Nmap 5.00 Released, With Many Improvements 73
iago-vL writes "The long-awaited Nmap Security Scanner version 5.00 was just released (download)! This marks the most important release since 1997, and is a huge step in Nmap's evolution from a simple port scanner to an all-around security and networking tool suite. Significant performance improvements were made, and dozens of scripts were added. For example, Nmap can now log into Windows and perform local checks (PDF), including Conficker detection. New tools included in 5.00 are Ncat, a modern reimplementation of Netcat (with IPv6, SSL, NAT traversal, port redirection, and more!), and Ndiff, for quickly comparing scan results. Other tools are in the works for future releases, but we're still waiting for them to add email and ftp clients so we can finally get off Emacs!"
Bloat. (Score:2, Insightful)
So nmap went from a special purpose-built tool to a suite. Frack. Anyone here taking commissions on erecting a grave marker? UNIX is nice because it creates many little purpose-built utilities that can be strung together to perform complex tasks. This style of thinking seems to be going away in favor of integrated solutions that rather than doing one thing well do an umbrella of things passably okay. At least they haven't gone the approach yet of stuffing everything into a service that has to run all the ti
Re:Bloat. (Score:4, Interesting)
I think that this is exactly what they are doing, only that all the small tools are bundled in the same tarball.
Re:Bloat. (Score:5, Informative)
As the original poster, and the author of a dozen or more Nmap scripts, I agree 100%. If you look at the tool itself, you'll see that everything is fairly separate and independent, even if they share a common codebase -- between the scripting and the "bonus" tools, the core is still fairly tight.
My comment at the end about the bloat + Emacs was intended 100% as humour, not actual commentary. I'm hoping nobody took it as a legitimate stab at Nmap, because it wasn't.
Re: (Score:1, Funny)
It was, however, a legitimate stab at Emacs. This is not only acceptable but wholeheartedly encouraged.
Re: (Score:3, Informative)
When i read the summary, that's what i thought.
And to some extent, i think you might still be right.
What they've done isn't to build in Conficker detection and the like, but to enable scripting so you can extent nmap.
being able to write nmap scripts is nice, on the other hand, on the other hand, several other tools allow for scripting nmap, so i don't see the point in going the other way around it.
Re: (Score:3, Insightful)
Having to compete on feature sets, interoperability, and user satisfaction is a lot harder than claiming moral superiority. -_- This is why open source still isn't taken seriously by businesses -- the mindset of its adherents is still blatantly immature.
Nice troll you have there.
Open source gets lots of things right -- and -- lots of things wrong.
If you want to talk about competing on feature sets, interoperability and user satisfaction, well, there are quite a few packages out there that do exactly that. OF course, you always have to take into account your audience.
Development tools like gcc, autoconf, Python, Perl, Emacs, gdb, are all at the top of their class in terms of these three things. I know several people, for example, who have been using Emacs
Re:Bloat. (Score:4, Informative)
Really? Everyone I know who uses Visual Studio .Net loves it, and I frequently hear comments, even on Slashdot, how its the "One thing that Microsoft got right." I certainly enjoy using it, and scratch my head when I come across the occasional (rare) comment that its "bloated and buggy."
Of course, using the words "bloated and buggy" has become the new "I don't like it, but don't want to give any specifics." So, yeah.
Re: (Score:1)
> Really? Everyone I know who uses Visual Studio .Net loves it, and I frequently hear comments, even on Slashdot, how its the "One thing that Microsoft got right." I certainly enjoy using it, and scratch my head when I come across the occasional (rare) comment that its "bloated and buggy."
I don't know how VS is now because I haven't used it for ages, so my complaint may be outdated, but I remember trying to make some CLI applications with it years ago and finding that parts of the standard library were s
Re: (Score:2)
I was using VC 5.0 (Score:1)
> But I haven't written a CLI app in a while, and I'm mostly used to post-VC6 Visual Studio (VC6 was pretty terrible standards-wise, they even got the for-loop scoping wrong).
A _VERY_ old install CD that has been collecting dust for ages says that I was using VC++ 5.0, Enterprise Edition (I got it by working on a project with a professor in college; I don't think I've ever used it since then). So they've certainly had a long time to improve, even though I clearly remember how horribly broken it used to
Re: (Score:2)
Re: (Score:3, Informative)
But then again, these are tools written by developers, for developers, not by developers for marketeers. Say what you will about Visual Studio .NET, but I can point you at scores of people that absolutely despise it, and not for the fact that it's closed source. It's terrible bug-infested bloatware, and everyone who has ever used it knows that. (That being said, there are those that are forced to use it, of ocurse).
I've used Visual Studio 2005, 2008 and 2010 and love them all and almost everyone else where I work loves it as well.
Re: (Score:2)
Re: (Score:1)
Yeah. I'm with ya on that one. Turbo C++, at least the newer versions, are garbage.
Then again, as someone who cut his programming teeth on Turbo Pascal, I will always have a soft spot for Borland's products, even if they do suck. ;)
Re: (Score:2)
While your basic point I believe is correct your information is dreadfully dated. The original visual studio .Net you had a point with. all versions since the release of .Net 2.0 have been solid though and every programmer I've encountered loves it.
Also I'm not sure how you can say MS has stagnated development for IIS. IIS 7 is such an improvement that I can serve twice as much content as I could with IIS 6 on the same hardware. Combined with the fact that IIS has since the time of IIS5 beaten Apache at d
Re: (Score:2)
Nice troll you have there. Open source gets lots of things right -- and -- lots of things wrong.
And my only point was that the slashdot moderators (which by proxy is the slashdot readership) does not like to hear this.
Re: (Score:2)
"This is why open source still isn't taken seriously by businesses"
Twat.
Of course business doesn't take FOSS seriously, I mean, that explains perfectly why Oracle, the biggest name in databases, has it's own linux distribution.
And why IBM builds its software for RedHat and SuSE/Novell on the mainframe.
And why Google runs its search engine on a custome linux version.
Think before you speak, moron.
Re:Bloat. (Score:5, Informative)
So nmap went from a special purpose-built tool to a suite. Frack.
Step 1) Download the tarball
Step 2) Compile with '--without-ndiff --without-zenmap --without-liblua --without-ncat --without-openssl' for a classic Nmap experience
Step 3) Profit
Re: (Score:2)
Or, leave Zenmap in and see if there's really that much bloat, instability or loss of speed to have a good GUI front end for NMap. It's a pretty tight GUI - sure it adds some to load times, but unless you're just determined to prove you go back to the original unix command line days, you are halfway likely to decide you like having a GUI that is well designed for its purpose. The natural terminal display for nmap has the usual problem of terminals, that is doing multiple operations tends to push all the dat
Re: (Score:2)
Did you get all upset and angry too when you found out that g++ comes with gcc?
Re: (Score:2)
Its nice to have small, simple utilities that you can chain together. But at certain times its nice to have a larger tool that ties them all together for certain tasks. Ideally, you'd have a choice between both where appropriate (and in most cases, this isn't that difficult to accomplish). NMap strikes me as the kind of tool that can benefit from this sort of thing.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
for i in `cat foo.iplist`; do nslookup $i; done
Re: (Score:2)
Wow, and you have a 4 digit id...
While on both my SuSE box and the Mac, piping to nslookup works, if it doesn't work for you and things like "for loops" are too complicated (!?), there alternatives like good ol' xargs.
cat foo.iplist |xargs -i nslookup {}
Re: (Score:2)
You could do it like that:
while read host ; do dig $host ; done foo.iplist
But the output is ugly as sin.
ncat (Score:4, Interesting)
i was just about to check out ncat. Seems interesting. The only downside is that is can never reach the same critical mass as the vanilla nc, and hence you cannot rely on the more advanced functions on an unknown computer. would be cool though, SSL could be handy in some situations.
Re: (Score:2)
Yeah, even GNU NetCat isn't really a standard replacement. Ncat isn't likely to become one either. It's another tool, it has great features, if it's useful for you use it. I'd say Ncat's primary competitor is probably socat or cryptcat rather than vanilla nc.
Some of the best.... (Score:3)
Re: (Score:1)
Now give me money (that's what I want)
Re: (Score:2)
Re: (Score:2)
It's obviously some dark, nefarious plot to undermine our entire society using robotic tunnelling equipment.
Re:Keep beating that horse (Score:5, Informative)
Full Disclosure: I am a Nmap developer.
Despite your trollish tone, you're right that there isn't a ton of innovation coming out in just TCP port scanning. The 5.00 release has several scanning performance improvements but port scanning is still port scanning.
But as for innovation/enterprise features:
* OS Fingerprinting (second generation engine)
* Graphing (via the Zenmap front-end) of the network topology
* Service fingerprinting
* Script engine including
* Windows SMB/CIFS/RPC scripts
* Windows vulnerability detection scripts
* SQL Injection scanning script
* Telnet/HTTP/FTP/SMB brute force scripts
* Conficker detection script
* A lot more
* XML output for report generation and nice XLST file for conversion to HTML
If you want to see AI behind OS fingerprinting, then submit a patch. I'd recommend starting with a Support Vector Machine as that has shown the most promise in developer testing.
If you want to see a webapp front-end for scheduling of scans and report generation then start a project.
Nmap is an open source project and despite the release wording, does not believe in bloat. Nmap isn't Nessus and never will be. If you want a client/server architecture or webapp they will be separate tools.
I use Nmap in an enterprise environment to scan 3 /16 networks (all ports). Do you?
Re: (Score:2)
I use Nmap in an enterprise environment to scan 3 /16 networks (all ports). Do you?
you poor bastard.
I had the sad experience of working on a single /16 network once for a few years. Well, obviously not much "worked" well.
With 3 /16 networks, your life must be hell. I wouldn't trust any of the code you wrote :).
Re:Keep beating that horse (Score:4, Interesting)
Disclosure: I am an OpenVAS [openvas.org] developer...
Nmap does what it does very well. It would be a strange day that I stop using it for pentesting, in fact more likely I'll adopt some of the other tools the project has developed. Ncat in particular sounds great simply because it unifies multiple functions I currently use from other tools. The other thing I like is the NSE, great for quickly cooking up a scanner for 0day threats as we saw with Conficker check they produced.
If you want a Free Software vulnerability scanner, then support OpenVAS. The project is making quiet progress (cleaning up the code base, redesigning the architecture and most importantly adding new NVTs) and has just had a second DevCon in Germany with 16 developers from 4 continents making the trip. Nothings ever perfect but it now has NVT that are not in Nessus so if you're not using it, you're probably missing out. It's worth noting that we at OpenVAS like the nmap developments so much that a couple of the OpenVAS developers are looking to actively contribute and we're considering libnmap as a replacement for the rather fragile port / service discovery functionality we inherited.
Re: (Score:2)
Does nmap yet provide a way to update its OS fingerprints? This is the sort of thing that changes constantly, and I haven't found a good, automated way to do this, especially when using linux distribution-maintained nmap packages.
Re: (Score:2)
what do you want a TCP scanner to do? TCP scan. I fail to see how you benifit from clustering, if you know what your doing you can bash out a script that can use a cluster of computers to use nmap, but if you can't do that you don't really have enough of a clue to benifit from it. I also really dislike the idea of adaptive code in a network scanner, you can either recognise a scan as belonging to an os (or being similar) or you cant adaptive AI may workaround having outdated config files but you lose too mu
Re: (Score:3, Funny)
what sort of enterprise features do you want from a TCP scanner?
Build in Email Client, image editor, and web browser, of course. Don't you know that no special-purpose tool is complete without them?
ncat vs socat (Score:2)
ncat is still fairly limited.
socat (the 2.0 beta versions) is the best app to use for that stuff. It can use arbitrary chains of protocols, which is very useful when dealing with exotic and crazy situations like trying to tunnel stuff through multiple proxies.
http://www.dest-unreach.org/socat/socat-version2.html [dest-unreach.org]
Re: (Score:2)
socat is crazy. It supports SSL/TLS and chaining of protocols (e.g. for tunnelling) and you can use this addressing scheme as a library for your projects.
checkout the Manpage [dest-unreach.org] and the examples [dest-unreach.org]
Definitely powerful, but I found it a little picky on command-line parameters -- if you just want to do simple stuff it is not that easy to get into it.
It is significantly faster (Score:1, Informative)
Across the board I am seeing significant speed improvements over 4.85.
Congratulations to the developers this looks like another quality release. I am looking forward to testing some of the new features to determine what additional capabilities can be added to our online scanning.
* Full disclosure - I run HackerTarget.com *
A thousand HP Directjet boxes cry out in pain ... (Score:4, Interesting)
Nmap and similar tools will show you that what in the past was called "enterprise" was simply becuase the vendors assumed you had a lot of expendable guys in red to throw at any problem. It can show you where there is none of the security the sales guy said was there.
Re:A thousand HP Directjet boxes cry out in pain . (Score:2)
Or, alternatively, putting in the bin...
Re:A thousand HP Directjet boxes cry out in pain . (Score:1)
What do you mean by "killed"? The machine stops working forever?
Now this isn't the same scenario, but i have a Westell DSL modem + router combo that gets disconnected from the network and resets itself when i do a portscan of my ISP's network. I RTFM'd and tried the --scan-delay option, which fixed the disconnection and reset issue i was having. My theory is that the next hop had a threshold-based security feature, or the ISP had flaky hardware that couldn't handle the storm of packets.
Re: (Score:2)
Sadly yes, everything apart from the power light, it appears the firmware was flashed and filled with rubbish. HP Directjet EX Plus printserver - expensive piece of utter garbage that can really be replaced with other stuff but there are still a few around. Some HP printers and an Oce plotter required a reset to factory settings after a port scan but ran again after that. Quite an embarrassing first week at a new site but it turned up a root
netcat /email (Score:1, Informative)
Fyodor added ncat, which means you've *already* got ftp and email support. Now I bet you're gonna complain that ftp & email are hard or something, when you have to hand type the bytes...
Oh, cool! (Score:2)
I'm sure movie producers everywhere [nmap.org] are pleased to hear this.
"Damnit, Eddie, that version of nmap is out of date!"