mailing list archives
Nmap 3.48: Service fingerprints galore!
From: Fyodor <fyodor () insecure org>
Date: Mon, 6 Oct 2003 02:23:21 -0700
-----BEGIN PGP SIGNED MESSAGE-----
I spent the last couple weeks integrating TONS of submitted service
fingerprints as well as a number of great patches (mostly portability
related) that have been sent. Wow! In the first two days after
the 3.45 release, you guys made more than 800 submissions! Now there
are nearly 2000 total. I still have more to integrate before I am
caught up, but I don't want to delay this release any
longer. Please keep the submissions coming! Even though I am behind
at the moment, I will get to all the submissions.
The service detection release has been so successful that I am
already working on the next major feature! It will be called "bomb
scan" (-sB) and utilize the technology described in this article:
I am still deciding on the command-line API for this. Considering the
severity of the attack, I might want to require an -f (force) option
like rm has. It would be a shame for people to die because a tired
sysadmin pressed -sB when he meant -sN (NULL scan). On the other
hand, UNIX was not designed to coddle the weak. If you accidently
obliterate one of your subsidiary companies with a bomb scan of their
/16, that will teach you to be more careful next time!
In more serious news, I am pleased to release Nmap 3.48. Besides
nearly DOUBLING the Nmap version detection database size to 663
signatures thanks to your submissions, this version improves some
version detection algorithms to provide more accurate results more
quickly. I have also added "helper functions" to the file format for
dealing with UNICODE encoding of normal ASCII strings and several
other strange issues. 3.48 also offers many bugfixes to resolve both
runtime errors and compilation problems.
Note that 3.46 and 3.47 were "informal" releases sent to nmap-dev for
testing. If you are interested in that sort of early release,
subscribe by sending a blank email to nmap-dev-subscribe () insecure org
. Or read the archives on http://lists.insecure.org .
As usual, 3.48 is available from
http://www.insecure.org/nmap/nmap_download.html , including Windows
(.zip format) binaries.
For the more paranoid (smart) members of the list, here are the md5
These release notes should be signed with my PGP key, which is
available at http://www.insecure.org/fyodor_gpgkey.txt . The key
fingerprint is: 97 2F 93 AB 9C B0 09 80 D9 51 40 6B B9 BC E1 7E
Enjoy! And please let me know if you find any problems. Here are the
major changes since 3.45:
o Integrated an enormous number of version detection service
submissions. The database has almost doubled in size to 663
signatures representing the following 130 services:
3dm-http afp apcnisd arkstats bittorent chargen citrix-ica
cvspserver cvsup dantzretrospect daytime dict directconnect domain
echo eggdrop exec finger flexlm font-service ftp ftp-proxy gnats
gnutella-http hddtemp hp-gsg http http-proxy hylafax icecast ident
imap imaps imsp ipp irc ircbot irc-proxy issrealsecure jabber
kazaa-http kerberos-sec landesk-rc ldap linuxconf lmtp lotusnotes
lpd lucent-fwadm meetingmaker melange microsoft-ds microsoft-rdp
mldonkey msactivesync msdtc msrpc ms-sql-m mstask mud mysql
napster ncacn_http ncp netbios-ns netbios-ssn netrek netsaint
netstat netwareip networkaudio nntp nsclient nsunicast ntop-http
omniback oracle-mts oracle-tns pcanywheredata pksd pmud pop2 pop3
pop3s poppass postgresql powerchute printer qotd redcarpet
rendezvous rlogind rpc rsync rtsp sdmsvc sftp shell shivahose
sieve slimp3 smtp smux snpp sourceoffice spamd ssc-agent ssh ssl
svrloc symantec-av symantec-esm systat telnet time tinyfw upnp
uucp veritasnetbackup vnc vnc-http vtun webster whois wins
winshell wms X11 xfce zebra
o Added the ability to execute "helper functions" in version
templates, to help clean up/manipulate data captured from a server
response. The first defined function is P() which includes only
printable characters in a captured string. The main impetus for
this is to deal with unicode strings like
"W\0O\0R\0K\0G\0R\0O\0U\0P\0" that many MS protocols send. Nmap can
now decode that into "WORKGROUP".
o Added SUBST() helper function, which replaces strings in matched
appname/version/extrainfo strings with something else. For example,
VanDyke Vshell gives a banner that includes
"SSH-2\.0-VShell_2_2_0_528". A substring match is used to pick out
the string "2_2_0_528", and then SUBST(1,"_",".") is called on that
match to form the version number 220.127.116.118.
o If responses to a probe fail to match any of the registered match
strings for that probe, Nmap will now try against the registered "null
probe" match strings. This helps in the case that the NULL probe
initially times out (perhaps because of initial DNS lookup) but the
banner appears in later responses.
o Applied some portability fixes (particularly for OpenBSD) from Chad
Loder (cloder(a)loder.us), who is also now the OpenBSD Nmap port
o Applied some portability fixes from Marius Strobl
o The tarball distribution of Nmap now strips the binary at install
time thanks to a patch from Marius Strobl
o Fixed a problem related to building Nmap on systems that lack PCRE
libs (and thus have to use the ones included by Nmap). Thanks to Remi
Denis-Courmont (deniscr6(a)cti.ecp.fr) for the repot and patch.
o Alphebetized the service names in each Probe section in
nmap-service-probes (makes them easier to find and add to).
o Fixed the problem several people reported where Nmap would quit with
a "broken pipe" error during service scanning. Thanks to Jari Ruusu
(jari.ruusu(a)pp.inet.fi) for sending a patch. The actual error
message was "Unexpected error in NSE_TYPE_READ callback. Error
code: 32 (Broken pipe)"
o Fixed protocol scan (-sO), which I had broken when adding the new
output table format. It would complain "NmapOutputTable.cc:128:
failed assertion `row < numRows'". Thanks to Matt Burnett
(marukka(a)mac.com) for notifying me of the problem.
o Upgraded Libpcap to the latest tcpdump.org version (0.7.2) from
o Applied a patch from Peter Marschall (peter(a)adpm.de) which adds
version detection support to nmapfe.
o Fixed a problem with XML output being invalid when service detection
was done on SSL-tunneled ports. Thanks to the several people who
reported this - it means that folks are actually using the XML
o Fixed (I hope) some Solaris Sune ONE compiler compilation problems
reported (w/patches) by Mikael Mannstrom (candyman(a)penti.org)
o Fixed the --with-openssl configure option for people who have
OpenSSL installed in a path not automatically found by their
compilers. Thanks to Marius Strobl (marius(a)alchemy.franken.de) for
o Made some portability changes for HP-UX and possibly other types of
machines, thanks to a patch from Petter Reinholdtsen (pere(a)hungry.com)
o Applied a patch from Matt Selsky (selsky () columbia edu) which fixes
compilation on some Solaris boxes, and maybe others. The error said
"cannot compute sizeof (char)"
o Applied some patches from the NetBSD ports tree that Hubert Feyrer
(hubert.feyrer(a)informatik.fh-regensburg.de) sent me. The NetBSD
Nmap ports page is at http://www.NetBSD.org/packages/net/nmap/ .
o Applied some Makefile patches from the FreeBSD ports tree that I
found at http://www.freebsd.org/cgi/cvsweb.cgi/ports/security/nmap/files/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: For info see http://www.gnupg.org
-----END PGP SIGNATURE-----
For help using this (nmap-hackers) mailing list, send a blank email to
nmap-hackers-help () insecure org . List run by ezmlm-idx (www.ezmlm.org).
- Nmap 3.48: Service fingerprints galore! Fyodor (Oct 06)