter]

o Output a warning when deprecated options are used, and suggest the preferred
option. Currently deprecated: -i -o -m -sP -P0 -PN -oM -sR. The warning is
only visible with -v. [Daniel Miller]

o [NSE] Added script http-ls. Parses web server directory index pages with
optional recursion. [Pierre Lalet]

o [NSE] [GH#106] Added a new NSE module, ls.lua, for accumulating and
outputting file and directory listings. The afp-ls, nfs-ls, and smb-ls
scripts have been converted to use this module. [Pierre Lalet]

o Fix Nmap's DTD, which did not recognize that the script element could contain
character data when a script returns a number or a boolean.
[Jonathan Daugherty]

o [GH#75] Normalize check targets to standard format check-*.
[Gioacchino Mazzurco]

o [GH#75] Normalize clean and distclean targets to standard format clean-* and
distclean-*. [Gioacchino Mazzurco]

o [GH#75] Normalize build targets to standard format build-*.
[Gioacchino Mazzurco]

o [NSE] Added script xmlrpc-methods. This script perfoms introspection of
xmlrpc services and lists methods and their description. [Gyanendra Mishra]

o [NSE] Removed http-email-harvest as the the new http-grep does email address
scraping by default. [Gyanendra Mishra]

o [NSE] Added script http-fetch. This script can be used to fetch all files
from the target, specific files from the target or files that match a given
pattern. [Gyanendra Mishra]

o [NSE] http-drupal-modules was renamed to http-drupal-enum. Extended to
enumerate both themesa and modules of drupal installaions. [Gyanendra Mishra]

o [GH#196] Fix raw packet sending on FreeBSD 10.0 and later. FreeBSD changed
byte order of the IPv4 stack, so SYN scan and other raw packet functions were
broken. [Edward Napiera?a] Also reported in [GH#50] by Olli Hauer.

o [NSE] Added script http-svn-enum. Enumerates users of a Subversion
repostory by examinning commit logs. [Gyanendra Mishra]

o [NSE] Added script http-svn-info. Requests information from a
Subversion repository.[Gyanendra Mishra]

o [GH#51] Added IPv6 support to nmap_mass_rdns, improved reverse DNS cache,
and refactored DNS code to improve readability and extensibility.
[Gioacchino Mazzurco]

o [NSE] Added NTLM brute support to http-brute. [Gyanendra Mishra]

o [NSE] Added NTLM authentication support to http.lua and a related function to create
an ntlm v2 session response in smbauth.lua. [Gyanendra Mishra]

o [NSE] ssl-enum-ciphers now marks cipher scores as unkown for ciphers requiring
the use of openssl when openssl is missing. [jrchamp]

o [NSE] Added builtin pattern and multiple pattern search to http-grep. [Gyanendra Mishra]

o [NSE] http-crossdomainxml is now http-cross-domain-policy and supports client access
policies and uses the new SLAXML parser. [Gyanendra Mishra]

o [NSE] Added a patch for vulns lib that allows list of tables to be submitted
to fields in the vulns report. [Jacob Gajek]

o [NSE] Added additional checks for successful PUT request in http-put.
[Oleg Mitrofanov]

o [NSE] Added an update for http-methods that checks all possible methods not in
Allow or Public header of OPTIONS response. [Gyanendra Mishra]

o [NSE] Added SLAXML, an XML parser in Lua originally written by Gavin Kistner
(a.k.a. Phrogz). [Gyanendra Mishra]

o [NSE] Added hnap-info, detects and outputs info for Home Network
Administration Protocol devices. [Gyanendra Mishra]

o [NSE] Added http-webdav-scan, which detects WebDAV servers. [Gyanendra Mishra]

o [NSE] Added tor-consensus-checker, which checks if a target is a
known Tor node. [Jiayi Ye]

Fix Nmap's DTD, which did not recognize that the script element could contain
character data when a script returns a number or a boolean.
[Jonathan Daugherty]

o [GH#75] Normalize check targets to standard format check-*.
[Gioacchino Mazzurco]

o [GH#75] Normalize clean and distclean targets to standard format clean-* and
distclean-*. [Gioacchino Mazzurco]

o [GH#75] Normalize build targets to standard format build-*.
[Gioacchino Mazzurco]

o [NSE] Added script xmlrpc-methods. This script perfoms introspection of
xmlrpc services and lists methods and their description. [Gyanendra Mishra]

o [NSE] Removed http-email-harvest as the the new http-grep does email address
scraping by default. [Gyanendra Mishra]

o [NSE] Added script http-fetch. This script can be used to fetch all files
from the target, specific files from the target or files that match a given
pattern. [Gyanendra Mishra]

o [NSE] http-drupal-modules was renamed to http-drupal-enum. Extended to
enumerate both themesa and modules of drupal installaions. [Gyanendra Mishra]

o [GH#196] Fix raw packet sending on FreeBSD 10.0 and later. FreeBSD changed
byte order of the IPv4 stack, so SYN scan and other raw packet functions were
broken. [Edward Napiera?a] Also reported in [GH#50] by Olli Hauer.

o [NSE] Added script http-svn-enum. Enumerates users of a Subversion
repostory by examinning commit logs. [Gyanendra Mishra]

o [NSE] Added script http-svn-info. Requests information from a
Subversion repository.[Gyanendra Mishra]

o [GH#51] Added IPv6 support to nmap_mass_rdns, improved reverse DNS cache,
and refactored DNS code to improve readability and extensibility.
[Gioacchino Mazzurco]

o [NSE] Added NTLM brute support to http-brute. [Gyanendra Mishra]

o [NSE] Added NTLM authentication support to http.lua and a related function to create
an ntlm v2 session response in smbauth.lua. [Gyanendra Mishra]

o [NSE] ssl-enum-ciphers now marks cipher scores as unkown for ciphers requiring
the use of openssl when openssl is missing. [jrchamp]

o [NSE] Added builtin pattern and multiple pattern search to http-grep. [Gyanendra Mishra]

o [NSE] http-crossdomainxml is now http-cross-domain-policy and supports client access
policies and uses the new SLAXML parser. [Gyanendra Mishra]

o [NSE] Added a patch for vulns lib that allows list of tables to be submitted
to fields in the vulns report. [Jacob Gajek]

o [NSE] Added additional checks for successful PUT request in http-put.
[Oleg Mitrofanov]

o [NSE] Added an update for http-methods that checks all possible methods not in
Allow or Public header of OPTIONS response. [Gyanendra Mishra]

o [NSE] Added SLAXML, an XML parser in Lua originally written by Gavin Kistner
(a.k.a. Phrogz). [Gyanendra Mishra]

o [NSE] Added hnap-info, detects and outputs info for Home Network
Administration Protocol devices. [Gyanendra Mishra]

o [NSE] Allow ssl-enum-ciphers to run on non-typical ports when it is selected
by name. It will now send a service detection probe if the port is not a
typical SSL port and version scan (-sV) was not used. [Daniel Miller]

o [NSE] Added http-webdav-scan, which detects WebDAV servers. [Gyanendra Mishra]

o [NSE] Added tor-consensus-checker, which checks if a target is a
known Tor node. [Jiayi Ye]

Fix Ncat listen mode on Solaris and other platforms where struct sockaddr does not have a sa_len member. This also affected use of the -p and -s options. Brandon Haberfeld reported the crash.
Fix a Zenmap failure ot open on OS X with the error: "dyld: Symbol not found: _iconv Referenced from: /usr/lib/libcups.2.dylib" We had to remove the DYLD_LIBRARY_PATH environment variable from zenmap_wrapper.py.
Report our https URL (https://nmap.org) in more places rather than our non-SSL one.

Integrated all of your IPv4 OS fingerprint submissions from May 2014 to February 2015 (1900+ of them). Added 281 fingerprints, bringing the new total to 4766. Addtions include Linux 3.18, Windows 8.1, OS X 10.10, Android 5.0, FreeBSD 10.1, OpenBSD 5.6, and more. Highlights: http://seclists.org/nmap-dev/2015/q2/169 [Daniel Miller]
Integrated all of your service/version detection fingerprints submitted from June 2013 to February 2015 (2500+ of them). The signature count soared over the 10000 mark, a 12% increase. We now detect 1062 protocols, from http, telnet, and ftp to jute, bgp, and slurm. Highlights: http://seclists.org/nmap-dev/2015/q2/171 [Daniel Miller]
Integrated all of your IPv6 OS fingerprint submissions from June 2013 to April 2015 (only 97 of them!). We are steadily improving the IPv6 database, but we need your submissions. The classifier added 9 new groups, bringing the new total to 90. Highlights: http://seclists.org/nmap-dev/2015/q2/170 [Daniel Miller]
Nmap now has an official bug tracker! We are using Github Issues, which you can reach from http://issues.nmap.org/. We welcome your bug reports, enhancement requests, and code submissions via the Issues and Pull Request features of Github (https://github.com/nmap/nmap), though the repository itself is just a mirror of our authoritative Subversion repository.
[Zenmap] New Chinese-language (zh) translation from Jie Jiang, new Hindi (hi) translation by Gyanendra Mishra, and updated translations for German (de, Chris Leick), Italian (it, Jan Reister), Polish (pl, Jacek Wielemborek), and French (fr, MaZ)
Added options --data and --data-string to send custom payloads in scan packet data. [Jay Bosamiya]
--reason is enabled for verbosity > 2, and now includes the TTL of received packets in Normal output (this was already present in XML) [Jay Bosamiya]
Update our Windows build system to VS 2013 on Windows 8.1. Also, we now build our included OpenSSL with DEP, ASLR, and SafeSEH enabled. [Daniel Miller]
Our OS X installer is now built for a minimum supported version of 10.8 (Mountain Lion), a much-needed update from 10.5 (Leopard). Additionally, OpenSSL is now statically linked, allowing us to distribute the latest from Macports instead of being subjected to the 0.9.8 branch still in use as of 10.9. [Daniel Miller]
New features for the IPv6 OS detection engine allow for better classification of systems: IPv6 guessed initial hop limit (TTL) and ratio of TCP initial window size to maximum segment size. [Alexandru Geana]
[NSE] Rework ssl-enum-ciphers to actually score the strength of the SSL/TLS handshake, including certificate key size and DH parameters if applicable. This is similar to Qualys's SSL Labs scanner, and means that we no longer maintain a list of scores per ciphersuite. [Daniel Miller]
All nmap.org pages are now available SSL-secured to improve privacy and ensure your binaries can't be tampered with in transit. So be sure to download from https://nmap.org/download.html. We will soon remove the non-SSL version of the site. We still offer GPG-signed binaries as well: https://nmap.org/book/install.html#inst-integrity
Enhance Nmap's tcpwrapped service detection by using a shorter timeout for the tcpwrapped designation. This prevents falsely labeling services as tcpwrapped which merely have a read timeout shorter than 6 seconds. Full discussion: http://issues.nmap.org/39 [nnposter, Daniel Miller]
Fix ICMP Echo (-PE) host discovery for IPv6, broken since 6.45, caused by failing to set the ICMP ID for outgoing packets which is used to match incoming responses. [Andrew Waters]
Add 2 more ASCII-art configure splash images to be rotated randomly with the traditional dragon image. New ideas for other images to use here may be sent to dev@nmap.org. [Jay Bosamiya, Daniel Miller]
Solve a crash on Windows (reported on Windows 8.1 on Surface Pro 3) caused by passing a NULL pointer to a WinPcap function that then tries to write an error message to it. [Peter Malecka]
Fix compilation and several bugs on AIX. [Daniel Miller]
Fix a bug in libdnet-stripped on Solaris that resulted in the wrong MAC address being detected for all interfaces. http://seclists.org/nmap-dev/2015/q2/1 [Daniel Miller]
[NSE] Improved http-form-brute autodetection and behavior to handle more unusual-but-valid HTML syntax, non-POST forms, success/failure testing on HTTP headers, and more. [nnposter]
[NSE] Reduce many NSE default timeouts and base them on Nmap's detected timeouts for those hosts from the port scan phase. Scripts which take timeout script-args can now handle 's' and 'ms' suffixes, just like Nmap's own options. [Daniel Miller]
[NSE] Remove db2-discover, as its functionality was performed by service version detection since the broadcast portion was separated into broadcast-db2-discover. http://seclists.org/nmap-dev/2014/q3/415 [Daniel Miller]
Cache dnet names not found on Windows when enumerating interfaces in the Windows Registry. Reduces startup times. [Elon Natovich]
[NSE] Make smb-ls able to leverage results from smb-enum-shares or list of shares specified on command line. [Pierre Lalet]
[NSE] Fix X509 cert date parsing for dates after 2049. Reported by Teppo Turtiainen. [Daniel Miller]
Handle a bunch of socket errors that can result from odd ICMP Type 3 Destination Unreachable messages received during service scanning. The crash reported was "Unexpected error in NSE_TYPE_READ callback. Error code: 92 (Protocol not available)" [Daniel Miller]
Fixed a crash (NULL pointer dereference) in PortList::isTCPwrapped when using -sV and -O on an unknown service not listed in nmap-services. [Pierre Lalet]
Fixed a benign TOCTOU race between stat() and open() in mmapfile(). Reported by Camille Mougey. [Henri Doreau]
Reduce CPU consumption when using nsock poll engine with no registered FD, by actually calling Poll() for the time until timeout, instead of directly returning zero and entering the loop again. [Henri Doreau]
Change the URI for the fingerprint submitter to its new location at https://nmap.org/cgi-bin/submit.cgi
[NSE] Added a check for Cisco ASA version disclosure, CVE-2014-3398, to http-enum in the 'security' category [Daniel Miller]
Fixed a bug that caused Nmap to fail to find any network interface when a Prism interface is in monitor mode. The fix was to define the ARP_HRD_IEEE80211_PRISM header identifier in the libdnet-stripped code. [Brad Johnson]
Added a version probe for Tor. [David Fifield]
[NSE] Add support to citrix-enum-apps-xml for reporting if Citrix published applications in the list are enforcing/requiring the level of ICA/session data encryption shown in the script result. [Tom Sellers]
[NSE] Updated our Wordpress plugin list to improve the http-wordpress-enum NSE script. We can now detect 34,077 plugins, up from 18,570. [Danila Poyarkov]
[NSE] Add the signature algorithm that was used to sign the target port's x509 certificate to the output of ssl-cert.nse [Tom Sellers]
[NSE] Fixed a bug in the sslcert.lua library that was triggered against certain services when version detection was used. [Tom Sellers]
[NSE] vulns.Report:make_output() now generates XML structured output reports automatically. [Paulino Calderon]
[NSE] Add port.reason_ttl, host.reason, host.reason_ttl for use in scripts [Jay Bosamiya]
[NSE] If a version script is run by name, nmap.version_intensity() returns the maximum value (9) for it [Jay Bosamiya]
[NSE] shortport.version_port_or_service() takes an optional rarity parameter now to run only when version intensity > rarity [Jay Bosamiya]
[NSE] Added nmap.version_intensity() function so that NSE version scripts can use the argument to --version-intensity (which can be overridden by the script arg 'script-intensity') in order to decide whether to run or not [Jay Bosamiya]
Improve OS detection; If a port is detected to be 'tcpwrapped', then it will not be used for OS detection. This helps in cases where a firewall might be the port to be 'tcpwrapped' [Jay Bosamiya]
[Zenmap] Reduce noise generated in Topology View due to anonymous hops [Jay Bosamiya]
Added option --exclude-ports to Nmap so that some ports can be excluded from scanning (for example, due to policy) [Jay Bosamiya]
[Zenmap] Catch the MemoryError caused in Zenmap due to large Nmap Output, and display a more helpful error message [Jay Bosamiya]
Catch badly named output files (such as those unintentionally caused by "-oX -sV logfile.xml") [Jay Bosamiya]
[Zenmap] Improved NmapParser to increase speed in opening scans. Large scans now open in seconds instead of hours. [Jay Bosamiya]
Modify the included libpcap configure script to disable certain unused features: bluetooth, usb, usb-can, and dbus sniffing. Dbus support caused a build problem on CentOS 6.5. [Daniel Miller]
Updated the bundled libpcap from 1.2.1 to 1.5.3 [Jay Bosamiya]
Correct the Target MAC Address in Nmap's ARP discovery to conform to what IP stacks in currently popular operating systems use. [Jay Bosamiya]
Fixed a bug which caused Nmap to be unable to have any runtime interaction when called from sudo or from a shell script. [Jay Bosamiya]
Improvements to whois-ip.nse: fix an unhandled error when a referred-to response could not be understood; add a new pattern to recognise a LACNIC "record not found" type of response and update the way ARIN is queried. [jah]
[NSE] Added 25 NSE scripts from 17 authors, bringing the total up to 494! They are all listed at https://nmap.org/nsedoc/, and the summaries are below (authors are listed in brackets):
bacnet-info gets device information from SCADA/ICS devices via BACnet (Building Automation and Control Networks) [Stephen Hilt, Michael Toecker]
docker-version detects and fingerprints Docker [Claudio Criscione]
enip-info gets device information from SCADA/ICS devices via EtherNet/IP [Stephen Hilt]
fcrdns performs a Forward-confirmed Reverse DNS lookup and reports anomalous results. [Daniel Miller]
http-avaya-ipoffice-users enumerates users in Avaya IP Office 7.x systems. [Paulino Calderon]
http-cisco-anyconnect gets version and tunnel information from Cisco SSL VPNs. [Patrik Karlsson]
http-crossdomainxml detects overly permissive crossdomain policies and finds trusted domain names available for purchase. [Paulino Calderon]
http-shellshock detects web applications vulnerable to Shellshock (CVE-2014-6271). [Paulino Calderon]
http-vuln-cve2006-3392 exploits a file disclosure vulnerability in Webmin. [Paul AMAR]
http-vuln-cve2014-2126, http-vuln-cve2014-2127, http-vuln-cve2014-2128 and http-vuln-cve2014-2129 detect specific vulnerabilities in Cisco AnyConnect SSL VPNs. [Patrik Karlsson]
http-vuln-cve2015-1427 detects Elasticsearch servers vulnerable to remote code execution. [Gyanendra Mishra]
http-vuln-cve2015-1635 detects Microsoft Windows systems vulnerable to MS15-034. [Paulino Calderon]
http-vuln-misfortune-cookie detects the "Misfortune Cookie" vulnerability in Allegro RomPager 4.07, commonly used in SOHO routers for TR-069 access. [Andrew Orr]
http-wordpress-plugins was renamed http-wordpress-enum and extended to enumerate both plugins and themes of Wordpress installations and their versions. http-wordpress-enum is now http-wordpress-users. [Paulino Calderon]
mikrotik-routeros-brute performs password auditing attacks against Mikrotik's RouterOS API. [Paulino Calderon]
omron-info gets device information from Omron PLCs via the FINS service. [Stephen Hilt]
s7-info gets device information from Siemens PLCs via the S7 service, tunneled over ISO-TSAP on TCP port 102. [Stephen Hilt]
snmp-info gets the enterprise number and other information from the snmpEngineID in an SNMPv3 response packet. [Daniel Miller]
ssl-ccs-injection detects whether a server is vulnerable to the SSL/TLS CCS Injection vulnerability (CVE-2014-0224) [Claudiu Perta]
ssl-poodle detects the POODLE bug in SSLv3 (CVE-2014-3566) [Daniel Miller]
supermicro-ipmi-conf exploits Supermicro IPMI/BMC controllers. [Paulino Calderon]
targets-ipv6-map4to6 generates target IPv6 addresses which correspond to IPv4 addresses mapped within a particular IPv6 subnet. [Ra?l Fuentes]
targets-ipv6-wordlist generates target IPv6 addresses from a wordlist made of hexadecimal characters. [Ra?l Fuentes]

Integrated all of your IPv4 OS fingerprint submissions since June 2013 (2700+ of them). Added 366 fingerprints, bringing the new total to 4485.
Additions include Linux 3.10 - 3.14, iOS 7, OpenBSD 5.4 - 5.5, FreeBSD 9.2,
OS X 10.9, Android 4.3, and more. Many existing fingerprints were improved.
Upgraded the included OpenSSL to version 1.0.1i.
Upgraded the included Python to version 2.7.8.
Removed the External Entity Declaration from the DOCTYPE in Nmap's XML. This was added in 6.45, and resulted in trouble for Nmap XML parsers without
network access, as well as increased traffic to Nmap's servers. The doctype
is now:
[Ndiff] Fixed the installation process on Windows, which was missing the actual Ndiff Python module since we separated it from the driver script.
[Ndiff] Fixed the ndiff.bat wrapper in the zipfile Windows distribution, which was giving the error, "\Microsoft was unexpected at this time."
[Zenmap] Fixed the Zenmap .dmg installer for OS X. Zenmap failed to launch, producing this error:
Could not import the zenmapGUI.App module:
'dlopen(/Applications/Zenmap.app/Contents/Resources/lib/python2.6/lib-dynlo
ad/glib/_glib.so, 2):
Library not loaded: /Users/david/macports-10.5/lib/libffi.5.dylib\n
Referenced from:
/Applications/Zenmap.app/Contents/Resources/lib/python2.6/lib-dynload/glib/_glib
.so\n
Reason: image not found'.
[Ncat] Fixed SOCKS5 username/password authentication. The password length was being written in the wrong place, so authentication could not succeed.
Avoid formatting NULL as "%s" when running nmap --iflist. GNU libc converts this to the string "(null)", but it caused segfault on Solaris. [Daniel Miller]
[Zenmap][Ndiff] Avoid crashing when users have the antiquated PyXML package installed. Python tries to be nice and loads it when we import xml, but it isn't compatible. Instead, we force Python to use the standard library xml module.
Handle ICMP admin-prohibited messages when doing service version detection.
Crash reported by Nathan Stocks was: Unexpected error in NSE_TYPE_READ
callback. Error code: 101 (Network is unreachable)]
[NSE] Fix a bug causing http.head to not honor redirects.
[Zenmap] Fix a bug in DiffViewer causing this crash:
TypeError: GtkTextBuffer.set_text() argument 1 must be string or read-only buffer, not NmapParserSAX
Crash happened when trying to compare two scans within Zenmap.

[NSE] Made numerous improvements to ssl-heartbleed to provide
more reliable detection of the vulnerability.

o [Zenmap] Fixed a bug which caused this crash message:
IOError: [Errno socket error] [Errno 10060] A connection attempt failed
because the connected party did not properly respond after a period of
time, or established connection failed because connected host has
failed to
respond
The bug was caused by us adding a DOCTYPE definition to Nmap's XML
output which caused Python's XML parser to try and fetch the DTD
every time it parses an XML file. We now override that DTD-fetching
behavior. [Daniel Miller]

o [NSE] Fix some bugs which could cause snmp-ios-config and
snmp-sysdescr scripts to crash
(http://seclists.org/nmap-dev/2014/q2/120) [Patrik Karlsson]

o [NSE] Improved performance of citrixlua library when handling large XML
responses containing application lists. [Tom Sellers]

NOTE THAT THE CHANGELOG FOR THIS RELEASE IS INCOMPLETE. We plan to
finish it soon.

o [NSE] Add ssl-heartbleed script to detect the Heartbleed bug in OpenSSL
CVE-2014-0160 [Patrik Karlsson]

o [NSE] Fixed an error-handling bug in socks-open-proxy that caused it to fail
when scanning a SOCKS4-only proxy. Reported on IRC by Husky. [Daniel Miller]

o [NSE] Improved ntp-info script to handle underscores in returned
data. [nnposter]

o [NSE] Add quake1-info script for retrieving server and player information
from Quake 1 game servers. Reports potential DoS amplification factor.
[Ulrik Haugen]

o [NSE] Add unicode library for decoding and encoding UTF-8, UTF-16, CP437 and
other character sets to Unicode code points. Scripts that previously just
added or skipped nulls in UTF-16 data can use this to support non-ASCII
characters. [Daniel Miller]

o When doing a ping scan (-sn), the --open option will prevent down hosts from
being shown when -v is specified. This aligns with similar output for other
scan types. [Daniel Miller]

o [Ncat] Added support for socks5 and corresponding regression tests.
[Marek Lucaszuk, Petr Stodulka]

o [NSE] Add http-ntlm-info script for getting server information from Web
servers that require NTLM authentication. [Justin Cacak]

o Added TCP support to dns.lua. [John Bond]

o Added safe fd_set operations. This makes nmap fail gracefully instead of
crashing when the number of file descriptors grows over FD_SETSIZE. Jacek
Wielemborek reported the crash. [Henri Doreau]

o [NSE] Added tls library for functions related to SSLv3 and TLS messages.
Existing ssl-enum-ciphers, ssl-date, and tls-nextprotoneg scripts were
updated to use this library. [Daniel Miller]

o [NSE] Add sstp-discover script to discover Microsoft's Secure Socket
Tunnelling Protocol (http://msdn.microsoft.com/en-us/library/cc247338.aspx)
[Niklaus Schiess]

o [NSE] Added unittest library and NSE script for adding unit tests to NSE
libraries. See unittest.lua for examples, and run `nmap --script=unittest
--script-args=unittest.run -d` to run the tests. [Daniel Miller]

o Updated bundled liblua from 5.2.2 to 5.2.3 (bugfix release) [Daniel Miller]

o Added version detection signatures and probes for a bunch of Android
remote mouse/keyboard servers, including AndroMouse, AirHID,
Wifi-mouse, and RemoteMouse. [Paul Hemberger]

o [NSE] Added allseeingeye-info for gathering information from games
using this query protocol. A version detection probe was also
added. [Marin Mar?i?]

o [NSE] Add freelancer-info to gather information about the Freelancer
game server. Also added a related version detection probe and UDP
protocol payload for detecting the service. [Marin Mar?i?]

o [Ncat] Fixed compilation when --without-liblua is specified in
configure (an #include needed an ifdef guard). [Quentin Glidic]

o [NSE] Add http-server-header script to grab the Server header as a last-ditch
effort to get a software version. This can't be done as a softmatch because
of the need to match non-HTTP services that obey some HTTP requests. [Daniel
Miller]

o [NSE] Add rfc868-time script to get the date and time from an RFC 868 Time
server. [Daniel Miller]

o [NSE] Add weblogic-t3-info script that detects the T3 RMI protocol used by
Oracle/BEA Weblogic. Extracts the Weblogic version, as well [Alessandro
Zanni, Daniel Miller]

o Fixed a bug in libdnet with handling interfaces with AF_LINK addresses on
FreeBSD >9 reported by idwer on IRC. Likely affected other *BSDs. Handled by
skipping these non-network addresses. [Daniel Miller]

o Fixed a bug with UDP checksum calculation. When the UDP checksum is zero
(0x0000), it must be transmitted as 1's-complement -0 (0xffff) to avoid
ambiguity with +0, which indicates no checksum was calculated. This affected
UDP on IPv4 only. Reported by Michael Weber. [Daniel Miller]

o [NSE] Removed a fixed value (28428) which was being set for the Request ID in
the snmpWalk library function; a value based on nmap.clock_ms will now be set
instead. [jah]

o [NSE] Add http-iis-short-name-brute script that detects Microsoft IIS
servers vulnerable to a file/folder name disclosure and a denial of
service vulnerability. The script obtains the "shortnames" of the
files and folders in the webroot folder. [Paulino Calderon]

o Idle scan now supports IPv6. IPv6 packets don't usually come with
fragments identifiers like IPv4 packets do, so new techniques had to
be developed to make idle scan possible. The implementation is by
Mathias Morbitzer, who made it the subject of his master's thesis.

o [NSE] Add http-dlink-backdoor script that detects DLink routers with firmware
backdoor allowing admin access over HTTP interface. [Patrik Karlsson]

o The ICMP ID of ICMP probes is now matched against the sent ICMP ID,
to reduce the chance of false matches. Patch by Chris Johnson.

o [NSE] Made telnet-brute support multiple parallel guessing threads,
reuse connections, and support password-only logins. [nnposter]

o [NSE] Made the table returned by ssh1.fetch_host_key contain a "key"
element, like that of ssh2.fetch_host_key. This fixed a crash in the
ssh-hostkey script reported by Dan Farmer and Florian Pelgrim. The
"key" element of ssh2.fetch_host_key now is base64-encoded, to match
the format used by the known_hosts file. [David Fifield]

o [Nsock] Handle timers and timeouts via a priority queue (using a heap)
for improved performance. Nsock now only iterates over events which are
completed or expired instead of inspecting the entire event set at each
iteration. [Henri Doreau]

o [NSE] Update dns-cache-snoop script to use a new list of top 50
domains rather than a 2010 list. [Nicolle Neulist]

o [NSE] Added the qconn-exec script by Brendan Coles, which tests the
QNX QCONN service for remote command execution.

o [Zenmap] Fixed a crash that would happen when you entered a search
term starting with a colon: "AttributeError:
'FilteredNetworkInventory' object has no attribute 'match_'".
Reported by Kris Paernell. [David Fifield]

o [Ncat] Added NCAT_PROTO, NCAT_REMOTE_ADDR, NCAT_REMOTE_PORT, NCAT_LOCAL_ADDR
and NCAT_LOCAL_PORT environment variables being set in all --*-exec child
processes.