First Nmap SOC release! Nmap 4.22SOC1

[Fyodor <fyodor () insecure org>]

Hi Everyone!  I'm happy to put out the first test release with all of
the SoC changes we've seen over the past couple of months!  There are
some huge changes, so I'm sure this release will have some gotchas.
But it has worked in my testing on Linux and Windows this morning.  So
please give it a try and report any problems to nmap-dev!  If any
serious issues crop up, we'll try to fix them for a new release this
coming week.  For now this release is in the Nmap dist directory but
not listed on the download page.  I'll give you guys a day or two to
chew on it first.

The changes are immense (described in detail below).  We're talking
integration of the UMIT frontend in the tarball (this is the most
experimental part), an overhauled port selection mechanism by which
lets you scan just the statistically most common ports, tons of new
Nmap Scripting Engine (NSE) scripts (31 now), the --reason option,
tons of new OS and version detection signatures, the NSE Library which
lets you write common routines in C or LUA and make them available to
all NSE scripts, and much more!

Here are the goods in the usual formats:

http://download.insecure.org/nmap/dist/nmap-4.22SOC1.tar.bz2
http://download.insecure.org/nmap/dist/nmap-4.22SOC1-setup.exe
http://download.insecure.org/nmap/dist/nmap-4.22SOC1-win32.zip
http://download.insecure.org/nmap/dist/nmap-4.22SOC1-1.src.rpm
http://download.insecure.org/nmap/dist/nmap-4.22SOC1-1.i386.rpm
http://download.insecure.org/nmap/dist/nmap-frontend-4.22SOC1-1.i386.rpm
http://download.insecure.org/nmap/dist/nmap-4.22SOC1-1.x86_64.rpm
http://download.insecure.org/nmap/dist/nmap-frontend-4.22SOC1-1.x86_64.rpm
http://download.insecure.org/nmap/dist/nmap-4.22SOC1.tgz

I hope this works well for you!  And if not, we're looking forward to
your detailed description of the problem so we can fix it!

Here is a detailed list of the most important changes since 4.22SOC1:

o The UMIT graphical Nmap frontend is now included (as an ALPHA TEST
  release) with the Nmap tarball distribution.  It isn't yet in the
  RPMs or the Windows distributions.  UMIT is written with Python/GTK
  and has many huge advantages over NmapFE.  It installs from the Nmap
  source tarballs as part of the "make install" process unless you
  specify --without-umit to configure.  Please give UMIT a try (the
  executable is named umit) and let us know the results!  We hope to
  include UMIT in the Windows Nmap distributions soon.

o The port selection mechanism was overhauled.  Nmap now knows
  (roughly) how common various services are, so you can specify
  options such as --top-ports 50 to scan the 50 most popular ports.
  You can also use the new --port-ratio option to scan ports above a
  given popularity level.  You can also now give the -p option service
  names (such as 'http') and wildcards (such as http* to include
  services such as https and http-mgmt).  There is also a bracket ([])
  operator for scanning all known ports within a given range.  All
  these changes, by Doug Hoyte, are described at
  http://seclists.org/nmap-dev/2007/q2/0224.html .

o Added more Nmap Scripting Engine scripts, bringing the total to 31.
  The new ones are bruteTelnet (Eddie Bell), SMTPcommands (Jason
  DePriest), iax2Detect (Jason), nbstat (Brandon Enright),
  SNMPsysdescr (Thomas Buchanan), HTTPAuth (Thomas), finger (Eddie),
  ircServerInfo (Doug Hoyte), and MSSQLm (Thomas Buchanan).

o Added the --reason option which explains WHY Nmap assigned a port
  status.  For example, a port could be listed as "filtered" because
  no response was received, or because an ICMP network unreachable
  message was received. [ Eddie ]

o Integrated all of your 2nd generation OS detection submissions,
  increasing the database size by 68% since 4.21ALPHA4 to 699
  fingerprints.  The 2nd generation database is now nearly half (42%)
  the size of the original.  Please keep those submissions coming so
  that we can do another integration round before the SoC program ends
  on August 20!  Thanks to David Fifield for doing most of the
  integration work!

o Integrated version detection submissions.  The database has grown by
  more than 350 signatures since 4.21ALPHA4.  Nmap now has 4,236
  signatures for 432 service protocols.  As usual, Doug Hoyte deserves
  credit for the integration marathon, which he describes at
  http://hcsw.org/blog.pl .

o Added the NSE library (nselib) which is a library of useful
  functions (which can be implemented in LUA or as loadable C/C++
  modules) for use by NSE scripts.  We already have libraries for bit
  operations (bit), list operations (listop), URL fetching and
  manipulation (url), activation rules (shortport), and miscelaneous
  commonly useful functions (stdnse).  Stoiko added the underlying
  functionality, though numerous people contributed to the library
  routines.

o Added --servicedb and --versiondb command-line options which allow
  you to specify a custom Nmap services (port to port number translation
  and port frequency) file or version detection database. [ David
  Fifield ]

o The build dependencies were dramatically reduced by removing
  unneccessary header includes and moving header includes from .h
  files to .cc as well as adding some forward declarations.  This
  reduced the number of makefile.dep dependencies from 1469 to 605.
  This should make Nmap compilation faster and prevent some
  portability problems. [David Fifield]

o Upgraded from WinPcap 3.1 to WinPcap 4.01 and fixed a pcap installer
  error. [Eddie]

o In verbose mode, Nmap now reports where it obtains data files (such as
  nmap-services) from. [David Fifield]

o Canonicalized a bunch of OS classes, device types, etc. in the OS
  detection and version scanning databases so they are named
  consistently. [Doug]

o If we get a ICMP Protocol Unreachable from a host other than our
  target during a port scan, we set the state to 'filtered' rather than
  'closed'. This is consistent with how port unreachable errors work for
  udp scan. [Kris]

o Relocated OSScan warning message (could not find 1 closed and 1 open
  port). Now output.cc prints the warning along with a targets OSScan 
  results. [Eddie]

o Fixed a bug which caused port 0 to be improperly used for gen1 OS
  detection in some cases when your scan includes port 0 (it isn't
  included by default).  Thanks to Sebastian Wolfgarten for the report
  and Kris Katterjohn for the fix.

o The --iflist table now provides Winpcap device names on
  Windows. [Eddie]

o The Nmap reference guide (man page) Docbook XML source is now in the
  SVN repository at svn://svn.insecure.org/nmap/docs/refguide.xml .

o NSE now has garbage collection so that if you forget to close a
  socket before exiting a script, it is closed for you. [Stoiko]

o The <portused> tag in XML output now provides the open TCP port used
  for OS detection as well as the closed TCP and UDP ports which were
  reported previously. [Kris]

o XML output now has a <times> tag for reporting final time
  information which was already printed in normal output in verbose
  mode (round trip time, rtt variance, timeout, etc.) [Kris]

o Changed the XML output format so that the <extrareasons> tag (part
  of Eddie's --reason patch) falls within the <extraports> tag. [Kris]

o Nmap now provides more consise OS fingerprints for submission thanks
  to better merging. [David Fifield]

o A number of changes were made to the Windows build system to handle
  version numbers, publisher field, add/remove program support,
  etc. [Eddie]

o The Nmap -A optionm now enables the traceroute option too [Eddie]

o Improved how the Gen1 OS Detection system selects which UDP ports to
  send probes to.  [Kris]

o Updated nmap-mac-prefixes to latest IEEE data as of 5/18/07. Also
  removed some high (greater than 0x80) characters from some company
  names because they were causing this error on Windows when Nmap is
  compiled in Debug mode: 
  isctype.c Line 56: Expression: (unsigned)(c + 1) <= 256".
  Thanks to Sina Bahram for the initial report and Thomas Buchanan for
  tracking down the problem.

o Added a SIP (IP phone) probe from Matt Selsky to nmap-service-probes.

o Fixed a bug which prevented the NSE scripts directory from appearing
  in the Win32 .zip version of Nmap.

o Fixed a bug in Traceroute's output.  It occured when a traced host could
  be fully consolidated, but only the first hop number was outputted. [Kris]

o The new "rnd" option to -D allows you to ask Nmap to generate random
  decoy IPs rather having to specify them all yourself. [Kris]

o Fixed a Traceroute bug relating to scanning through the localhost
  interface on Windows (which previously caused a crash).  Thanks to
  Alan Jones for the report and Eddie Bell for the fix.

o Fixed a traceroute bug related to tracing between interfaces of a
  multi-homed host.  Thanks to David Fifield for reporting the problem
  and Eddie Bell for the fix.

o Service detection (-sV) and OS detection (-O) are now (rightfully)
  disabled when used with the IPProto Scan (-sO).  Using the Service
  Scan like this led to premature exiting, and the OS Scan led to gross
  inaccuracies.  [Kris]

o Updated IANA assignment IP list for random IP (-iR) generation. [Kris]


Enjoy!
-Fyodor


_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org