-
Notifications
You must be signed in to change notification settings - Fork 0
/
CHANGELOG
14611 lines (11332 loc) · 653 KB
/
CHANGELOG
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# Nmap Changelog ($Id$); -*-text-*-
o Print service info in grepable output for ports which are not listed in
nmap-services when a service tunnel (SSL) is detected. Previously, the
service info ("ssl|unknown") was not printed unless the service inside the
tunnel was positively identified. http://seclists.org/nmap-dev/2015/q4/260
[Daniel Miller]
o Extend libnetutil's isipprivate function to check for 169.254/16 RFC3927
addresses. [Bill Parker]
o New service probe for CORBA GIOP (General Inter-ORB Protocol) detection
should elicit a not-found exception from GIOP services that do not respond to
non-GIOP probes. [Quentin Hardy]
o [NSE] Added ipv6-multicast-mld-list for discovering IPv6 multicast listeners
with MLD probes. The discovery is the same as targets-ipv6-multicast-mld, but
the subscribed addresses are decoded and listed.
[Alexandru Geana, Daniel Miller]
o [NSE] [GH#226] Added http-vuln-cve2014-3704 for detecting and exploiting the
"Drupalgeddon" pre-auth SQL Injection vulnerability in Drupal. [Mariusz Ziulek]
o [NSE] [GH#242] Fix multiple false-positive sources in http-backup-agent.
[Tom Sellers]
Nmap 7.01 [2015-12-09]
o Switch to using gtk-mac-bundler and jhbuild for building the OS X installer.
This promises to reduce a lot of the problems we've had with local paths and
dependencies using the py2app and macports build system. [Daniel Miller]
o The Windows installer is now built with NSIS 2.47 which features LoadLibrary
security hardening to prevent DLL hijacking and other unsafe use of temporary
directories. Thanks to Stefan Kanthak for reporting the issue to NSIS and to
us and the many other projects that use it.
o Updated the OpenSSL shipped with our binary builds (Windows, OS X, and RPM)
to 1.0.2e.
o [Zenmap] [GH#235] Fix several failures to launch Zenmap on OS X. The new
build process eliminates these errors:
IOError: [Errno 2] No such file or directory: '/Applications/Zenmap.app/Contents/Resources/etc/pango/pangorc.in'
LSOpenURLsWithRole() failed for the application /Applications/Zenmap.app with error -10810.
o [NSE] [GH#254] Update the TLSSessionRequest probe in ssl-enum-ciphers to
match the one in nmap-service-probes, which was fixed previously to correct a
length calculation error. [Daniel Miller]
o [NSE] [GH#251] Correct false positives and unexpected behavior in http-*
scripts which used http.identify_404 to determine when a file was not found
on the target. The function was following redirects, which could be an
indication of a soft-404 response. [Tom Sellers]
o [NSE] [GH#241] Fix a false-positive in hnap-info when the target responds
with 200 OK to any request. [Tom Sellers]
o [NSE] [GH#244] Fix an error response in xmlrpc-methods when run against a
non-HTTP service. The expected behavior is no output. [Niklaus Schiess]
o [NSE] Fix SSN validation function in http-grep, reported by Bruce Barnett.
Nmap 7.00 [2015-11-19]
o This is the most important release since Nmap 6.00 back in May 2012!
For a list of the most significant improvements and new features,
see the announcement at: https://nmap.org/7
o [NSE] Added 6 NSE scripts from 6 authors, bringing the total up to 515!
They are all listed at https://nmap.org/nsedoc/, and the summaries are below
(authors are listed in brackets):
+ targets-xml extracts target addresses from previous Nmap XML results files.
[Daniel Miller]
+ [GH#232] ssl-dh-params checks for problems with weak, non-safe, and
export-grade Diffie-Hellman parameters in TLS handshakes. This includes the
LOGJAM vulnerability (CVE-2015-4000). [Jacob Gajek]
+ nje-node-brute does brute-forcing of z/OS JES Network Job Entry node names.
[Soldier of Fortran]
+ ip-https-discover detectings support for Microsoft's IP over HTTPS
tunneling protocol. [Niklaus Schiess]
+ [GH#165] broadcast-sonicwall-discover detects and extracts information from
SonicWall firewalls. [Raphael Hoegger]
+ [GH#38] http-vuln-cve2014-8877 checks for and optionally exploits a
vulnerability in CM Download Manager plugin for Wordpress. [Mariusz Ziulek]
o [Ncat] [GH#151] [GH#142] New option --no-shutdown prevents Ncat from shutting
down when it reads EOF on stdin. This is the same as traditional netcat's
"-d" option. [Adam Saponara]
o [NSE] [GH#229] Improve parsing in http.lua for multiple Set-Cookie headers in
a single response. [nnposter]
Nmap 6.49BETA6 [2015-11-03]
o Integrated all of your IPv6 OS fingerprint submissions from April to October
(only 9 of them!). We are steadily improving the IPv6 database, but we need
your submissions. The classifier added 3 new groups, bringing the new total
to 93. Highlights: http://seclists.org/nmap-dev/2015/q4/61 [Daniel Miller]
o Integrated all of your IPv4 OS fingerprint submissions from February to
October (1065 of them). Added 219 fingerprints, bringing the new total to
4985. Additions include Linux 4.1, Windows 10, OS X 10.11, iOS 9, FreeBSD
11.0, Android 5.1, and more. Highlights:
http://seclists.org/nmap-dev/2015/q4/60 [Daniel Miller]
o Integrated all of your service/version detection fingerprints submitted from
February to October (800+ of them). The signature count went up 2.5% to
10293. We now detect 1089 protocols, from afp, bitcoin, and caldav to
xml-rpc, yiff, and zebra. Highlights: http://seclists.org/nmap-dev/2015/q4/62
[Daniel Miller]
o [NSE] Added 10 NSE scripts from 5 authors, bringing the total up to 509!
They are all listed at http://nmap.org/nsedoc/, and the summaries are below
(authors are listed in brackets):
+ knx-gateway-discover and knx-gateway-info scripts gather information from
multicast and unicast KNX gateways, which connect home automation systems
to IP networks. [Niklaus Schiess, Dominik Schneider]
+ http-ls parses web server directory index pages with optional recursion.
[Pierre Lalet]
+ xmlrpc-methods perfoms introspection of xmlrpc services and lists methods
and their descriptions. [Gyanendra Mishra]
+ http-fetch can be used like wget or curl to fetch all files, specific
filenames, or files that match a given pattern. [Gyanendra Mishra]
+ http-svn-enum enumerates users of a Subversion repository by examining
commit logs. [Gyanendra Mishra]
+ http-svn-info requests information from a Subversion repository, similar to
the "svn info" command. [Gyanendra Mishra]
+ hnap-info detects and outputs info for Home Network Administration Protocol
devices. [Gyanendra Mishra]
+ http-webdav-scan detects WebDAV servers and reports allowed methods and
directory listing. [Gyanendra Mishra]
+ tor-consensus-checker checks the target's address with the Tor directory
authorities to determine if a target is a known Tor node. [Jiayi Ye]
o [NSE] Several scripts have been split, combined, or renamed:
+ [GH#171] smb-check-vulns has been split into:
* smb-vuln-conficker
* smb-vuln-cve2009-3103
* smb-vuln-ms06-025
* smb-vuln-ms07-029
* smb-vuln-regsvc-dos
* smb-vuln-ms08-067
The scripts now use the vulns library, and the "unsafe" script-arg has been
replaced by putting the scripts into the "dos" category. [Paulino Calderon]
+ http-email-harvest was removed, as the new http-grep does email address
scraping by default. [Gyanendra Mishra]
+ http-drupal-modules was renamed to http-drupal-enum. Extended to enumerate
both themes and modules of Drupal installaions. [Gyanendra Mishra]
o [Ncat] [GH#193] Fix Ncat listen mode over Unix sockets (named pipes) on OS X.
This was crashing with the error:
Ncat: getnameinfo failed: Undefined error: 0 QUITTING.
Fixed by forcing the name to "localhost" [Michael Wallner]
o [Zenmap] Fix a crash in Zenmap when using Compare Results:
AttributeError: 'NoneType' object has no attribute 'get_nmap_output'
[Daniel Miller]
o [NSE] [GH#194] Add support for reading fragmented TLS messages to
ssl-enum-ciphers. [Jacob Gajek]
o [GH#51] Added IPv6 support to nmap_mass_rdns, improved reverse DNS cache,
and refactored DNS code to improve readability and
extensibility. All in all, this makes the rDNS portion of IPv6 scans
much faster. [Gioacchino Mazzurco]
o [NSE] Added NTLM brute support to http-brute. [Gyanendra Mishra]
o [NSE] Added NTLM authentication support to http.lua and a related function to create
an ntlm v2 session response in smbauth.lua. [Gyanendra Mishra]
o [NSE] [GH#106] Added a new NSE module, ls.lua, for accumulating and
outputting file and directory listings. The afp-ls, nfs-ls, and smb-ls
scripts have been converted to use this module. [Pierre Lalet]
o [NSE] bacnet-info.nse and s7-info.nse were added to the version category.
[Paulino Calderon]
o [NSE] Added 124 new identifiers to bacnet-info.nse vendor database.
[Paulino Calderon]
o [NSE] Fixed bacnet-info.nse to bind to the service port detected
during scan instead of fixed port. [Paulino Calderon]
o [NSE] Enhanced reporting of elliptic curve names and strengths in
ssl-enum-ciphers. The name of the curve is now reported instead of just "ec"
[Brandon Paulsen]
o [GH#75] Normalize Makefile targets to use the same verb-project format, e.g.
build-ncat, check-zenmap, install-nping, clean-nsock [Gioacchino Mazzurco]
o [NSE] Added builtin pattern and multiple pattern search to http-grep. [Gyanendra Mishra]
o [NSE] http-crossdomainxml is now http-cross-domain-policy and supports client
access policies and uses the new SLAXML parser. [Gyanendra Mishra]
o [NSE] Added a patch for vulns lib that allows list of tables to be submitted
to fields in the vulns report. [Jacob Gajek]
o [NSE] Added additional checks for successful PUT request in http-put.
[Oleg Mitrofanov]
o [NSE] Added an update for http-methods that checks all possible methods not in
Allow or Public header of OPTIONS response. [Gyanendra Mishra]
o [NSE] Added SLAXML, an XML parser in Lua originally written by Gavin Kistner
(a.k.a. Phrogz). [Gyanendra Mishra]
o [NSE] [GH#122] Update the snmp-brute and other snmp-* scripts to use the
creds library to store brute-forced snmp community strings. This allows Nmap
to use the correct brute-forced string for each host. [Gioacchino Mazzurco]
o Several improvements to TLS/SSL detection in nmap-service-probes. A new
probe, TLSSessionReq, and improvements to default SSL ports should help speed
up -sV scans. http://seclists.org/nmap-dev/2015/q2/17 [Daniel Miller]
o [Nsock] Clean up the API so that nsp_* calls are now nsock_pool_* and nsi_*
are nsock_iod_*. Simplify Nsock SSL init API, and make logging global to the
library instead of associated with a nspool. [Henri Doreau]
o [GH#181] The configure script now prints a summary of configured options.
Most importantly, it warns if OpenSSL was not found, since most users will
want this library compiled in. [Gioacchino Mazzurco]
o Define TCP Options for SYN scan in nmap.h instead of literally throughout.
This string is used by p0f and other IDS to detect Nmap scans, so having it a
compile-time option is a step towards better evasion. [Daniel Miller]
o [GH#51] Nmap's parallel reverse-DNS resolver now handles IPv6 addresses. This
should result in faster -6 scans. The old behavior is available with
--system-dns. [Gioacchino Mazzurco]
o [NSE] Fix a couple odd bugs in NSE command-line parsing. Most notably,
--script broadcast-* will now work (generally, wildcards with scripts whose
name begins with a category name were not working properly). [Daniel Miller]
o [NSE] [GH#113] http-form-fuzzer will now stop increasing the size of a
request when an HTTP 413 or 414 error indicates the web server will not
accept a larger request. [Gioacchino Mazzurco]
o [NSE] [GH#159] Add the ability to tag credentials in the creds library with
freeform text for easy retrieval. This gives necessary granularity to track
credentials to multiple web apps on a single host+port. [Gioacchino Mazzurco]
Nmap 6.49BETA5 [2015-09-25]
o Work around a bug which could cause Nmap to hang when running
multiple instances at once on Windows. The actual bug appears to be
in the WinPCAP driver in that it hanges when accessed via
OpenServiceA by multiple processes at once. So for now we have added
a mutex to prevent even multiple Nmap processes from making
concurrent calls to this part of WinPcap. We've received the reports
from multiple users on Windows 8.1 and Windows Server 2012 R2 and
this fix seems to resolve the hang for them. [Daniel Miller]
o [GH#212][NSE] Fix http.get_url function which was wrongly attempting
non-SSL HTTP requests first when passed https URLs. [jah]
o [GH#201] Fix Ndiff interpreter path problems in the OS X .dmg
installer which could prevent Ndiff (and the related Zenmap "compare
results" window) from working on OS X in some cases. [Daniel Miller]
o Fix Nmap's DTD, which did not recognize that the script element
could contain character data when a script returns a number or a
boolean. [Jonathan Daugherty]
o [GH#172][NSE] Fix reporting of DH parameter sizes by
ssl-enum-ciphers. The number shown was the length in bytes, not bits
as it should have been. Reported by Michael Staruch. [Brandon
Paulsen]
o Our Windows Nmap packages are now compiled with the older platform
toolset (v120_xp rather than v120) and so they may work with Windows
XP again for the dwindling number of users still on that operating
system.
o [GH#34] Disable TPACKET_V3 in our included libpcap. This version of
the Linux kernel packet ring API has problems that result in lots of
lost packets. This patch falls back to TPACKET_V2 or earlier
versions if available. [nnposter]
o [NSE] Check for socket errors in iscsi.lua. This was causing the
iscsi-info script to crash against some services. [Daniel Miller]
o [NSE] Fix http-useragent-tester, which was using cached HTTP
responses instead of testing new User-Agent strings. [Daniel Miller]
o Output a warning when deprecated options are used, and suggest the
preferred option. Currently deprecated: -i -o -m -sP -P0 -PN -oM
-sR. The warning is only visible with -v. [Daniel Miller]
o Add a fatal error for options like -oG- which is interpreted as the
deprecated -o option, outputting to a file named "G-", instead of
the expected behavior of -oG - (Grepable output to stdout). [Daniel
Miller]
o [GH#196] Fix raw packet sending on FreeBSD 10.0 and later. FreeBSD
changed byte order of the IPv4 stack, so SYN scan and other raw
packet functions were broken. [Edward Napierała] Also reported in
[GH#50] by Olli Hauer.
o [GH#183] Fix compilation on Visual Studio 2010, which failed with
error: "service_scan.cc(2559): error C2065: 'EOPNOTSUPP' :
undeclared identifier" [Daniel Miller]
o [GH#115][NSE] ssl-enum-ciphers will still produce output if OpenSSL
(required for certificate parsing) is not available. In cases where
handshake strength depends on the certificate, it will be reported
as "unknown". [jrchamp]
Nmap 6.49BETA4 [2015-07-06]
o Fix a hang on OS X in Zenmap's Topology page with error
"zenmap_wrapper.py[857]: GError: Couldn't recognize the image file format for
file '/Applications/Zenmap.app/Contents/MacOS/../Resources/share/zenmap/pixmaps/radialnet/padlock.png'
http://seclists.org/nmap-dev/2015/q3/8 [Daniel Miller]
o Fix a small memory leak for each target specified as a hostname which fails
to resolve. [Daniel Miller]
o Allow 'make check' to succeed when Nmap is configured without OpenSSL
support. This was broken due to our NSE unittest library expecting to be able
to load every library without error. [Daniel Miller]
o [NSE] Enable ssl-enum-ciphers to safely scan servers with a long handshake
intolerance issue which resulted in incomplete results when the handshake was
greater than 255 bytes. [Jacob Gajek, Daniel Miller]
o [Ncat] Fix a write overrun in Ncat that could cause a segfault if the -g
(source route) option was given too many times. [Daniel Miller]
o [NSE] [GH#168] Allow ssl-enum-ciphers to run on non-typical ports when it is
selected by name. It will now send a service detection probe if the port is
not a typical SSL port and version scan (-sV) was not used. [Daniel Miller]
Nmap 6.49BETA3 [2015-06-25]
o [GH#166] Fix Ncat listen mode on Solaris and other platforms where struct sockaddr
does not have a sa_len member. This also affected use of the -p and -s
options. Brandon Haberfeld reported the crash. [Daniel Miller]
o [GH#164] Fix a Zenmap failure ot open on OS X with the error:
"dyld: Symbol not found: _iconv Referenced from: /usr/lib/libcups.2.dylib"
We had to remove the DYLD_LIBRARY_PATH environment variable from
zenmap_wrapper.py. Reported by Robert Strom. [Daniel Miller]
o Report our https URL (https://nmap.org) in more places rather than
our non-SSL one. [David Fifield]
o [NSE] Fix Diffie-Hellman parameter extraction in tls.lua. [Jacob Gajek]
Nmap 6.49BETA2 [2015-06-16]
o [GH#154] Fix a crash (assertion error) when Nmap recieves an ICMP Host
Unreachable message.
o [GH#158] Fix a configure failure when Python is not present, but no Python
projects were requested. [Gioacchino Mazzurco]
o [GH#161] [Zenmap] Fix Zenmap on OS X which was failing with
zipimport.ZipImportError due to architecture mismatch.
o [NSE] Remove ahbl.org checks from dnsbl.lua, since the service was shut down.
[Forrest B.]
Nmap 6.49BETA1 [2015-06-03]
o Integrated all of your IPv4 OS fingerprint submissions from May 2014 to
February 2015 (1900+ of them). Added 281 fingerprints, bringing the new total
to 4766. Addtions include Linux 3.18, Windows 8.1, OS X 10.10, Android 5.0,
FreeBSD 10.1, OpenBSD 5.6, and more. Highlights:
http://seclists.org/nmap-dev/2015/q2/169 [Daniel Miller]
o Integrated all of your service/version detection fingerprints submitted from
June 2013 to February 2015 (2500+ of them). The signature count soared over
the 10000 mark, a 12% increase. We now detect 1062 protocols, from http,
telnet, and ftp to jute, bgp, and slurm. Highlights:
http://seclists.org/nmap-dev/2015/q2/171 [Daniel Miller]
o Integrated all of your IPv6 OS fingerprint submissions from June 2013 to
April 2015 (only 97 of them!). We are steadily improving the IPv6 database,
but we need your submissions. The classifier added 9 new groups, bringing the
new total to 90. Highlights: http://seclists.org/nmap-dev/2015/q2/170 [Daniel
Miller]
o Nmap now has an official bug tracker! We are using Github Issues, which you
can reach from http://issues.nmap.org/. We welcome your bug reports,
enhancement requests, and code submissions via the Issues and Pull Request
features of Github (https://github.com/nmap/nmap), though the repository
itself is just a mirror of our authoritative Subversion repository.
o [Zenmap] New Chinese-language (zh) translation from Jie Jiang, new Hindi (hi)
translation by Gyanendra Mishra, and updated translations for German (de,
Chris Leick), Italian (it, Jan Reister), Polish (pl, Jacek Wielemborek), and
French (fr, MaZ)
o Added options --data <hex string> and --data-string <string> to send custom
payloads in scan packet data. [Jay Bosamiya]
o --reason is enabled for verbosity > 2, and now includes the TTL of received
packets in Normal output (this was already present in XML) [Jay Bosamiya]
o Fix ICMP Echo (-PE) host discovery for IPv6, broken since 6.45, caused by
failing to set the ICMP ID for outgoing packets which is used to match
incoming responses. [Andrew Waters]
o Solve a crash on Windows (reported on Windows 8.1 on Surface Pro 3) caused by
passing a NULL pointer to a WinPcap function that then tries to write an
error message to it. [Peter Malecka]
o Enhance Nmap's tcpwrapped service detection by using a shorter timeout for
the tcpwrapped designation. This prevents falsely labeling services as
tcpwrapped which merely have a read timeout shorter than 6 seconds. Full
discussion: http://issues.nmap.org/39 [nnposter, Daniel Miller]
o All nmap.org pages are now available SSL-secured to improve privacy
and ensure your binaries can't be tampered with in transit. So be
sure to download from https://nmap.org/download.html . We will soon
remove the non-SSL version of the site. We still offer GPG-signed
binaries as well: https://nmap.org/book/install.html#inst-integrity
o [NSE] Added 25 NSE scripts from 17 authors, bringing the total up to 494!
They are all listed at https://nmap.org/nsedoc/, and the summaries are below
(authors are listed in brackets):
+ bacnet-info gets device information from SCADA/ICS devices via BACnet
(Building Automation and Control Networks) [Stephen Hilt, Michael Toecker]
+ docker-version detects and fingerprints Docker [Claudio Criscione]
+ enip-info gets device information from SCADA/ICS devices via EtherNet/IP
[Stephen Hilt]
+ fcrdns performs a Forward-confirmed Reverse DNS lookup and reports
anomalous results. [Daniel Miller]
+ http-avaya-ipoffice-users enumerates users in Avaya IP Office 7.x systems.
[Paulino Calderon]
+ http-cisco-anyconnect gets version and tunnel information from Cisco SSL
VPNs. [Patrik Karlsson]
+ http-crossdomainxml detects overly permissive crossdomain policies and
finds trusted domain names available for purchase. [Paulino Calderon]
+ http-shellshock detects web applications vulnerable to Shellshock
(CVE-2014-6271). [Paulino Calderon]
+ http-vuln-cve2006-3392 exploits a file disclosure vulnerability in Webmin.
[Paul AMAR]
+ http-vuln-cve2014-2126, http-vuln-cve2014-2127, http-vuln-cve2014-2128 and
http-vuln-cve2014-2129 detect specific vulnerabilities in Cisco AnyConnect
SSL VPNs. [Patrik Karlsson]
+ http-vuln-cve2015-1427 detects Elasticsearch servers vulnerable to remote
code execution. [Gyanendra Mishra]
+ http-vuln-cve2015-1635 detects Microsoft Windows systems vulnerable to
MS15-034. [Paulino Calderon]
+ http-vuln-misfortune-cookie detects the "Misfortune Cookie" vulnerability
in Allegro RomPager 4.07, commonly used in SOHO routers for TR-069 access.
[Andrew Orr]
+ http-wordpress-plugins was renamed http-wordpress-enum and extended to
enumerate both plugins and themes of Wordpress installations and their
versions. http-wordpress-enum is now http-wordpress-users. [Paulino Calderon]
+ mikrotik-routeros-brute performs password auditing attacks against
Mikrotik's RouterOS API. [Paulino Calderon]
+ omron-info gets device information from Omron PLCs via the FINS service.
[Stephen Hilt]
+ s7-info gets device information from Siemens PLCs via the S7 service,
tunneled over ISO-TSAP on TCP port 102. [Stephen Hilt]
+ snmp-info gets the enterprise number and other information from the
snmpEngineID in an SNMPv3 response packet. [Daniel Miller]
+ ssl-ccs-injection detects whether a server is vulnerable to the SSL/TLS
CCS Injection vulnerability (CVE-2014-0224) [Claudiu Perta]
+ ssl-poodle detects the POODLE bug in SSLv3 (CVE-2014-3566) [Daniel Miller]
+ supermicro-ipmi-conf exploits Supermicro IPMI/BMC controllers. [Paulino
Calderon]
+ targets-ipv6-map4to6 generates target IPv6 addresses which correspond to
IPv4 addresses mapped within a particular IPv6 subnet. [Raúl Fuentes]
+ targets-ipv6-wordlist generates target IPv6 addresses from a wordlist made
of hexadecimal characters. [Raúl Fuentes]
o Update our Windows build system to VS 2013 on Windows 8.1. Also, we now build
our included OpenSSL with DEP, ASLR, and SafeSEH enabled. [Daniel Miller]
o Our OS X installer is now built for a minimum supported version of 10.8
(Mountain Lion), a much-needed update from 10.5 (Leopard). Additionally,
OpenSSL is now statically linked, allowing us to distribute the latest from
Macports instead of being subjected to the 0.9.8 branch still in use as of
10.9. [Daniel Miller]
o Add 2 more ASCII-art configure splash images to be rotated randomly with the
traditional dragon image. New ideas for other images to use here may be sent
to dev@nmap.org. [Jay Bosamiya, Daniel Miller]
o Solve a crash on Windows (reported on Windows 8.1 on Surface Pro 3) caused by
passing a NULL pointer to a WinPcap function that then tries to write an
error message to it. [Peter Malecka]
o Fix compilation and several bugs on AIX. [Daniel Miller]
o Fix a bug in libdnet-stripped on Solaris that resulted in the wrong MAC
address being detected for all interfaces.
http://seclists.org/nmap-dev/2015/q2/1 [Daniel Miller]
o New features for the IPv6 OS detection engine allow for better classification
of systems: IPv6 guessed initial hop limit (TTL) and ratio of TCP initial
window size to maximum segment size. [Alexandru Geana]
o [NSE] Rework ssl-enum-ciphers to actually score the strength of the SSL/TLS
handshake, including certificate key size and DH parameters if applicable.
This is similar to Qualys's SSL Labs scanner, and means that we no longer
maintain a list of scores per ciphersuite. [Daniel Miller]
o [NSE] Improved http-form-brute autodetection and behavior to handle more
unusual-but-valid HTML syntax, non-POST forms, success/failure testing on
HTTP headers, and more. [nnposter]
o [NSE] Reduce many NSE default timeouts and base them on Nmap's detected
timeouts for those hosts from the port scan phase. Scripts which take timeout
script-args can now handle 's' and 'ms' suffixes, just like Nmap's own
options. [Daniel Miller]
o [NSE] Remove db2-discover, as its functionality was performed by service
version detection since the broadcast portion was separated into
broadcast-db2-discover. http://seclists.org/nmap-dev/2014/q3/415 [Daniel
Miller]
o Cache dnet names not found on Windows when enumerating interfaces in the
Windows Registry. Reduces startup times. [Elon Natovich]
o [NSE] Make smb-ls able to leverage results from smb-enum-shares or list of
shares specified on command line. [Pierre Lalet]
o [NSE] Fix X509 cert date parsing for dates after 2049. Reported by Teppo
Turtiainen. [Daniel Miller]
o Handle a bunch of socket errors that can result from odd ICMP Type 3
Destination Unreachable messages received during service scanning. The crash
reported was "Unexpected error in NSE_TYPE_READ callback. Error code: 92
(Protocol not available)" [Daniel Miller]
o Fixed a crash (NULL pointer dereference) in PortList::isTCPwrapped when using
-sV and -O on an unknown service not listed in nmap-services. [Pierre Lalet]
o Fixed a benign TOCTOU race between stat() and open() in mmapfile().
Reported by Camille Mougey. [Henri Doreau]
o Reduce CPU consumption when using nsock poll engine with no registered FD,
by actually calling Poll() for the time until timeout, instead of directly
returning zero and entering the loop again. [Henri Doreau]
o Change the URI for the fingerprint submitter to its new location at
https://nmap.org/cgi-bin/submit.cgi
o [NSE] Added a check for Cisco ASA version disclosure, CVE-2014-3398, to
http-enum in the 'security' category [Daniel Miller]
o Fixed a bug that caused Nmap to fail to find any network interface when a
Prism interface is in monitor mode. The fix was to define the
ARP_HRD_IEEE80211_PRISM header identifier in the libdnet-stripped code.
[Brad Johnson]
o Added a version probe for Tor. [David Fifield]
o [NSE] Add support to citrix-enum-apps-xml for reporting if Citrix
published applications in the list are enforcing/requiring the level
of ICA/session data encryption shown in the script result.
[Tom Sellers]
o [NSE] Updated our Wordpress plugin list to improve the
http-wordpress-enum NSE script. We can now detect 34,077 plugins,
up from 18,570. [Danila Poyarkov]
o [NSE] Add the signature algorithm that was used to sign the target port's
x509 certificate to the output of ssl-cert.nse [Tom Sellers]
o [NSE] Fixed a bug in the sslcert.lua library that was triggered against
certain services when version detection was used. [Tom Sellers]
o [NSE] vulns.Report:make_output() now generates XML structured output
reports automatically. [Paulino Calderon]
o [NSE] Add port.reason_ttl, host.reason, host.reason_ttl for use in scripts
[Jay Bosamiya]
o [NSE] If a version script is run by name, nmap.version_intensity() returns
the maximum value (9) for it [Jay Bosamiya]
o [NSE] shortport.version_port_or_service() takes an optional rarity parameter
now to run only when version intensity > rarity [Jay Bosamiya]
o [NSE] Added nmap.version_intensity() function so that NSE version scripts
can use the argument to --version-intensity (which can be overridden by the
script arg 'script-intensity') in order to decide whether to run or not
[Jay Bosamiya]
o Improve OS detection; If a port is detected to be 'tcpwrapped', then it will
not be used for OS detection. This helps in cases where a firewall might be
the port to be 'tcpwrapped' [Jay Bosamiya]
o [Zenmap] Reduce noise generated in Topology View due to anonymous
hops [Jay Bosamiya]
o Added option --exclude-ports to Nmap so that some ports can be excluded from
scanning (for example, due to policy) [Jay Bosamiya]
o [Zenmap] Catch the MemoryError caused in Zenmap due to large Nmap Output,
and display a more helpful error message [Jay Bosamiya]
o Catch badly named output files (such as those unintentionally caused by
"-oX -sV logfile.xml") [Jay Bosamiya]
o [Zenmap] Improved NmapParser to increase speed in opening scans. Large scans
now open in seconds instead of hours. [Jay Bosamiya]
o Modify the included libpcap configure script to disable certain unused
features: bluetooth, usb, usb-can, and dbus sniffing. Dbus support caused a
build problem on CentOS 6.5. [Daniel Miller]
o Updated the bundled libpcap from 1.2.1 to 1.5.3 [Jay Bosamiya]
o Correct the Target MAC Address in Nmap's ARP discovery to conform to what IP
stacks in currently popular operating systems use. [Jay Bosamiya]
o Fixed a bug which caused Nmap to be unable to have any runtime interaction
when called from sudo or from a shell script. [Jay Bosamiya]
o Improvements to whois-ip.nse: fix an unhandled error when a referred-to
response could not be understood; add a new pattern to recognise a
LACNIC "record not found" type of response and update the way ARIN is
queried. [jah]
Nmap 6.47 [2014-08-23]
o Integrated all of your IPv4 OS fingerprint submissions since June 2013
(2700+ of them). Added 366 fingerprints, bringing the new total to 4485.
Additions include Linux 3.10 - 3.14, iOS 7, OpenBSD 5.4 - 5.5, FreeBSD 9.2,
OS X 10.9, Android 4.3, and more. Many existing fingerprints were improved.
Highlights: http://seclists.org/nmap-dev/2014/q3/325 [Daniel Miller]
o (Windows, RPMs) Upgraded the included OpenSSL to version 1.0.1i. [Daniel Miller]
o (Windows) Upgraded the included Python to version 2.7.8. [Daniel Miller]
o Removed the External Entity Declaration from the DOCTYPE in Nmap's XML. This
was added in 6.45, and resulted in trouble for Nmap XML parsers without
network access, as well as increased traffic to Nmap's servers. The doctype
is now:
<!DOCTYPE nmaprun>
o [Ndiff] Fixed the installation process on Windows, which was missing the
actual Ndiff Python module since we separated it from the driver script.
[Daniel Miller]
o [Ndiff] Fixed the ndiff.bat wrapper in the zipfile Windows distribution,
which was giving the error, "\Microsoft was unexpected at this time." See
https://support.microsoft.com/kb/2524009 [Daniel Miller]
o [Zenmap] Fixed the Zenmap .dmg installer for OS X. Zenmap failed to launch,
producing this error:
Could not import the zenmapGUI.App module:
'dlopen(/Applications/Zenmap.app/Contents/Resources/lib/python2.6/lib-dynload/glib/_glib.so, 2):
Library not loaded: /Users/david/macports-10.5/lib/libffi.5.dylib\n
Referenced from:
/Applications/Zenmap.app/Contents/Resources/lib/python2.6/lib-dynload/glib/_glib.so\n
Reason: image not found'.
o [Ncat] Fixed SOCKS5 username/password authentication. The password length was
being written in the wrong place, so authentication could not succeed.
Reported with patch by Pierluigi Vittori.
o Avoid formatting NULL as "%s" when running nmap --iflist. GNU libc converts
this to the string "(null)", but it caused segfault on Solaris. [Daniel Miller]
o [Zenmap][Ndiff] Avoid crashing when users have the antiquated PyXML package
installed. Python tries to be nice and loads it when we import xml, but it
isn't compatible. Instead, we force Python to use the standard library xml
module. [Daniel Miller]
o Handle ICMP admin-prohibited messages when doing service version detection.
Crash reported by Nathan Stocks was: Unexpected error in NSE_TYPE_READ
callback. Error code: 101 (Network is unreachable) [David Fifield]
o [NSE] Fix a bug causing http.head to not honor redirects. [Patrik Karlsson]
o [Zenmap] Fix a bug in DiffViewer causing this crash:
TypeError: GtkTextBuffer.set_text() argument 1 must be string or read-only
buffer, not NmapParserSAX
Crash happened when trying to compare two scans within Zenmap. [Daniel Miller]
Nmap 6.46 [2014-04-18]
o [NSE] Made numerous improvements to ssl-heartbleed to provide
more reliable detection of the vulnerability.
o [Zenmap] Fixed a bug which caused this crash message:
IOError: [Errno socket error] [Errno 10060] A connection attempt failed
because the connected party did not properly respond after a period of
time, or established connection failed because connected host has
failed to
respond
The bug was caused by us adding a DOCTYPE definition to Nmap's XML
output which caused Python's XML parser to try and fetch the DTD
every time it parses an XML file. We now override that DTD-fetching
behavior. [Daniel Miller]
o [NSE] Fix some bugs which could cause snmp-ios-config and
snmp-sysdescr scripts to crash
(http://seclists.org/nmap-dev/2014/q2/120) [Patrik Karlsson]
o [NSE] Improved performance of citrix.lua library when handling large XML
responses containing application lists. [Tom Sellers]
Nmap 6.45 [2014-04-11]
o Idle scan now supports IPv6. IPv6 packets don't usually come with
fragments identifiers like IPv4 packets do, so new techniques had to
be developed to make idle scan possible. The implementation is by
Mathias Morbitzer, who made it the subject of his master's thesis.
o When doing a ping scan (-sn), the --open option will prevent down hosts from
being shown when -v is specified. This aligns with similar output for other
scan types. [Daniel Miller]
o Fixed some syntax problems in nmap-os-db that were caused by some automated
merging of fingerprints (http://seclists.org/nmap-dev/2013/q4/68) [Daniel
Miller]
o New service probes and fingerprints for Quake1, TeamSpeak3, xmlsysd,
Freelancer game server, All-Seeing Eye, AndroMouse, and AirHD.
o Update included WinPcap to version 4.1.3 [Rob Nicholls]
o [NSE] Convert many more scripts to emit structured XML output
(https://nmap.org/book/nse-api.html#nse-structured-output) [Daniel Miller]
o [NSE] Added 24 NSE scripts from 12 authors, bringing the total up to 470.
They are all listed at https://nmap.org/nsedoc/, and the summaries are
below (authors are listed in brackets):
+ allseeingeye-info gathers information from games using this query protocol.
A version detection probe was also added. [Marin Maržić]
+ freelancer-info gathers information about the Freelancer game server. Also
added a related version detection probe and UDP protocol payload for
detecting the service. [Marin Maržić]
+ http-csrf detects Cross Site Request Forgeries (CSRF) vulnerabilities by
searching for CSRF tokens in HTML forms. [George Chatzisofroniou]
+ http-devframework finds out the technology behind the target website based
on HTTP headers, static URLs, and other content and resources. [George
Chatzisofroniou]
+ http-dlink-backdoor detects DLink routers with firmware backdoor allowing
admin access over HTTP interface. [Patrik Karlsson]
+ http-dombased-xss finds potential DOM-based Cross-site Scripting (XSS)
vulnerabilities by searching for specific patterns in JavaScript resources.
[George Chatzisofroniou]
+ http-errors crawls for URIs that return error status codes (HTTP 400 and
above). [George Chatzisofroniou]
+ http-feed crawls a web site for Atom and RSS feeds. [George Chatzisofroniou]
+ http-iis-short-name-brute detects Microsoft IIS servers vulnerable to a
file/folder name disclosure and a denial of service vulnerability. The
script obtains the "shortnames" of the files and folders in the webroot
folder. [Paulino Calderon]
+ http-mobileversion-checker checks for mobile versions of web pages by
setting an Android User-Agent header and checking for HTTP redirects.
[George Chatzisofroniou]
+ http-ntlm-info gets server information from Web servers that require NTLM
authentication. [Justin Cacak]
+ http-referer-checker finds JavaScript resources that are included from other
domains, increasing a website's attack surface. [George Chatzisofroniou]
+ http-server-header grabs the Server header as a last-ditch effort to get a
software version. This can't be done as a softmatch because of the need to
match non-HTTP services that obey some HTTP requests. [Daniel Miller]
+ http-useragent-tester checks for sites that redirect common Web spider
User-Agents to a different page than browsers get. [George Chatzisofroniou]
+ http-vuln-cve2013-7091 (released as http-vuln-zimbra-lfi) looks for
CVE-2013-7091, a LFI vulnerability in Zimbra. [Paul AMAR, Ron Bowes]
+ http-xssed searches the xssed.com database of Cross-site Scripting
vulnerabilities for previously-reported XSS vulnerabilities in the target.
[George Chatzisofroniou]
+ qconn-exec tests the QNX QCONN service for remote command execution.
[Brendan Coles]
+ quake1-info retrieves server and player information from Quake 1 game
servers. Reports potential DoS amplification factor. [Ulrik Haugen]
+ rfc868-time gets the date and time from an RFC 868 Time server. [Daniel
Miller]
+ ssl-heartbleed detects the Heartbleed bug in OpenSSL CVE-2014-0160 [Patrik
Karlsson]
+ sstp-discover discovers Microsoft's Secure Socket Tunnelling Protocol
(http://msdn.microsoft.com/en-us/library/cc247338.aspx) [Niklaus Schiess]
+ unittest runs unit tests found in NSE libraries. The corresponding
unittest.lua library has examples. Run `nmap --script=unittest
--script-args=unittest.run -d` to run the tests. [Daniel Miller]
+ weblogic-t3-info detects the T3 RMI protocol used by Oracle/BEA Weblogic
and extracts the Weblogic version. [Alessandro Zanni, Daniel Miller]
+ whois-ip and whois-domain replace the whois script, which previously could
only collect whois info for IP addresses. [George Chatzisofroniou]
o [NSE] Fixed an error-handling bug in socks-open-proxy that caused it to fail
when scanning a SOCKS4-only proxy. Reported on IRC by Husky. [Daniel Miller]
o [NSE] Improved ntp-info script to handle underscores in returned
data. [nnposter]
o [NSE] Add unicode library for decoding and encoding UTF-8, UTF-16, CP437 and
other character sets to Unicode code points. Scripts that previously just
added or skipped nulls in UTF-16 data can use this to support non-ASCII
characters. [Daniel Miller]
o Significant code and documentation cleanup effort, fixing file encodings,
trailing whitespace, indentation, spelling mistakes, NSEdoc formatting
issues, PEP 8 compliance for Python, deprecation cleanup under python -3,
cleanup of warnings from LLVM's AddressSanitizer. [Daniel Miller]
o [Ncat] Added support for socks5 and corresponding regression tests.
[Marek Lukaszuk, Petr Stodulka]
o Added TCP support to dns.lua. [John Bond]
o Added safe fd_set operations. This makes nmap fail gracefully instead of
crashing when the number of file descriptors grows over FD_SETSIZE. Jacek
Wielemborek reported the crash. [Henri Doreau]
o [NSE] Added tls library for functions related to SSLv3 and TLS messages.
Existing ssl-enum-ciphers, ssl-date, and tls-nextprotoneg scripts were
updated to use this library. [Daniel Miller]
o Added NSE and Zenmap unit tests to "make check" [Daniel Miller]
o [NSE] Enable http-enum to use the large Nikto fingerprint database at runtime
if provided by the user. For licensing reasons, we do not distribute this
database, but the integration effort has the blessing of the Nikto folks.
[George Chatzisofroniou]
o Updated bundled liblua from 5.2.2 to 5.2.3 (bugfix release) [Daniel Miller]
o Added version detection signatures and probes for a bunch of Android
remote mouse/keyboard servers, including AndroMouse, AirHID,
Wifi-mouse, and RemoteMouse. [Paul Hemberger]
o [Ncat] Fixed compilation when --without-liblua is specified in
configure (an #include needed an ifdef guard). [Quentin Glidic]
o Fixed a bug in libdnet with handling interfaces with AF_LINK addresses on
FreeBSD >9 reported by idwer on IRC. Likely affected other *BSDs. Handled by
skipping these non-network addresses. [Daniel Miller]
o Fixed a bug with UDP checksum calculation. When the UDP checksum is zero
(0x0000), it must be transmitted as 1's-complement -0 (0xffff) to avoid
ambiguity with +0, which indicates no checksum was calculated. This affected
UDP on IPv4 only. Reported by Michael Weber. [Daniel Miller]
o [NSE] Removed a fixed value (28428) which was being set for the Request ID in
the snmpWalk library function; a value based on nmap.clock_ms will now be set
instead. [jah]
o The ICMP ID of ICMP probes is now matched against the sent ICMP ID,
to reduce the chance of false matches. Patch by Chris Johnson.
o [NSE] Made telnet-brute support multiple parallel guessing threads,
reuse connections, and support password-only logins. [nnposter]
o [NSE] Made the table returned by ssh1.fetch_host_key contain a "key"
element, like that of ssh2.fetch_host_key. This fixed a crash in the
ssh-hostkey script reported by Dan Farmer and Florian Pelgrim. The
"key" element of ssh2.fetch_host_key now is base64-encoded, to match
the format used by the known_hosts file. [David Fifield]
o [Nsock] Handle timers and timeouts via a priority queue (using a heap)
for improved performance. Nsock now only iterates over events which are
completed or expired instead of inspecting the entire event set at each
iteration. [Henri Doreau]
o [NSE] Update dns-cache-snoop script to use a new list of top 50
domains rather than a 2010 list. [Nicolle Neulist]
o [Zenmap] Fixed a crash that would happen when you entered a search
term starting with a colon: "AttributeError:
'FilteredNetworkInventory' object has no attribute 'match_'".
Reported by Kris Paernell. [David Fifield]
o [Ncat] Added NCAT_PROTO, NCAT_REMOTE_ADDR, NCAT_REMOTE_PORT, NCAT_LOCAL_ADDR
and NCAT_LOCAL_PORT environment variables being set in all --*-exec child
processes.
Nmap 6.40 [2013-07-29]
o [Ncat] Added --lua-exec. This feature is basically the equivalent of 'ncat
--sh-exec "lua <scriptname>"' and allows you to run Lua scripts with Ncat,
redirecting all stdin and stdout operations to the socket connection. See
https://nmap.org/book/ncat-man-command-options.html [Jacek Wielemborek]
o Integrated all of your IPv4 OS fingerprint submissions since January
(1,300 of them). Added 91 fingerprints, bringing the new total to 4,118.
Additions include Linux 3.7, iOS 6.1, OpenBSD 5.3, AIX 7.1, and more.
Many existing fingerprints were improved. Highlights:
http://seclists.org/nmap-dev/2013/q2/518. [David Fifield]
o Integrated all of your service/version detection fingerprints submitted
since January (737 of them)! Our signature count jumped by 273 to 8,979.
We still detect 897 protocols, from extremely popular ones like http, ssh,
smtp and imap to the more obscure airdroid, gopher-proxy, and
enemyterritory. Highlights:
http://seclists.org/nmap-dev/2013/q3/80. [David Fifield]
o Integrated your latest IPv6 OS submissions and corrections. We're still
low on IPv6 fingerprints, so please scan any IPv6 systems you own or
administer and submit them to https://nmap.org/submit/. Both new
fingerprints (if Nmap doesn't find a good match) and corrections (if Nmap
guesses wrong) are useful. [David Fifield]
o [Nsock] Added initial proxy support to Nsock. Nmap version detection
and NSE can now establish TCP connections through chains of one or
more CONNECT or SOCKS4 proxies. Use the Nmap --proxies option with a
chain of one or more proxies as the argument (example:
http://localhost:8080,socks4://someproxy.example.com). Note that
only version detection and NSE are supported so far (no port
scanning or host discovery), and there are other limitations
described in the man page. [Henri Doreau]
o [NSE] Added 14 NSE scripts from 6 authors, bringing the total up to 446.
They are all listed at https://nmap.org/nsedoc/, and the summaries are
below (authors are listed in brackets):
+ hostmap-ip2hosts finds hostnames that resolve to the target's IP address
by querying the online database at http://www.ip2hosts.com (uses Bing
search results) [Paulino Calderon]
+ http-adobe-coldfusion-apsa1301 attempts to exploit an authentication
bypass vulnerability in Adobe Coldfusion servers (APSA13-01:
http://www.adobe.com/support/security/advisories/apsa13-01.html) to
retrieve a valid administrator's session cookie. [Paulino Calderon]
+ http-coldfusion-subzero attempts to retrieve version, absolute path of
administration panel and the file 'password.properties' from vulnerable
installations of ColdFusion 9 and 10. [Paulino Calderon]
+ http-comments-displayer extracts and outputs HTML and JavaScript
comments from HTTP responses. [George Chatzisofroniou]
+ http-fileupload-exploiter exploits insecure file upload forms in web
applications using various techniques like changing the Content-type
header or creating valid image files containing the payload in the
comment. [George Chatzisofroniou]
+ http-phpmyadmin-dir-traversal exploits a directory traversal