What changed in Nmap from 6 to 7

Upgraded included OpenSSL to version 3.0.21 on all platforms. Fixed a memory-consumption hang in Ncat's HTTP proxy code that affected both connect and listen modes, reported by kumama_nui. Patched our included libssh2 source with upstream fixes for CVE-2025-15661, CVE-2026-7598, CVE-2026-55199, CVE-2026-55200, CVE-2026-58050, and CVE-2026-58051. The version number has been annotated as 1.11.1_NMAP1 [Zenmap] [GH#3347]Fixed several issues leading to crashes when parsing, editing, or saving command profiles containing '%' characters. [NSE] [GH#2272] smb-enum-shares failed to produce output for valid shares when an error was encountered on one share. [GH#3410]Fixed an issue where DNS resolution would incorrectly fail to match the same name in a different case. [NSE] [GH#1066]Added service names for SSL-protected services like amt-soap-https to portrules for several scripts, ensuring they run on these as well as the standard unencrypted services. Audited and converted most instances of strcat, strcpy, and sprintf to use bounded functions instead. [NSE] [GH#2221] mysql-dump-hashes now uses the correct column name for MySQL 5.7+ [NSE] [GH#2238] http-referer-checker was incorrectly fetching off-host URLs. Now only URLs on the target are fetched. [GH#2122]When an interface is specified with -e, also bind to the IP address for that device so that it works for non-Linux systems and non-root users. [Nsock] [GH#1939]When nsock_iod_set_localaddr() is used, nsock_connect_*() will now treat errors in bind(2) as connection failure. [GH#2732]Fix a potential crash on 32-bit platforms in debug mode due to incorrect format specifier for 64-bit integer type. [Christopher Chavez] [GH#3201] [GH#3367]Increase line length limit for nmap-service-probes and correctly handle lines that are too long. [@liquidpele, Ashutosh Kumar Singh] [GH#3414]Avoid out-of-bounds read when parsing PTR domain names. [@toor11 (Juri)] [GH#2245]Ensure variables updated by signal handlers are volatile sig_atomic_t. [Ncat] [GH#1410]Fix an assertion failure (count <= INT_MAX) in ncat -lk in some cases where stdin or a listening socket produces an error. [NSE] [GH#1946]Fix a cryptic error in smb-enum-services, "Server returned less data than needed for header" when smb.start_smb() failed. Fixed an issue with parsing nmap-service-probes that could cause a corrupted file to crash Nmap. Reported by Muhammed Hussein. [NSE] [GH#2016]Removed hostmap-bfk.nse, since the service it used shut down. Fixed several issues reported by Himanshu Anand: infinite loop in TCP options parsing and out-of-bounds memory read in IPv4 OS detection; integer underflow in IPv6 extension header processing; and undefined behavior in DNS label parsing. [GH#2721]Added checks for returned pointers from OpenSSL allocation functions. [GH#1546]Fix an incorrect assertion "timeout / 1000 <= (long) o.scan_delay" in traceroute which failed for timeouts greater than 1 second when there was no scan delay. [GH#3175]The --stats-every option can now be used in conjunction with --noninteractive. Previously, no stats messages were printed if a TTY was not attached. [GH#3375]Nmap can now be built with OpenSSL 4.0 [Nping] [GH#1751]The --rate option will not accept a rate higher than 1000 packets per second, since Nsock timers have millisecond resolution. Use --delay 0 for unlimited rate. [Nping]Fixed several issues with Nping in IPv6 mode including: [GH#1261]Incorrect BPF generated leading to "expression rejects all packets" [GH#3215]Incorrect constant used to check for IP version in Echo Server [NSE] [GH#3368]Fixed an out-of-memory issue in packet.lua when parsing a zero-length TCP header option. [Maxim Suhanov] Fixed an issue where Nmap OS scan trusts a packet's ip_len to size a CRC32 computation over TCP RST payload data, which may result in reading arbitrary heap data. Reported by Michael Bommarito. [Ncat] [GH#3005]Correctly report listening port number. ncat -l -p 0 will cause Ncat to listen on an ephemeral port, but it

Integrated many of the most-frequently-submitted IPv4 and IPv6 OS fingerprints, as well as dozens of updated service fingerprints. Upgraded included libraries: OpenSSL 3.0.19, libpcap 1.10.6, libpcre2 10.47, liblinear 2.50, zlib 1.3.2 [Windows]Upgraded the included version of Npcap from 1.83 to 1.87, resolving several crashes and stability-related issues. See https://npcap.com/changelog [Zenmap] [GH#3182]Zenmap is now distributed as a universal wheel (zenmap-7.99-py3-none-any.whl) instead of an RPM package so that it can be installed on any system with Python 3. [Daniel Miller] [Ncat] [Windows]Limited the number of handles inherited by subprocesses launched with -e, preventing interference between clients when -e and --keep-open are used. Reported by Nimish Verma. [Ncat]Several fixes for regressions or longstanding failure cases in ncat-test.pl [Daniel Miller]: [Windows]Fixed handling of socket EOF with --exec Fixed the -i (idle timeout) option for listen mode, which was broken when adding the -q option in Ncat 7.96 Fixed HTTP proxy server when SSL is used. DTLS (SSL over UDP) shutdown connection on stdin EOF. [Windows] [GH#2711]Nmap now supports scanning over various VPN virtual adapters like OpenVPN TAP adapters. [Daniel Miller] [GH#3280]Fix a performance regression in reverse-DNS in Nmap 7.98. The fix for #3130 had caused Nmap to send requests too slowly. [Daniel Miller] [macOS] [GH#3289]Fixed a configure-time failure in libdnet that resulted in incorrect MAC addresses being reported. [Daniel Miller] [Zenmap] [GH#3189]Fix a crash in Zenmap topology and hosts viewer: "TypeError: format requires a mapping" [Daniel Miller] [GH#2955]Fix a routing issue with -e and -S related to #2206 causing error "setup_target: failed to determine route" [Daniel Miller] [GH#3214]Improve compatibility of build process on various platforms and add multiplatform autobuilds in Github workflow. [Jordan Ritter] [NSE] [GH#2183] [GH#3239]Script hostmap-crtsh now reports only true subdomains of a given target hostname by default. In the past, it was reporting any DNS name that included the target hostname as a substring (but not necessarily as a suffix). The old behavior can be enabled by setting script argument hostmap-crtsh.lax. [Sweekar-cmd, nnposter] [NSE]Function url.parse_query was not interpreting plus signs as spaces. [nnposter] [NSE]Function url.parse was not properly parsing URLs with query strings but empty paths. [nnposter] [NSE] [GH#3287]Functions tableaux.tcopy and tableaux.shallow_tcopy were not behaving the same when the input table had a custom __pairs metamethod. Both functions now perform a raw copy, ignoring the metamethod. [nnposter]

SECURITY: Rebuilt the Windows self-installer with NSIS 3.11, addressing CVE-2025-43715--a race condition in earlier NSIS versions that could allow local attackers to escalate to SYSTEM privileges when a vulnerable installer is run as SYSTEM. The Nmap installer does not run as SYSTEM by default. Upgraded included libraries: OpenSSL 3.0.17, Lua 5.4.8 Windows: Upgraded the included version of Npcap from 1.82 to 1.83, improving compatibility with PPPoE connections. macOS: GH#3127: Fix "dnet: Failed to open device en0" errors on macOS since Nmap 7.96. Fixed an issue in FTP bounce scan where a single null byte is written past the end of the receive buffer. The issue is triggered by a malicious server but does not cause a crash with default builds. GH#3130: Fix a crash (stack exhaustion due to excessive recursion) in the parallel DNS resolver. Additionally, improved performance by processing responses that come after the request has timed out. GH#2148: Fix the error, "Assertion failed: (datalink == DLT_EN10MB), function begin_sniffer, file scan_engine_raw.cc" when using Nmap with certain VPN interfaces. GH#2757: Fix a crash in traceroute when using randomly-generated decoys: "Assertion source->ss_family == AF_INET' failed" GH#2899: When IP protocol scanning on IPv6 (-sO -6), skip protocol numbers that are registered as Extension Header values. When the --data option was used, these would fail the assertion "len == (u32) ntohs(ip6->ip6_plen)" GH#3086: Prevent TCP Connect scan (-sT) from leaking one socket per hostgroup, which led to progressively slower scans and assertion failures in other scan phases. NSE: GH#3133: Fix the error "nse_nsock.cc:637: void receive_callback(nsock_pool, nsock_event, void*): Assertion lua_status(L) == 1' failed." when reading from an SSL connection. NSE: Added NSE bindings for more libssh2 functions: channel_request, channel_request_pty_ex, channel_shell, and userauth_keyboard_interactive. ssh-brute will now use keyboard-interactive auth if password auth is not offered. NSE: GH#3014: Fix dns-zone-transfer to handle nontraditional TLDs Fix a bug that was causing Nmap to send empty DNS packets for each target that was not found up instead of just skipping them for reverse DNS. NSE: Fix/update/enhance tls.lua for newer TLSv1.3 ciphers, including post-quantum ciphersuites. GH#3114: Windows: Use only the DNS servers for up and configured interfaces for forward and reverse DNS lookups. When -e or -S are used, use only DNS servers that can be connected via that interface or source address. Ndiff: GH#3115: Have configure script check for PyPA 'build' module. Zenmap: Updated Spanish and Chinese language strings for Zenmap to cover latest strings. Zenmap: GH#2718: Zenmap language translation (i18n) files were not being installed. Zenmap: GH#3066: Fix Zenmap error "ValueError: I/O operation on closed file" when Nmap crashes or fails. Zenmap: GH#3084: GH#3127: Fix UnicodeDecodeError issues in ScriptMetadata and UmitConfigParser. NSE: GH#3123: WS-Discovery parsing would error out if the MessageID UUID was not prefixed with "urn:". GH#3280: Fix a performance regression in reverse-DNS in Nmap 7.98. The fix for #3130 had caused Nmap to send requests too slowly. macOS: GH#3289: Fixed a configure-time failure in libdnet that resulted in incorrect MAC addresses being reported. Zenmap: GH#3189: Fix a crash in Zenmap topology and hosts viewer: "TypeError: format requires a mapping" GH#2955: Fix a routing issue with -e and -S related to #2206 causing error "setup_target: failed to determine route" GH#3214: Improve compatibility of build process on various platforms and add multiplatform autobuilds in Github workflow. NSE: GH#2183: GH#3239: Script hostmap-crtsh now reports only true subdomains of a given target hostname by default. In the past, it was reporting any DNS name that included the target hostname as a substring (but not necessarily as a suffix). The old behavior can be enabled by setting script argument hostmap-crts

Zenmap: GH#3087: Fix a crash when starting a scan on Windows in locales that use non-latin character sets. Also changed Nmap to print the time zone as an offset from UTC instead of as a localized string. Fixed an issue with the parallel forward DNS resolver: it had not been consulting /etc/hosts, nor did it correctly handle the 'localhost' name. GH#3088: Mitigate a false-positive detection by replacing a malicious URL in the example output of http-malware-host

Upgraded included libraries: OpenSSL 3.0.16, Lua 5.4.7, libssh2 1.11.1, libpcap 1.10.5, libpcre2 10.45, libdnet 1.18.0 Windows: Upgraded the included version of Npcap from version 1.79 to the latest version 1.82, bringing faster packet injection, VLAN header capture, and support for SR-IOV adapters, along with many other bug fixes and feature enhancements. GH#1451: Nmap now performs forward DNS lookups in parallel, using the same engine that has been reliably performing reverse-DNS lookups for nearly a decade. Scanning large lists of hostnames is now enormously faster and avoids the unresponsive wait for blocking system calls, so progress stats can be shown. In testing, resolving 1 million website names to both IPv4 and IPv6 took just over an hour. The previous system took 49 hours for the same data set! Nping: GH#2862: Promoted Nping version number from a 0.7.95 alpha release to the same release version as Nmap. Zenmap: GH#2358: Added dark mode, accessed via Profile->Toggle Dark Mode or window::dark_mode in zenmap.conf. NSE: Added 3 new scripts, for a total of 612 NSE scripts: GH#2973: mikrotik-routeros-version queries MikroTik's WinBox router admin service to get the RouterOS version. New service probes were also added for this service. mikrotik-routeros-username-brute brute-forces WinBox usernames for the router using CVE-2024-54772. targets-ipv6-eui64 generates target IPv6 addresses from a user-provided file of MAC addresses, using the EUI-64 method. GH#2982: Fixed an issue preventing the Nmap OEM 7.95 uninstaller from correctly uninstalling Nmap OEM. GH#2139: Nsock: Windows: Fixed the IOCP Nsock engine, which had been demoted since Nmap 7.91 due to unresolved issues around SSL sockets and IPv6. GH#2113: Fixed the issue where TCP Connect scans (-sT) on Windows would show 'filtered' instead of 'closed', due to differences in understanding timeouts. GH#2900: GH#2896: GH#2897: Nmap is now able to scan IP protocol 255. Nmap will now allow targets to be specified both on the command line and in an input file with -iL. Previously, if targets were provided in both places, only the targets in the input file would be scanned, and no notice was given that the command-line targets were ignored. Zenmap: GH#2854: Fixed a Zenmap crash in DiffViewer when Ndiff exits with error. Zenmap: Fixed several UnicodeDecodeError or UnicodeEncodeError crashes throughout Zenmap. Zenmap: GH#1696: Fixed an issue preventing Zenmap from launching if nmap was not in the PATH. The issue primarily affected macOS users. GH#2838: GH#2836: Fixed a couple of issues with parsing the argument to the -iR option. NSE: GH#2852: Added TLS support to redis.lua and improved -sV detection of redis. GH#2954: Fix 2 potential crashes in parsing IPv6 extension headers discovered using AFL++ fuzzer. Nping: Bind raw socket to device when possible. This was already done for IPv6, but was needed for IPv4 L3 tunnels. Ncat: Ncat in connect mode no longer defaults to half-closed TCP connections. This makes it more compatible with other netcats. The -k option will enable the old behavior. Nsock: GH#2788: Fix an issue affecting Ncat where unread bytes in the SSL layer's buffer could not be read until more data arrived on the socket, which could lead to deadlock. Ncat: GH#2422: New Ncat option -q to delay quit after EOF on stdin, the same as traditional netcat's -q option. Ncat: GH#2843: Ncat in listen mode with -e or -c correctly handles error and EOF conditions that had not been being delivered to the child process. Ncat: Windows: All Nsock engines now work correctly. The default is still 'select', but others can be set with --nsock-engine=iocp or --nsock-engine=poll NSE: GH#1014: GH#2616: SSH NSE scripts now catch connection errors thrown by the libssh2 Lua binding, providing useful output instead of a backtrace. NSE: Several fixes and extensions to the libssh2 NSE bindings: fixed libssh2.channel_read_stderr, which was reading stdout instead; add binding for libssh2_userauth_publi

Integrated over 4,000 of your IPv4 OS fingerprints. Added 336 signatures, bringing the new total to 6,036. Additions include iOS 15 & 16, macOS Ventura & Monterey, Linux 6.1, OpenBSD 7.1, and lwIP 2.2 Integrated over 2,500 service/version detection fingerprints. The signature count went up 1.4% to 12,089, including 9 new softmatches. We now detect 1,246 protocols, including new additions of grpc, mysqlx, essnet, remotemouse, and tuya. Upgraded Npcap (our Windows raw packet capturing and transmission driver) from version 1.75 to the latest version 1.79. It includes many performance improvements, bug fixes and feature enhancements described at https://npcap.com/changelog. Added four new scripts from the DINA community ( https://github.com/DINA-community) for querying industrial control systems: hartip-info reads device information from devices using the Highway Addressable Remote Transducer protocol, iec61850-mms queries devices using Manufacturing Message Specification requests, multicast-profinet-discovery Sends a multicast PROFINET DCP Identify All message and prints the responses, profinet-cm-lookup queries the DCERPC endpoint mapper exposed via the PNIO-CM service. Improvements to OS detection fingerprint matching, including a syntax change for nmap-os-db that allows ranges within the TCP Options string. This leads to more concise and maintainable fingerprints. Improved the OS detection engine by using a new source port for each retry. Scans from systems such as Windows that do not send RST for unsolicited SYN|ACK responses were previously unable to get a response in subsequent tries. Several profile-guided optimizations of the port scan engine. Upgraded from libpcre 7.6 to libpcre2 10.43. Upgraded included libraries: Lua 5.4.6, zlib 1.3.1, libssh2 1.11.0, and liblinear 2.47 Upgraded OpenSSL binaries (for the Windows builds and for RPMs) to version 3.0.13. This addresses various OpenSSL vulnerabilities which don't impact Nmap (full details are in the GH issue). Fixed an issue where TCP Connect scan (-sT) on Windows would fail to open any sockets, leading to scans that never finish. Zenmap and Ndiff now use setuptools, not distutils for packaging. Fixed Ncat UDP server mode to not quit after EOF on stdin. Reported as Debian bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1039613 ssh-auth-methods will now print the pre-authentication banner text when available. Requires libssh2 1.11.0 or later. Fix a crash in Zenmap when changing a host comment. Fix TLS 1.2 signature algorithms for EdDSA. RPM spec files now correctly require the python3 package, not python>=3 Fix an out-of-bounds read which led to out-of-memory errors when duplicate addresses were used with --exclude Fixed a memory leak in Nsock: compiled pcap filters were not freed. Fixed a crash when using service name wildcards with -p, as in -p "http*" Fixed an issue where NSE-assigned service names could be overwritten prior to output, leading to XML validation errors and unprintable screen output. Fixed DNS TXT record parsing bug which caused asn-query to fail in Nmap 7.80 and later. Fixed packet size testing in KNX scripts

Zenmap and Ndiff now use Python 3! Thanks to the many contributors who made this effort possible: Updated Zenmap to Python 3 and PyGObject, Updated Ndiff to Python 3. Additional Python 3 update fixes by Sam James, Daniel Miller. Special thanks to those who opened Python 3-related issues and pull requests: Eli Schwartz, Romain Leonard, Varunram Ganesh, Pavel Zhukov, Carey Balboa, Hasan Aliyev, and others. Upgraded Npcap (our Windows raw packet capturing and transmission driver) from version 1.71 to the latest version 1.75. It includes dozens of performance improvements, bug fixes and feature enhancements described at https://npcap.com/changelog. Nmap now prints vendor names based on MAC address for MA-S (24-bit), MA-M (28-bit), and MA-L (36-bit) registrations instead of the fixed 3-byte MAC prefix used previously for lookups. Added partial silent-install support to the Nmap Windows installer. It previously didn't offer silent mode (/S) because the free/demo version of Npcap Windoes packet capturing driver that it needs and ships with doesn't include a silent installer. Now with the /S option, Nmap checks whether Npcap is already installed (either the free version or OEM) and will silently install itself if so. This is similar to how the Wireshark installer works and is particularly helpful for organizations that want to fully automate their Nmap (and Npcap) deployments. See https://nmap.org/nmap-silent-install for more details. Lots of profile-guided memory and processing improvements for Nmap, including OS fingerprint matching, probe matching and retransmission lookups for large hostgroups, and service name lookups. Overhauled Nmap's string interning and several other startup-related procedures to speed up start times, especially for scans using OS detection. Integrated many of the most-submitted IPv4 OS fingerprints for recent versions of Windows, iOS, macOS, Linux, and BSD. Added 22 fingerprints, bringing the new total to 5700! Added the tftp-version script which requests a nonexistent file from a TFTP server and matches the error message to a database of known software. Ncat can now accept "connections" from multiple UDP hosts in listen mode with the --keep-open option. This also enables --broker and --chat via UDP. Upgraded OpenSSL binaries (for the Windows builds and for RPM's) to version 3.0.8. This resolves some CVE's (CVE-2022-3602; CVE-2022-3786) which don't impact Nmap proper since it doesn't do certificate validation, but could possibly impact Ncat when the --ssl-verify option is used. Upgrade included libraries: zlib 1.2.13, Lua 5.4.4, libpcap 1.10.4 Removed the bogus OpenSSL message from the Windows Nmap executable which looked like "NSOCK ERROR ssl_init_helper(): OpenSSL legacy provider failed to load." We actually already have the legacy provider built-in to our OpenSSL builds, and that's why loading the external one fails. UDP port scan (-sU) and version scan (-sV) now both use the same data source, nmap-service-probes, for data payloads. Previously, the nmap-payloads file was used for port scan. Port scan responses will be used to kick-start the version matching process. Nmap's service scan (-sV) can now probe the UDP service behind a DTLS tunnel, the same as it already does for TCP services with SSL/TLS encryption. The DTLSSessionReq probe has had its rarity lowered to 2 to allow it to be sent sooner in the scan. Ncat in listen mode with --udp --ssl will use DTLS to secure incoming connections. Handle Internationalized Domain Names (IDN) like Яндекс.рф on platforms where getaddrinfo supports the AI_IDN flag. Addressed an issue from the Debian bug tracker ( https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=969314) regarding data received immediately after a SOCKS CONNECT response. Ncat can now be correctly used in the ProxyCommand option of OpenSSH. Improved DNS domain name parsing to avoid recursion and enforce name length limits, avoiding a theoretical stack exhaustion issue with certain crafted DNS server r

This release commemorates Nmap's 25th anniversary! It all started with this September 1, 1997 Phrack article by Fyodor: https://nmap.org/p51-11.html. Upgraded Npcap (our Windows raw packet capturing and transmission driver) from version 1.50 to the latest version 1.71. It includes dozens of performance improvements, bug fixes and feature enhancements described at https://npcap.com/changelog. Ensure Nmap builds with OpenSSL 3.0 using no deprecated API functions. Binaries for this release include OpenSSL 3.0.5. Upgrade included libraries: libssh2 1.10.0, zlib 1.2.12, Lua 5.3.6, libpcap 1.10.1 Fix a bug that prevented Nmap from discovering interfaces on Linux when no IPv4 addresses were configured.

Upgraded Npcap (our Windows raw packet capturing and transmission driver) from version 1.00 to the latest version 1.50. You can read about the dozens of performance improvements, bug fixes and feature enhancements. Nmap now works on the Windows ARM architecture so you can run it on lightweight and power-efficient tablets like the Microsoft Surface Pro X and Samsung Galaxy Book Go. Updated our Windows builds to Visual Studio 2019, Windows 10 SDK, and the UCRT. This prevents Nmap from working on Windows Vista and earlier, but they can still use older versions of Nmap on their ancient operating system. New Nmap option --unique will prevent Nmap from scanning the same IP address twice, which can happen when different names resolve to the same address. TLS 1.3 now supported by most scripts for which it is relevant, such as ssl-enum-ciphers. Some functions like ssl tunnel connections and certificate parsing will require OpenSSL 1.1.1 or later to fully support TLS 1.3. Added 3 NSE scripts, from 4 authors, bringing the total up to 604! nbns-interfaces queries NetBIOS name service (NBNS) to gather IP addresses of the target's network interfaces openflow-info gathers preferred and supported protocol versions from OpenFlow devices port-states prints a list of ports that were found in each state, including states that were summarized as "Not shown: X closed ports" Fix an issue with -sU where payload data went out-of-scope before it was used, causing corrupted payloads to be sent. Nmap's retransmission limits were preventing some UDP payloads from being tried with -sU and -PU. Now, Nmap sends each payload for a particular port at the same time without delay. TS3INIT1 for UDP 3389 DTLS for UDP 3391 (RD Gateway) SMB2 dialect handling has been redesigned. Notable improvement in speed of script smb-protocols and others. Some SMB scripts are no longer using a hardcoded dialect, improving target interoperability. Dialect names are aligned with Microsoft, such as 3.0.2, instead of 3.02 Upgraded OpenSSL to version 1.1.1k. This addresses some CVE's which don't affect Nmap in a material way. Removed support for the ancient WinPcap library since we already include our own Npcap library supporting the same API. WinPcap was abandoned years ago and it's official download page says that "WE RECOMMEND USING Npcap INSTEAD" for security, stability, compatibility, and support reasons. Fix an issue in addrset matching that was causing all targets to be excluded if the --excludefile listed a CIDR range that contains an earlier, smaller CIDR range. Fix an issue that would cause Nmap to hang during scans with a host timeout, such as -T5. Any active probes when a target timed out were counting towards the global congestion window. Do not count host discovery phase time against the host timeout, since Nmap may wait a long time between sending probes to a target while it processes other targets instead. Fix issues with matching ICMP Time Exceeded messages that led to ignored responses and long scan times when scanning distant targets. Upgrade the Windows NSIS installer to use the latest NSIS 3 (version 3.07) instead of the previous NSIS 2 generation. Setting --host-timeout=0 will disable the host timeout, which is set by -T5 to 15 minutes. Earlier versions of Nmap require the user to specify a very long timeout instead. If a host times out, the XML element will have the attribute timedout="true" and the host's timing info (srtt etc.) will still be printed. The "extrareasons" element now includes a list of port numbers for each "ignored" state. The "All X ports" and "Not shown:" lines in normal output have been changed slightly to provide more detail. Prevent the ssl-* NSE scripts from probing ports that were excluded from version scan, usually 9100-9107, since JetDirect will print anything sent to these ports. Nmap no longer produces cryptic message "Failed to convert source address to presentation format" when unable to find useable route to the target. Use

[NSE] [GH#2136] [GH#2137]Fix several places where Lua's os.time was being used to represent dates prior to January 1, 1970, which fails on Windows. Notably, NSE refused to run in UTC+X timezones with the error "time result cannot be represented in this installation" [Clément Notin, nnposter, Daniel Miller] [GH#2148] [Zenmap]Fix a crash in the profile editor due to a missing import. [GH#2139] [Nsock] [Windows]Demote the IOCP Nsock engine because of some known issues that will take longer to resolve. The previous default "poll" engine will be used instead. [GH#2140] [Nsock] [Windows]Fix a crash in service scan due to a previously-unknown error being returned from the IOCP Nsock engine. [Daniel Miller] [NSE] [GH#2128]MySQL library was not properly parsing server responses, resulting in script crashes. [nnposter] [GH#2135]Silence the irrelevant warning, "Your ports include 'T:' but you haven't specified any TCP scan type" when running nmap -sUV

[Windows]Upgraded Npcap, our Windows packet capturing (and sending) library to the milestone 1.00 release! It's the culmination of 7 years of development with 170 public pre-releases. This includes dozens of performance improvements, bug fixes, and feature enhancements described at https://npcap.com/changelog. Integrated over 800 service/version detection fingerprints submitted since August 2017. The signature count went up 1.8% to 11,878, including 17 new softmatches. We now detect 1237 protocols from airmedia-audio, banner-ivu, and control-m to insteon-plm, pi-hole-stats, and ums-webviewer. A significant number of submissions remain to be integrated in the next release. Integrated over 330 of the most-frequently-submitted IPv4 OS fingerprints since August 2017. Added 26 fingerprints, bringing the new total to 5,678. Additions include iOS 12 & 13, macOS Catalina & Mojave, Linux 5.4, FreeBSD 13, and more. Integrated all 67 of your IPv6 OS fingerprint submissions from August 2017 to September 2020. Added new groups for FreeBSD 12, Linux 5.4, and Windows 10, and consolidated several weak groups to improve classification accuracy. [NSE]Added 3 NSE scripts, from 2 authors, bringing the total up to 601! They are all listed at https://nmap.org/nsedoc/, and the summaries are below: dicom-brute attempts to brute force the called Application Entity Title of DICOM servers. [Paulino Calderon] dicom-ping discovers DICOM servers and determines if any Application Entity Title is allowed to connect. [Paulino Calderon] uptime-agent-info collects system information from an Idera Uptime Infrastructure Monitor agent. [Daniel Miller] [GH#1834]Addressed over 250 code quality issues identified by LGTM.com, improving our code quality score from "C" to "A+" Released Npcap OEM Edition. For more than 20 years, the Nmap Project has been funded by selling licenses for companies to distribute Nmap with their products, along with commercial support. Hundreds of commercial products now use Nmap for network discovery tasks like port scanning, host discovery, OS detection, service/version detection, and of course the Nmap Scripting Engine (NSE). Until now they have just used standard Nmap, but this new OEM Edition is customized for use within other Windows software. Nmap OEM contains the OEM version of our Npcap driver, which allows for silent installation. It also removes the Zenmap GUI, which cuts the installer size by more than half. And it reports itself as Nmap OEM so customers know it's a properly licensed Nmap. See https://nmap.org/oem for more details. We will be reaching out to all existing licensees with Nmap OEM access credentials, but any licensees who wants it quicker should see https://nmap.org/oem. Upgraded the Nmap license form a sort of hacked-up version of GPLv2 to a cleaner and better organized version (still based on GPLv2) now called the Nmap Public Source License to avoid confusion. See https://nmap.org/npsl/ for more details and annotated license text. This NPSL project was started in 2006 (community discussion here: https://seclists.org/nmap-dev/2006/q4/126) and then it lost momentum for 7 years until it was restarted in 2013 ( https://seclists.org/nmap-dev/2013/q1/399) and then we got distracted by development again. We still have some ideas for improving the NPSL, but it's already much better than the current license, so we're applying NPSL Version 0.92 to the code now and can make improvements later if needed. This does not change the license of previous Nmap releases. Removed nmap-update. This program was intended to provide a way to update data files and NSE scripts, but the infrastructure was never fielded. It depended on Subversion version control and would have required maintaining separate versions of NSE scripts for compatibility. Removed the silent-install command-line option (/S) from the Windows installer. It causes several problems and there were no objections when we proposed removing it in 2016 ( https://seclists.org/nm

[Windows]The Npcap Windows packet capturing library ( https://npcap.com/) is faster and more stable than ever. Nmap 7.80 updates the bundled Npcap from version 0.99-r2 to 0.9982, including all of these changes from the last 15 Npcap releases: https://npcap.com/changelog [NSE]Added 11 NSE scripts, from 8 authors, bringing the total up to 598! They are all listed at https://nmap.org/nsedoc/, and the summaries are below: [GH#1232] broadcast-hid-discoveryd discovers HID devices on a LAN by sending a discoveryd network broadcast probe. [Brendan Coles] [GH#1236] broadcast-jenkins-discover discovers Jenkins servers on a LAN by sending a discovery broadcast probe. [Brendan Coles] [GH#1016] [GH#1082] http-hp-ilo-info extracts information from HP Integrated Lights-Out (iLO) servers. [rajeevrmenon97] [GH#1243] http-sap-netweaver-leak detects SAP Netweaver Portal with the Knowledge Management Unit enabled with anonymous access. [ArphanetX] https-redirect detects HTTP servers that redirect to the same port, but with HTTPS. Some nginx servers do this, which made ssl-* scripts not run properly. [Daniel Miller] [GH#1504] lu-enum enumerates Logical Units (LU) of TN3270E servers. [Soldier of Fortran] [GH#1633] rdp-ntlm-info extracts Windows domain information from RDP services. [Tom Sellers] smb-vuln-webexec checks whether the WebExService is installed and allows code execution. [Ron Bowes] smb-webexec-exploit exploits the WebExService to ru