What is NMapWin?

NMapWin is a Windows/2000/XP front-end for nmap. It is based on nmap v2.54beta36. For more information about nmap see http://www.insecure.org.

This distribution also contains a Windows versions of winpcap (version 2.3). You have to install winpcap first, before you can use any advanced nmap options, or in case your operating system does not support raw sockets.

The picture shows screenshot for Windows2000 and Windows/XP of a typical nmapwin session.

Version above 1.2.8 has all command line switches implemented. The front end looks similar to the GTK style front-end, but without using the any GTK/GDK/Gimp libraries on Win32. This makes NMapWin much more suitable for Windows platforms.

NMapWin includes the Front-End GUI as well as a win32 service. The service has the ability to start a nmap scan in regular intervals. The scan interval as well as the start time can be adjusted. Scan intervals range from 1h (minimum) to several month. The actual nmap process is startes as win32 background process. See Service Overview for more information on the NMap service.

NMapWin does not currently support any other flavour of Windows (neither Windows98, Windows ME, Windows CE etc.)

For news about available patches or new features visit: NMapWin home page

NMapWin is totally free and runs under GPL (GNU Public License). The source code is available at: http://www.sourceforge.net/projects/nmapwin

Copyright © JV Software


What is NMap?

Nmap ("Network Mapper") is an open source utility for network exploration or security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (ports) they are offering, what operating system (and OS version) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. Nmap runs on most types of computers, and both console and graphical versions are available. Nmap is free software, available with full source code under the terms of the GNU GPL.

Currently NMapWin is using nmap v 2.54beta36. See www.insecure.org for the latest release. In case you want to use a newer version of nmap than the one which is supplied with this distribution, get the new version from www.insecure.org and place it into the %NMAPWIN%\bin directory.

Features

  • Flexible: Supports dozens of advanced techniques for mapping out networks filled with IP filters, firewalls, routers, and other obstacles. This includes many port scanning mechanisms (both TCP & UDP), OS detection, pings sweeps, and more. See the documentation page.
  • Powerful: Nmap has been used to scan huge networks of literally hundreds of thousands of machines.
  • Portable: Most operating systems are supported, including Linux, Open/Free/Net BSD, Solaris, IRIX, Mac OS X, HP-UX, Sun OS, and more. Windows support is in beta and we are not distributing binaries yet. See the portability page.
  • Easy: While Nmap offers a rich set of advanced features for power users, you can start out as simply as "nmap -O -sS targethost". Both traditional command line and graphical (GUI) versions are available to suit your preference. Binaries are available for those who do not wish to compile Nmap from source.
  • Free: The primary goals of the Nmap Project is to help make the Internet a little more secure and to provide administrators/auditors/hackers with an advanced tool for exploring their networks. Nmap is available for free download, and also comes with full source code that you may modify and redistribute under the terms of the GNU General Public License (GPL).
  • Well Documented: Significant effort has been put into comprehensive and up-to-date man pages, whitepapers, and tutorials. Find them in multiple languages here.
  • Supported: While Nmap comes with no warranty, you can write the author (fyodor@insecure.org) if you experience any problems. We also host several mailing lists you can join.
  • Acclaimed: Nmap has won numerous awards, including "Information Security Product of the Year" by both Info World and Codetalker Digest. It has been featured in hundreds of magazine articles. Visit the press page for details.
  • Popular: Thousands of people download Nmap every day, and it is included with many operating systems (Redhat Linux, Debian Linux, FreeBSD, OpenBSD, etc). It is among the top ten (out of 15,000) downloads at the Freshmeat repository. This is important because it lends Nmap its vibrant development and user support communities.

Copyright © 2001 - 2002 JV Software


Prerequisites

NMapWin requires WinPCap version 2.3. In case WinPCap is already installed skip the installation of WinPCap, otherwise install WinPcap version 2.3 or higher. This distribution contains WinPCap version 2.3. Start the installation of WinPCap by selecting the WinPCap feature in the installation script.

For more information about WinPCap visit http://netgroup-serv.polito.it/winpcap.

In order to check the status of the Windows packet driver, open the System Management Gui and check for a driver called npf (Network Packet Filter).

shows a screenshot of the npf driver. All WinPCap driver from version 2.2 on are supported.


Installing NMapWin

In order to install NMapWin start the setup executable. This setup executable is a MSI compliant installation script. Per default NMapWin will be installed in c:\Program Files\NMapWin. See below on how to change the installation directory.

The home directory will be saved in a Windows system environment variable called NMAPDIR.

The installation will actually install three parts:

  • NMapWin: the NMap windows front-end.
  • NMapServ: the NMap service, which start nmap in given time intervals.
  • NMap: the actual NMap executable.
Currently NMap version 2.5.4beta36 will be installed.

The first picture shows the welcome screen.

Click on Next to continue.

The next screen shows the license agreement:

Click on Yes to accept the license.

On the next screen you can select the installation owner. Per default the values found in the registry of this computer are filled in:

Click on Next to continue. Select the destination folder. This can be any folder of your choise. Per default, NMapWin will be installed in c:\Prgram Files\NMapWin.

Click on Next to continue.

NMapWin comes with a WinPCap version 2.3. If WinPCap is already installed deselect the WinPCap check box. Otherwise NMapWin will install the packet driver.

Click on Next to continue.

On the next screen you can select the program group under which NMapWin will be installed. Per default NMapWin will choose its own group called NMapWin.

Click on Next to continue.

The next screen just summarizes the current setting.

Click on Next to continue.

The following screen shows installation information from the actual install.

After the installation finished with the copy of the necessary files, the services start screen is shown:

Select the checkbox if you want to start the nmap service now, otherwise leave it as it is. The last screen depend on whether WinPcap was selected or not. In case WinPCap was not selected the following scrren is shown:

Select whether you would like to read the README file, to start NMapWin. No reboot is necessary to have the NMapWin installed. Click on Finish to end the installation.

In case the WinPCap installation was selected a reboot is necessary to install the WinPCap packet driver:

Click on Finish to end the installation.


Uninstalling NMapWin

For uninstallation start the uninstall script from the Windows Add/Remove Programs Folder:

This will start the uninstallation.

First the welcome screen is displayed:

Select remove to uninstall NMapWin. Next the confimation dialog pops up:

Click on 'Yes'. This will bring you to the uninstallation progress bar:

Finally the finish screen is shown:

Note:

WinPCap will NOT be uninstalled after removing NMapWin, as it could be used by other programs as WinDump, etc.. To uninstall WinPCap:

  1. Delete c:\winnt\system32\drivers\npf.sys, c:\winnt\system32\packet.dll and c:\winnt\system32\wpcap.dll.
  2. Delete the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPF.
  3. Reboot the machine.


Troubleshooting

  • If you see a message box apearing during the installation of NMapWin, saying that this is a Installshield beta version, which is not for distribution: Delete c:\Program Files\Common\Installshield. This directory will be recreated during the NMapWin installation.
  • In case you cannot start the NMapWin executable from the Installshield installation script, start NMapWin from the Desktop Icon or from the Start Menu.
  • If you can start NMapWin but all scan jobs stop immediatley, check the %PATH% variable. It should include the bin directory of NMapWin (i.e. c:\Program Files\NMapWin\bin)
  • If you can start NMapWin but all scan jobs stop immediatley, check whether WinPCap is installed. See Prerequisites for details on how to check the WinPCap packet driver.
  • Installshield error 1607: This error will occur if the permissions are not set correctly on the Installer folder found in the Windows folder. Resolution: If you cannot find the Installer folder it may be hidden on the system, in which case you can unhide it by going to Tools->Folder Options from Windows Explorer. Then, choose the View tab, and choose the "Show hidden files and folders" radio button under Files and olders\Hidden files and folders. Once this is done, right-click the Installer folder, and choose properties. Go to the Security tab, and make sure that the system as well as the user name trying to run the installation has full control on this folder.
  • Installshield error 1608: When attempting to install nmapwin, the install fails half way through with an InstallShield 1608 Error. The installation ceases. As you can see byt the dialogues, this is an InstallShield bug. Here's the fix: This problem only exists on systems that are not connected to a network. If you install "Client for Microsoft Networks" on any of your network adaptors such as a nic, dsl card, or modem, reboot, then the software will install. Something happens when you install Client for Microsoft Networks that puts the system into a state that makes InstallShield happy.


NMapServ Overview

The NMapWin service is automatically installed whenever you install NMapWin. This service allows you to schedule scans of your network on a regular basis. The service runs as normal Windows/NT/2000/XP service. The service owner is the local system account.

All current settings are taken from the different NMapWin pages and stored in two registry keys. Each time the service starts it will read the current setting from the registry and will start to reschedule the processing. In case the keys are modified and stored into the registry, the nmap service will get notified and will relaunch the nmap scans. Therefore each change in the setting will be instantly transferd to the nmap service.

The actual nmap process is started as background process. At a given time only one nmap process can run in the background. Therefore, if the nmap process is about to start it first checks if there is already a nmap process running. In case this is true, the new nmap service is postphoned until the next scan time.

The registry keys are read each time the nmap service is about to start a new scan process. In case the setting has been changes since the last scan, the new values are read from the registry.

You should give a log file using the Ouput field on the files page (see Files Page for more details). The output is written log file, in Normal, HTML, XML orGrep format depending on the settings choosen on the Files Page. Use Append in order to append the output from each scan to the log file. See NMapWin manual page for details on the different output options.

Input file are supported as well. Put the network subnets you want to scan into a nmap input file. Set the input file on the Files Page (see Files Page for more details. For more detailed information on the syntax of the input file see NMapWin manual page


Install NMapServ

Normally the nmap service is automatically installed during installation of NMapWin. If this is not the case follow the instructions below.

Start a DOS window and change the directory to the bin directory of NMapWin.

cd %NMAPDIR%\bin

In order to install the service type:

nmapserv -i
This will install the service. The start mode is per default automatic, which means that each time the machine is rebooted the service is started automatically. Use the Windows/NT/2000 service manager to change the start mode. The owner of the service is the local system account.

The following listing is the output of nmapserv -h:

nmapserv v1.1.0
Copyright (c) 2000 - 2002 JV Software (vogje01@bluewin.ch)

usage:
        nmapserv [-i|-u|-p] [-h]

Options:
        -h              : This help screen.
        -i              : Install service.
        -u              : Uninstall service.
        -p              : Run as foreground process.


Install NMapServ

To uninstall the nmsp service, first stop the service. Start a DOS window and change the directory to the bin directory of NMapWin.
cd %NMAPDIR%\bin

Unistall the service by executing:

nmapserv -u
This will uninstall the service. The following listing is the output of nmapserv -h:

nmapserv v1.1.0
Copyright (c) 2000 - 2002 JV Software (vogje01@bluewin.ch)

usage:
        nmapserv [-i|-u|-p] [-h]

Options:
        -h              : This help screen.
        -i              : Install service.
        -u              : Uninstall service.
        -p              : Run as foreground process.


Configuring the service

The service features can be changes using the NMapWin GUI. Go to the Service tab on the main page. This will bring you to the service configuration page:

The service settings page is divided into several fields. On top of the page is the weekday selection, than the interval and start time selection and finally the interval period. The settings you see om the screenshot above will scan the network each Sunday at 01:00:00.

Current setting

The current setting is stored in two parameter fields in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NMap\Parameters\NMapArgs
and
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NMap\Parameters\NMapServArgs
NMapArgs contains all nmap related parameters and NMapServArgs all nmap service related parameters. NMapArgs contains per default: -sS -PI -PT, whereas NMapServArgs contains: 01:00:00 24 3 0 1 1 1 1 1 1 0 0 per default. See Registry Keys for more details on this keys.

Both parameters can be retrieved using the Get Param button of the NMapWin service page. Using the Set Param button will store the current settings in the registry. The service can be started/stopped using the two buttons Start and Stop.

Weekday selection

Select the weekdays you want to scan your network by selecting the corresponding checkboxes on top of the service settings page. In case the selected interval (see interval setting is more than one day, the nmap process will only start on days which are selected here. For example, if you select every second day for scanning, and the next scan day is not selected in the weekday selection, this day is skipped and the next scan will be performed 2 days later (assuming that this is selected in the weekday selection).

Interval selection

The scan interval (the period of time between two consecutive scans) is determined by the interval factor and the interval period. The interval factor can be Hours, Days, Weeks or Month. Depending on the selected factor the interval slider is changing the minumum and maximum scale. In case you select Days as interval factor the slider min, max values will be 0 to 30 (one month).

The interval can be set using the slider or the corresponding text box. The PageUp, PageDown as well as the Left and Right buttons are supported. PageUp and PageDown will change the value in intervals max/5, whereas Left and Right are changing the values with a stepsize of 1.

Start date/time

The start date/time can be selected using the two tect boxes in the middle of the tab. The date field will open a calendar in which one can select the start date for the first scan. The time is selected using the up and down buttons, or by editing the box directly.

Options

  • AutoStart starts scanning after service starts. If set to ON the service will start scanning the network. This flag is written to the registry using the Set Param button. The service will retrieve a notification event and will execute the change immediately. In case Immediately is also 'ON' one scan job will start immediately, otherwise the service will wait for the next scan interval (see below).
  • Immediately will start one scan job immediately, regardless the current interval setting.
After installation the AutoStart is set to 'OFF'. Therefore the service will not start any scan job until the AutoStart flag is set to 'ON'. The change is propagated to the service immediately. Nevertheless, depending on the Immediately flag setting, the start of the next scan job could be delayed until the next scan time.

Registry keys

The registry keys:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NMap\Parameters\NMapArgs
and
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NMap\Parameters\NMapServArgs
are used to store the current setting of the NMap service. The syntax of the NMapArgs key is exactly identical to the nmap command line arguments. See the NMap manual page for more information on the different command line arguments.

The NMapServArgs syntax is:

  • Start time: the start time as HH:MM:SS.
  • Interval factor: the interval factor as 0:hour, 1:days, 2: weeks, 3: month.
  • Scan interval: the scan interval in units determined by the interval factor.
  • Week day selection: seven integers 0: OFF, 1: ON, first index is Sunday: 0.
In case the registry keys are changed using a registry editor, the new values will be automatically before the next scan starts.


NMapWin Overview

NMapWin is a native Windows front-end to nmap. See the NMap manual page for more details on the NMap network scanner. The following screenshot shows the mainpage of the NMapWin GUI.

The NMapWin GUI is seperated in several fields. On top the network selection part, then the NMap options part and on the buttom is the log output field and the status line.

See Network Selection for more details on the different possibilities of the network selection. For a description of all option pages see the Options Folder page, for the log output and the status bar see Output and Status Bar page.


Network Selection

The following picture shows a screenshot of a valid network selection:

The simplest case is listing single hostnames or IP addresses. If you want to scan a subnet of IP addresses, you can append '/mask' to the hostname or IP address. mask must be between 0 (scan the whole internet) and 32 (scan the single host specified). Use /24 to scan a class 'C' address and /16 for a class 'B'.

Nmap also has a more powerful notation which lets you specify an IP address using lists/ranges for each element. Thus you can scan the whole class 'B' network 192.168.*.* by specifying '192.168.*.*' or '192.168.0-255.0-255' or even ´192.168.1-50,51-255.1,2,3,4,5-255'. And of course you can use the mask notation: '192.168.0.0/16'. These are all equivalent. If you use asterisks ('*'), remember that most shells require you to escape them with back slashes or protect them with quotes.

Another interesting thing to do is slice the Internet the other way. Instead of scanning all the hosts in a class specifying hosts to scan, see the examples section in the NMap manual pages.


Log Output

All nmap log output is written to the log text field. The following picture shows a screenshot of the log output:

The output from nmap will be written to this field as it comes from Nmap. No editing is done. The scollbars are enable on demand. The window is not editable.

Parts or the whole window can be copied into the Windows Clipboard. To copy parts of the log output to the clipboard:

  1. Select the portion of the window which you want to copy
  2. Press CRTL-c to copy the window portion into the clipboard.

Use CRTL-v to retrieve the window partion from the clipboard.


Status Bar

The status bar is divided into several fields:
  • Command: This shows the current command, with all nmsp options. Alternatively it will show all error or informational messages.
  • Busy: As long as nmap is busy this icon will be red, otherwise green.
  • Date: This field shows the date of the last message.
  • Time: This field shows the time of the last message.

The following picture shows the status bar:


Scan Folder Page

The scan page lets you select the scan method to use to the nmap scan. The following picture shows a screenshot of the scan page:

The following methods are supported:

  • Connect This is the most basic form of TCP scanning. The connect() system call provided by your operating system is used to open a connection to every interesting port on the machine. If the port is listening, connect() will succeed, other wise the port isn't reachable. One strong advantage to this technique is that you don't need any spe cial privileges. Any user on most UNIX boxes is free to use this call.
    This sort of scan is easily detectable as target host logs will show a bunch of connection and error messages for the services which accept() the con nection just to have it immediately shutdown.
  • SYN Stealth: This technique is often referred to as "half-open" scanning, because you don't open a full TCP connection. You send a SYN packet, as if you are going to open a real connection and you wait for a response. A SYN|ACK indicates the port is listening. A RST is indicative of a non-lis tener. If a SYN|ACK is received, a RST is immedi ately sent to tear down the connection (actually our OS kernel does this for us). The primary advan tage to this scanning technique is that fewer sites will log it. Unfortunately you need root privi leges to build these custom SYN packets.
  • FIN Stealth, Xmas Tree, Null Scan: There are times when even SYN scanning isn't clandestine enough. Some firewalls and packet filters watch for SYNs to restricted ports, and programs like Synlog ger and Courtney are available to detect these scans. These advanced scans, on the other hand, may be able to pass through unmolested.
    The idea is that closed ports are required to reply to your probe packet with an RST, while open ports must ignore the packets in question (see RFC 793 pp 64). The FIN scan uses a bare (surprise) FIN packet as the probe, while the Xmas tree scan turns on the FIN, URG, and PUSH flags. The Null scan turns off all flags. Unfortunately Microsoft (like usual) decided to completely ignore the standard and do things their own way. Thus this scan type will not work against systems running Windows95/NT. On the positive side, this is a good way to distin guish between the two platforms. If the scan finds open ports, you know the machine is not a Windows box. If a -sF,-sX,or -sN scan shows all ports closed, yet a SYN (-sS) scan shows ports being opened, you are probably looking at a Windows box. This is less useful now that nmap has proper OS detection built in. There are also a few other systems that are broken in the same way Windows is. They include Cisco, BSDI, HP/UX, MVS, and IRIX. All of the above send resets from the open ports when they should just drop the packet.
  • Ping: Sometimes you only want to know which hosts on a network are up. Nmap can do this by sending ICMP echo request packets to every IP address on the networks you specify. Hosts that respond are up. Unfortunately, some sites such as microsoft.com block echo request packets. Thus nmap can also send a TCP ack packet to (by default) port 80. If we get an RST back, that machine is up. A third technique involves sending a SYN packet and waiting for a RST or a SYN/ACK. For non-root users, a connect() method is used.
    By default (for root users), nmap uses both the ICMP and ACK techniques in parallel. You can change the -P option described later.
    Note that pinging is done by default anyway, and only hosts that respond are scanned. Only use this option if you wish to ping sweep without doing any actual port scans.
  • UDP Port Scan: This method is used to determine which UDP (User Datagram Protocol, RFC 768) ports are open on a host. The technique is to send 0 byte udp packets to each port on the target machine. If we receive an ICMP port unreachable message, then the port is closed. Otherwise we assume it is open.
    Some people think UDP scanning is pointless. I usu ally remind them of the recent Solaris rcpbind hole. Rpcbind can be found hiding on an undocu mented UDP port somewhere above 32770. So it doesn't matter that 111 is blocked by the firewall. But can you find which of the more than 30,000 high ports it is listening on? With a UDP scanner you can! There is also the cDc Back Orifice backdoor program which hides on a configurable UDP port on Windows machines. Not to mention the many commonly vulnerable services that utilize UDP such as snmp, tftp, NFS, etc.
    Unfortunately UDP scanning is sometimes painfully slow since most hosts implement a suggestion in RFC 1812 (section 4.3.2.8) of limiting the ICMP error message rate. For example, the Linux kernel (in net/ipv4/icmp.h) limits destination unreachable message generation to 80 per 4 seconds, with a 1/4 second penalty if that is exceeded. Solaris has much more strict limits (about 2 messages per sec ond) and thus takes even longer to scan. nmap detects this rate limiting and slows down accord ingly, rather than flood the network with useless packets that will be ignored by the target machine.
    As is typical, Microsoft ignored the suggestion of the RFC and does not seem to do any rate limiting at all on Win95 and NT machines. Thus we can scan all 65K ports of a Windows machine very quickly.
  • IP protocol: This method is used to determine which IP protocols are supported on a host. The technique is to send raw IP packets without any further protocol header to each specified protocol on the target machine. If we receive an ICMP pro tocol unreachable message, then the protocol is not in use. Otherwise we assume it is open. Note that some hosts (AIX, HP-UX, Digital UNIX) and firewalls may not send protocol unreachable messages. This causes all of the protocols to appear "open". Because the implemented technique is very similar to UDP port scanning, ICMP rate limit might apply too. But the IP protocol field has only 8 bits, so at most 256 protocols can be probed which should be possible in reasonable time anyway.
  • Idle Scan: This advanced scan method allows for a truly blind TCP port scan of the target (meaning no packets are sent to the target from your real IP address). Instead, a unique side-channel attack exploits predictable "IP fragmentation ID" sequence generation on the zombie host to glean information about the open ports on the target. IDS systems will display the scan as coming from the zombie machine you specify (which must be up and meet cer tain criteria). I am planning to put a more detailed explanation up at http://www.inse cure.org/nmap/nmap_documentation.html in the near future. Besides being extraordinarily stealthy (due to its blind nature), this scan type permits mapping out IP-based trust relationships between machines. The port listing shows open ports from the perspective of the zombie host. So you can try scanning a tar get using various zombies that you think might be trusted (via router/packet filter rules). Obvi ously this is crucial information when prioritizing attack targets. Otherwise, you penetration testers might have to expend considerable resources "own ing" an intermediate system, only to find out that its IP isn't even trusted by the target host/net work you are ultimately after a particular port on the zombie host for IPID changes. Otherwise Nmap will use the port it uses by default for "tcp pings".
  • ACK scan: This advanced method is usually used to map out firewall rulesets. In particular, it can help determine whether a firewall is stateful or just a simple packet filter that blocks incoming SYN packets.
    This scan type sends an ACK packet (with random looking acknowledgement/sequence numbers) to the ports specified. If a RST comes back, the ports is classified as "unfiltered". If nothing comes back (or if an ICMP unreachable is returned), the port is classified as "filtered". Note that nmap usu ally doesn't print "unfiltered" ports, so getting no ports shown in the output is usually a sign that all the probes got through (and returned RSTs). This scan will obviously never show ports in the "open" state.
  • Window scan: This advanced scan is very similar to the ACK scan, except that it can sometimes detect open ports as well as filtered/nonfiltered due to an anomaly in the TCP window size reporting by some operating systems. Systems vulnerable to this include at least some versions of AIX, Amiga, BeOS, BSDI, Cray, Tru64 UNIX, DG/UX, OpenVMS, Digital UNIX, FreeBSD, HP-UX, OS/2, IRIX, MacOS, NetBSD, OpenBSD, OpenStep, QNX, Rhapsody, SunOS 4.X, Ultrix, VAX, and VxWorks. See the nmap-hackers mailing list archive for a full list.
  • RPC scan: This method works in combination with the various port scan methods of Nmap. It takes all the TCP/UDP ports found open and then floods them with SunRPC program NULL commands in an attempt to determine whether they are RPC ports, and if so, what program and version number they serve up. Thus you can effectively obtain the same info as firewall (or protected by TCP wrappers). Decoys do not currently work with RPC scan, at some point I may add decoy support for UDP RPC scans.
  • List scan. This method simply generates and prints a list of IPs/Names without actually pinging or port scanning them. DNS name resolution will be performed unless you use -n.
  • FTP Bounce: An interesting "feature" of the ftp protocol (RFC 959) is support for "proxy" ftp connections. In other words, I should be able to connect from evil.com to the FTP server of tar get.com and request that the server send a file ANYWHERE on the internet! Now this may have worked well in 1985 when the RFC was written. But in today's Internet, we can't have people hijacking ftp servers and requesting that data be spit out to arbitrary points on the internet. As *Hobbit* wrote back in 1995, this protocol flaw "can be used to post virtually untraceable mail and news, hammer on servers at various sites, fill up disks, try to hop firewalls, and generally be annoying and hard to track down at the same time." What we will exploit this for is to (surprise, surprise) scan TCP ports from a "proxy" ftp server. Thus you could connect to an ftp server behind a firewall, and then scan ports that are more likely to be blocked (139 is a good one). If the ftp server allows reading from and writing to some directory (such as /incoming), you can send arbitrary data to ports that you do find open (nmap doesn't do this for you though).

    The argument passed to the 'b' option is the host you want to use as a proxy, in standard URL nota tion. The format is: username:pass word@server:port. Everything but server is optional. To determine what servers are vulnerable to this attack, you can see my article in Phrack 51. And updated version is available at the nmap URL (http://www.insecure.org/nmap).


Discover Folder Page

The discover page lets you choose the discovery method to use with nmap. The following picture shows a screenshot of the dicover page:

The following methods are supported:

  • TCP Ping: Use TCP "ping" to determine what hosts are up. Instead of sending ICMP echo request packets and waiting for a response, we spew out TCP ACK packets throughout the target network (or to a single machine) and then wait for responses to trickle back. Hosts that are up should respond with a RST. This option preserves the efficiency of only scan ning hosts that are up while still allowing you to scan networks/hosts that block ping packets. For non root users, we use connect(). To set the des tination port of the probe packets use -PT<port number>. The default port is 80, since this port is often not filtered out.
  • ICMP+TCP: This is the default ping type. It uses both the ACK ( -PT ) and ICMP ( -PI ) sweeps in parallel. This way you can get firewalls that filter either one (but not both). The TCP probe destination port can be set in the same manner as with -PT above.
  • ICMP:This option uses a true ping (ICMP echo request) packet. It finds hosts that are up and also looks for subnet-directed broadcast addresses on your network. These are IP addresses which are exter nally reachable and translate to a broadcast of incomming IP packets to a subnet of computers. These should be eliminated if found as they allow for numerous denial of service attacks (Smurf is the most common).
  • Don't Ping: Do not try and ping hosts at all before scanning them. This allows the scanning of networks that don't allow ICMP echo requests (or responses) through their firewall. microsoft.com is an exam ple of such a network, and thus you should always use -P0 or -PT80 when portscanning microsoft.com.


Options Folder Page

The options page lets you choose general nmap options. The following picture shows a screenshot of the options page:

General Options

The following general options can be selected:
  • Fragmentation: This option causes the requested SYN, FIN, XMAS, or NULL scan to use tiny fragmented IP packets. The idea is to split up the TCP header over several packets to make it harder for packet filters, intrusion detection systems, and other annoyances to detect what you are doing. Be careful with this! Some programs have trouble handling these tiny packets. My favorite sniffer segmentation faulted immediately upon receiving the first 36-byte frag ment. After that comes a 24 byte one! While this method won't get by packet filters and firewalls that queue all IP fragments (like the CON FIG_IP_ALWAYS_DEFRAG option in the Linux kernel), some networks can't afford the performance hit this causes and thus leave it disabled.
    Note that I do not yet have this option working on all systems. It works fine for my Linux, FreeBSD, and OpenBSD boxes and some people have reported success with other *NIX variants.
  • Get Identd Info: This turns on TCP reverse ident scanning. As noted by Dave Goldsmith in a 1996 Bugtraq post, the ident protocol (rfc 1413) allows for the disclosure of the username that owns any process connected via TCP, even if that process didn't initiate the con nection. So you can, for example, connect to the http port and then use identd to find out whether the server is running as root. This can only be done with a full TCP connection to the target port (i.e. the -sT scanning option). When -I is used, the remote host's identd is queried for each open port found. Obviously this won't work if the host is not running identd.
  • Resolve All: Tells Nmap to always do reverse DNS resolution on the target IP addresses. Normally this is only done when a machine is found to be alive.
  • Don't resolve: Tells Nmap to never do reverse DNS resolution on the active IP addresses it finds. Since DNS is often slow, this can help speed things up.
  • Fast Scan: Specifies that you only wish to scan for ports listed in the services file which comes with nmap (or the protocols file for -sO). This is obviously much faster than scanning all 65535 ports on a host.
  • OS Detection: This option activates remote host identification via TCP/IP fingerprinting. In other words, it uses a bunch of techniques to detect subtleties in the underlying operating system network stack of the computers you are scanning. It uses this informa tion to create a 'fingerprint' which it compares with its database of known OS fingerprints (the nmap-os-fingerprints file) to decide what type of system you are scanning.
    If Nmap is unable to guess the OS of a machine, and conditions are good (eg at least one open port), Nmap will provide a URL you can use to submit the fingerprint if you know (for sure) the OS running on the machine. By doing this you contribute to the pool of operating systems known to nmap and thus it will be more accurate for everyone. Note that if you leave an IP address on the form, the machine may be scanned when we add the fingerprint (to validate that it works).
    The -O option also enables several other tests. One is the "Uptime" measurement, which uses the TCP timestamp option (RFC 1323) to guess when a machine was last rebooted. This is only reported for machines which provide this information.
    Another test enabled by -O is TCP Sequence Predictability Classification. This is a measure that describes approximately how hard it is to establish a forged TCP connection against the remote host. This is useful for exploiting source- IP based trust relationships (rlogin, firewall fil ters, etc) or for hiding the source of an attack. The actual difficulty number is based on statisti cal sampling and may fluctuate. It is generally better to use the English classification such as "worthy challenge" or "trivial joke". This is only reported in normal output with -v.
    When verbose mode (-v) is on with -O, IPID Sequence Generation is also reported. Most machines are in the "incremental" class, which means that they increment the "ID" field in the IP header for each packet they send. This makes them vulnerable to several advanced information gathering and spoofing attacks.
  • Random Host: This option tells Nmap to generate its own hosts to scan by simply picking random numbers :). It will never end. This can be useful for statistical sam pling of the Internet to estimate various things. If you are ever really bored, try nmap -sS -iR -p 80 to find some web servers to look at.

Debug Options

The following debug options can be selected:
  • Debug: Writes debug output to the log screen.
  • Verbose: This is a highly recommended option and it gives out more information about what is going on. You can use it twice for greater effect. Use Debug a couple of times if you really want to get crazy with scrolling the screen!Writes debug output to the log screen.
  • Very Verbose: Even more verbose output.


Timing Folder Page

The timing page lets you choose timing options. The following picture shows a screenshot of the timing page:

Throttle Options

The following throttle options can be selected:
  • Paranoid: scans very slowly in the hopes of avoiding detec tion by IDS systems. It serializes all scans (no parallel scanning) and generally waits at least 5 minutes between sending packets.
  • Sneaky: is similar, except it only waits 15 seconds between sending packets.
  • Polite: is meant to ease load on the network and reduce the chances of crashing machines. It serializes the probes and waits at least 0.4 seconds between them.
  • Normal: is the default Nmap behaviour, which tries to run as quickly as possible without overloading the network or missing hosts/ports.
  • Agressive: mode adds a 5 minute timeout per host and it never waits more than 1.25 seconds for probe responses.
  • Insane: is only suitable for very fast networks or where you don't mind losing some information. It times out hosts in 75 seconds and only waits 0.3 seconds for individual probes. It does allow for very quick network sweeps though.
These canned timing modes should NOT be used in combination with the lower level controls given below. Per default nmapwin will use Normal.

Timeout Options

  • --host_timeout Specifies the amount of time in milliseconds Nmap is allowed to spend scanning a single host before giving up on that IP. The default timing mode has no host time out.
  • --max_rtt_timeout Specifies the maximum amount of time in millseconds Nmap is allowed to wait for a probe response before retransmitting or timing out that particular probe. The default mode sets this to about 9000.
  • --min_rtt_timeout When the target hosts start to establish a pattern of responding very quickly, Nmap will shrink the amount of time in milliseconds given per probe. This speeds up the scan, but can lead to missed packets when a response takes longer than usual. With this param eter you can guarantee that Nmap will wait at least the given amount of time before giving up on a probe.
  • --initial_rtt_timeout Specifies the initial probe timeout in millseconds. This is gen erally only useful when scanning firwalled hosts with -P0. Normally Nmap can obtain good RTT esti mates from the ping and the first few probes. The default mode uses 6000.
  • --max_parallelism Specifies the maximum number of scans Nmap is allowed to perform in parallel. Setting this to one means Nmap will never try to scan more than 1 port at a time. It also effects other parallel scans such as ping sweep, RPC scan, etc.
  • --scan_delay Specifies the minimum amount of time in milliseconds Nmap must wait between probes. This is mostly useful to reduce network load or to slow the scan way down to sneak under IDS thresholds.


Files Folder Page

The files page lets you choose input/output options. The following picture shows a screenshot of the files page:

Input File Options

The following input file options are supported:
  • Input File: read target specifications from the file specified RATHER than from the hostname exit box. The file should contain a list of host or network expressions seperated by spaces, tabs, or newlines. Use a hyphen (-) as inputfilename if you want nmap to read host expressions from stdin (like at the end of a pipe). See the section target specification for more information on the expressions you fill the file with. The browse button will open an file selection dialog, in which you can select the input file.

Output File Options:

  • Output File Name: writes the Nmap output to the specified file. The browse button will open an file selection dialog, in which you can select the output file.
  • Normal: This logs the results of your scans in a normal human readable form into the file you specify as an argument.
  • XML: this logs the results of your scans in XML form into the file you specify as an argument. This allows programs to easily capture and interpret Nmap results. You can give the argument ´-´ (with out quotes) to shoot output into stdout (for shell pipelines, etc). In this case normal output will be suppressed. Watch out for error messages if you use this (they will still go to stderr). Also note that ´-v´ may cause some extra information to be printed. The Document Type Definition (DTD) defin ing the XML output structure is available at http://www.insecure.org/nmap/nmap.dtd.
  • Grep: This logs the results of your scans in a grepable form into the file you specify as an argument. This simple format provides all the information on one line (so you can easily grep for port or OS information and see all the IPs. This used to be the preferred mechanism for programs to interact with Nmap, but now we recommend XML output (-oX instead). This simple format may not contain as much information as the other formats. You can give the argument ´-´ (without quotes) to shoot output into stdout (for shell pipelines, etc). In this case normal output will be suppressed. Watch out for error messages if you use this (they will still go to stderr). Also note that Verbose will cause some extra information to be printed.
  • All: this tells Nmap to log in ALL the majore formats (normal, grepable, and XML). You give a base for the filename, and the output files will be base.nmap, base.gnmap, and base.xml.
  • Append: Tells Nmap to append scan results to any output files you have specified rather than overwriting those files.


Windows Folder Page

The windows page lets you choose Windows specific options and commands. The following picture shows a screenshot of the windows page:

Windows Options

The following Windows specific options can be selected:
  • No Pcap: does not use the WinPcap library for packet capture, but used raw sockets.
  • No Hls Api: is similar, except it only waits 15 seconds between sending packets.
  • No Raw Sockets: No raw socket support.
  • Force Raw Sockets: Use raw sockets, even when nmap detected a working WinPcap library/packet driver.
  • NT4 Route: Tests nt4 route code.
  • Win Trace: Windows debugging options. Shows some more information for Win32 systems.

Windows Commands

The following Windows specific command are implemented:
  • List interfaces: Gives a list of available interfaces. The screenshot below shows a list of available interfaces. The list shows the name of the interface, the raw socket support and the IP address. The name, which is listed here has to be used in the device field on the Scan Page


Nmap network security scanner man page

NMAP(1)                                                   NMAP(1)

NAME

       nmap - Network exploration tool and security scanner

SYNOPSIS

       nmap [Scan Type(s)] [Options] <host or net #1 ... [#N]>

DESCRIPTION

       Nmap  is designed to allow system administrators and curi
       ous individuals to scan large networks to determine  which
       hosts  are  up  and what services they are offering.  nmap
       supports a large number of scanning  techniques  such  as:
       UDP, TCP connect(), TCP SYN (half open), ftp proxy (bounce
       attack), Reverse-ident, ICMP (ping sweep), FIN, ACK sweep,
       Xmas Tree, SYN sweep, IP Protocol, and Null scan.  See the
       Scan Types section for more details.  nmap also  offers  a
       number  of  advanced  features such as remote OS detection
       via TCP/IP fingerprinting, stealth scanning, dynamic delay
       and retransmission calculations, parallel scanning, detec
       tion of down hosts via  parallel  pings,  decoy  scanning,
       port  filtering  detection,  direct  (non-portmapper)  RPC
       scanning, fragmentation scanning, and flexible target  and
       port specification.

       Significant  effort  has been put into decent nmap perfor
       mance for non-root users.   Unfortunately,  many  critical
       kernel interfaces (such as raw sockets) require root priv
       ileges.  nmap should be run as root whenever possible (not
       setuid root, of course).

       The  result of running nmap is usually a list of interest
       ing ports on the machine(s) being scanned (if any).   Nmap
       always  gives  the  port's  "well  known" service name (if
       any), number, state, and protocol.  The  state  is  either
       'open',  ´filtered´, or ´unfiltered´.  Open means that the
       target machine will accept()  connections  on  that  port.
       Filtered  means  that a firewall, filter, or other network
       obstacle is covering the port  and  preventing  nmap  from
       determining  whether  the  port is open.  Unfiltered means
       that the port is known by nmap to be closed and  no  fire
       wall/filter  seems  to be interfering with nmap's attempts
       to determine this.  Unfiltered ports are the  common  case
       and  are  only shown when most of the scanned ports are in
       the filtered state.

       Depending on options used, nmap may also report  the  fol
       lowing  characteristics of the remote host: OS in use, TCP
       sequencability, usernames running the programs which  have
       bound  to  each  port, the DNS name, whether the host is a
       smurf address, and a few others.

OPTIONS

       Options that make sense together  can  generally  be  com
       bined.   Some  options are specific to certain scan modes.
       nmap tries to catch and warn the user about  psychotic  or
       unsupported option combinations.

       If you are impatient, you can skip to the examples section
       at the end, which demonstrates common usage.  You can also
       run  nmap  -h  for  a quick reference page listing all the
       options.

       SCAN TYPES

       -sT    TCP connect() scan: This is the most basic form  of
              TCP scanning. The connect() system call provided by
              your operating system is used to open a  connection
              to  every  interesting  port on the machine. If the
              port is listening, connect() will  succeed,  other
              wise the port isn't reachable. One strong advantage
              to this technique is that you don't need  any  spe
              cial  privileges.  Any  user  on most UNIX boxes is
              free to use this call.

              This sort of scan is easily  detectable  as  target
              host logs will show a bunch of connection and error
              messages for the services which accept()  the  con
              nection just to have it immediately shutdown.

       -sS    TCP  SYN  scan: This technique is often referred to
              as "half-open" scanning, because you don't  open  a
              full  TCP  connection. You send a SYN packet, as if
              you are going to open a  real  connection  and  you
              wait  for  a response. A SYN|ACK indicates the port
              is listening. A RST is  indicative  of  a  non-lis
              tener.   If a SYN|ACK is received, a RST is immedi
              ately sent to tear down  the  connection  (actually
              our OS kernel does this for us). The primary advan
              tage to this scanning technique is that fewer sites
              will  log  it.   Unfortunately you need root privi
              leges to build these custom SYN packets.

       -sF -sX -sN
              Stealth FIN, Xmas Tree, or Null scan  modes:  There
              are  times when even SYN scanning isn't clandestine
              enough. Some firewalls and packet filters watch for
              SYNs to restricted ports, and programs like Synlog
              ger and Courtney  are  available  to  detect  these
              scans. These advanced scans, on the other hand, may
              be able to pass through unmolested.

              The idea is that closed ports are required to reply
              to  your probe packet with an RST, while open ports
              must ignore the packets in question (see RFC 793 pp
              64).   The  FIN  scan  uses  a  bare (surprise) FIN
              packet as the probe, while the Xmas tree scan turns
              on  the  FIN,  URG,  and PUSH flags.  The Null scan
              turns off all flags.  Unfortunately Microsoft (like
              usual)  decided  to  completely ignore the standard
              and do things their own way.  Thus this  scan  type
              will not work against systems running Windows95/NT.
              On the positive side, this is a good way to distin
              guish between the two platforms.  If the scan finds
              open ports, you know the machine is not  a  Windows
              box.   If  a  -sF,-sX,or  -sN  scan shows all ports
              closed, yet a SYN  (-sS)  scan  shows  ports  being
              opened,  you are probably looking at a Windows box.
              This is less useful now that  nmap  has  proper  OS
              detection  built  in.   There  are also a few other
              systems that are broken in the same way Windows is.
              They  include  Cisco,  BSDI,  HP/UX, MVS, and IRIX.
              All of the above send resets from  the  open  ports
              when they should just drop the packet.

       -sP    Ping  scanning:  Sometimes  you  only  want to know
              which hosts on a network are up.  Nmap can do  this
              by  sending  ICMP  echo request packets to every IP
              address on the networks you  specify.   Hosts  that
              respond  are up.  Unfortunately, some sites such as
              microsoft.com block  echo  request  packets.   Thus
              nmap can also send a TCP ack packet to (by default)
              port 80.  If we get an RST back,  that  machine  is
              up.   A  third  technique  involves  sending  a SYN
              packet and waiting for a RST  or  a  SYN/ACK.   For
              non-root users, a connect() method is used.

              By  default  (for  root  users), nmap uses both the
              ICMP and  ACK  techniques  in  parallel.   You  can
              change the -P option described later.

              Note  that  pinging  is done by default anyway, and
              only hosts that respond are scanned.  Only use this
              option  if you wish to ping sweep without doing any
              actual port scans.

       -sU    UDP scans: This method is used to  determine  which
              UDP  (User  Datagram  Protocol,  RFC 768) ports are
              open on a host.  The technique is to  send  0  byte
              udp packets to each port on the target machine.  If
              we receive an ICMP port unreachable  message,  then
              the  port  is  closed.   Otherwise  we assume it is
              open.

              Some people think UDP scanning is pointless. I usu
              ally  remind  them  of  the  recent Solaris rcpbind
              hole. Rpcbind can be found  hiding  on  an  undocu
              mented  UDP  port  somewhere  above  32770.  So  it
              doesn't matter that 111 is blocked by the firewall.
              But can you find which of the more than 30,000 high
              ports it is listening on? With a  UDP  scanner  you
              can!   There  is also the cDc Back Orifice backdoor
              program which hides on a configurable UDP  port  on
              Windows machines.  Not to mention the many commonly
              vulnerable services that utilize UDP such as  snmp,
              tftp, NFS, etc.

              Unfortunately  UDP  scanning is sometimes painfully
              slow since most hosts implement a suggestion in RFC
              1812  (section  4.3.2.8) of limiting the ICMP error
              message rate.  For example, the  Linux  kernel  (in
              net/ipv4/icmp.h)   limits  destination  unreachable
              message generation to 80 per 4 seconds, with a  1/4
              second  penalty  if  that is exceeded.  Solaris has
              much more strict limits (about 2 messages per  sec
              ond)  and  thus  takes  even  longer to scan.  nmap
              detects this rate limiting and slows  down  accord
              ingly,  rather  than flood the network with useless
              packets that will be ignored by the target machine.

              As  is typical, Microsoft ignored the suggestion of
              the RFC and does not seem to do any  rate  limiting
              at  all on Win95 and NT machines.  Thus we can scan
              all 65K ports of a Windows  machine  very  quickly.
              Woop!

       -sO    IP protocol scans: This method is used to determine
              which IP protocols are supported on  a  host.   The
              technique  is  to  send  raw IP packets without any
              further protocol header to each specified  protocol
              on  the target machine.  If we receive an ICMP pro
              tocol unreachable message, then the protocol is not
              in use.  Otherwise we assume it is open.  Note that
              some hosts (AIX, HP-UX, Digital UNIX) and firewalls
              may  not  send protocol unreachable messages.  This
              causes all of the protocols to appear "open".

              Because the implemented technique is  very  similar
              to  UDP  port scanning, ICMP rate limit might apply
              too. But the IP protocol field has only 8 bits,  so
              at most 256 protocols can be probed which should be
              possible in reasonable time anyway.

       -sI <zombie host[:probeport]>
              Idlescan: This advanced scan method  allows  for  a
              truly blind TCP port scan of the target (meaning no
              packets are sent to the target from  your  real  IP
              address).   Instead,  a  unique side-channel attack
              exploits predictable "IP fragmentation ID" sequence
              generation  on the zombie host to glean information
              about the open ports on the  target.   IDS  systems
              will  display  the  scan  as coming from the zombie
              machine you specify (which must be up and meet cer
              tain  criteria).   I  am  planning  to  put  a more
              detailed   explanation   up   at   http://www.inse
              cure.org/nmap/nmap_documentation.html  in  the near
              future.

              Besides being extraordinarily stealthy (due to  its
              blind  nature),  this scan type permits mapping out
              IP-based trust relationships between machines.  The
              port  listing shows open ports from the perspective
              of the zombie host.  So you can try scanning a tar
              get  using  various zombies that you think might be
              trusted (via router/packet  filter  rules).   Obvi
              ously this is crucial information when prioritizing
              attack targets.  Otherwise, you penetration testers
              might  have  to expend considerable resources "own
              ing" an intermediate system, only to find out  that
              its  IP  isn't even trusted by the target host/net
              work you are ultimately after.

              a particular port  on  the  zombie  host  for  IPID
              changes.   Otherwise Nmap will use the port it uses
              by default for "tcp pings".

       -sA    ACK scan: This advanced method is usually  used  to
              map  out  firewall rulesets.  In particular, it can
              help determine whether a firewall  is  stateful  or
              just  a  simple  packet filter that blocks incoming
              SYN packets.

              This scan type sends an  ACK  packet  (with  random
              looking  acknowledgement/sequence  numbers)  to the
              ports specified.  If a RST comes back, the ports is
              classified  as "unfiltered".  If nothing comes back
              (or if an ICMP unreachable is returned),  the  port
              is  classified  as "filtered".  Note that nmap usu
              ally doesn't print "unfiltered" ports,  so  getting
              no ports shown in the output is usually a sign that
              all the probes got  through  (and  returned  RSTs).
              This  scan  will  obviously never show ports in the
              "open" state.

       -sW    Window scan: This advanced scan is very similar  to
              the  ACK  scan, except that it can sometimes detect
              open ports as well as filtered/nonfiltered  due  to
              an anomaly in the TCP window size reporting by some
              operating  systems.   Systems  vulnerable  to  this
              include at least some versions of AIX, Amiga, BeOS,
              BSDI, Cray, Tru64  UNIX,  DG/UX,  OpenVMS,  Digital
              UNIX,  FreeBSD,  HP-UX,  OS/2, IRIX, MacOS, NetBSD,
              OpenBSD,  OpenStep,  QNX,  Rhapsody,   SunOS   4.X,
              Ultrix,  VAX,  and  VxWorks.   See the nmap-hackers
              mailing list archive for a full list.

       -sR    RPC scan.  This method works  in  combination  with
              the  various  port  scan methods of Nmap.  It takes
              all the TCP/UDP ports found open  and  then  floods
              them  with  SunRPC  program  NULL  commands  in  an
              attempt to determine whether they  are  RPC  ports,
              and  if  so,  what  program and version number they
              serve up.  Thus you can effectively obtain the same
              info  as  firewall  (or protected by TCP wrappers).
              Decoys do not currently work with RPC scan, at some
              point I may add decoy support for UDP RPC scans.

       -sL    List scan.  This method simply generates and prints
              a list of IPs/Names  without  actually  pinging  or
              port  scanning  them.   DNS name resolution will be
              performed unless you use -n.

       -b <ftp relay host>
              FTP bounce attack: An interesting "feature" of  the
              ftp  protocol  (RFC 959) is support for "proxy" ftp
              connections. In other words, I should  be  able  to
              connect  from  evil.com  to  the FTP server of tar
              get.com and request that the  server  send  a  file
              ANYWHERE on the internet!  Now this may have worked
              well in 1985 when  the  RFC  was  written.  But  in
              today's  Internet,  we  can't have people hijacking
              ftp servers and requesting that data be spit out to
              arbitrary points on the internet. As *Hobbit* wrote
              back in 1995, this protocol flaw "can  be  used  to
              post virtually untraceable mail and news, hammer on
              servers at various sites, fill up disks, try to hop
              firewalls,  and  generally  be annoying and hard to
              track down at the same time." What we will  exploit
              this  for is to (surprise, surprise) scan TCP ports
              from a "proxy" ftp server. Thus you  could  connect
              to  an  ftp server behind a firewall, and then scan
              ports that are more likely to be blocked (139 is  a
              good  one).  If  the ftp server allows reading from
              and writing to some directory (such as  /incoming),
              you  can  send  arbitrary data to ports that you do
              find open (nmap doesn't do this for you though).

              The argument passed to the 'b' option is  the  host
              you  want  to use as a proxy, in standard URL nota
              tion.     The     format     is:     username:pass
              word@server:port.    Everything   but   server   is
              optional.  To determine what servers are vulnerable
              to  this  attack,  you can see my article in Phrack
              51.  And updated version is available at  the  nmap
              URL (http://www.insecure.org/nmap).

       GENERAL OPTIONS
              None  of  these  are required but some can be quite
              useful.

       -P0    Do not try and ping hosts at  all  before  scanning
              them.   This  allows  the scanning of networks that
              don't  allow  ICMP  echo  requests  (or  responses)
              through  their firewall.  microsoft.com is an exam
              ple of such a network, and thus you  should  always
              use -P0 or -PT80 when portscanning microsoft.com.

       -PT    Use  TCP  "ping"  to  determine  what hosts are up.
              Instead of sending ICMP echo  request  packets  and
              waiting for a response, we spew out TCP ACK packets
              throughout the  target  network  (or  to  a  single
              machine)  and  then  wait  for responses to trickle
              back.  Hosts that are up should respond with a RST.
              This  option preserves the efficiency of only scan
              ning hosts that are up while still allowing you  to
              scan  networks/hosts  that block ping packets.  For
              non root users, we use connect().  To set the  des
              tination  port  of  the  probe packets use -PT<port
              number>.  The default port is 80, since  this  port
              is often not filtered out.

       -PS    This  option  uses SYN (connection request) packets
              instead of ACK packets for root users.  Hosts  that
              are  up  should  respond  with a RST (or, rarely, a
              SYN|ACK).  You can set the destination port in  the
              same manner as -PT above.

       -PI    This  option  uses  a true ping (ICMP echo request)
              packet.  It finds hosts that are up and also  looks
              for  subnet-directed  broadcast  addresses  on your
              network.  These are IP addresses which  are  exter
              nally  reachable  and  translate  to a broadcast of
              incomming IP packets  to  a  subnet  of  computers.
              These  should  be eliminated if found as they allow
              for numerous denial of service  attacks  (Smurf  is
              the most common).

       -PB    This  is  the  default ping type.  It uses both the
              ACK ( -PT ) and ICMP ( -PI )  sweeps  in  parallel.
              This  way  you can get firewalls that filter either
              one (but not both).  The TCP probe destination port
              can be set in the same manner as with -PT above.

       -O     This  option  activates  remote host identification
              via TCP/IP fingerprinting.  In other words, it uses
              a  bunch  of techniques to detect subtleties in the
              underlying operating system network  stack  of  the
              computers  you are scanning.  It uses this informa
              tion to create a 'fingerprint'  which  it  compares
              with  its  database  of  known OS fingerprints (the
              nmap-os-fingerprints file) to decide what  type  of
              system you are scanning.

              If Nmap is unable to guess the OS of a machine, and
              conditions are good (eg at least  one  open  port),
              Nmap  will  provide a URL you can use to submit the
              fingerprint if you know (for sure) the  OS  running
              on  the  machine.   By doing this you contribute to
              the pool of operating systems  known  to  nmap  and
              thus  it  will be more accurate for everyone.  Note
              that if you leave an IP address on  the  form,  the
              machine  may be scanned when we add the fingerprint
              (to validate that it works).

              The -O option also  enables  several  other  tests.
              One is the "Uptime" measurement, which uses the TCP
              timestamp option (RFC 1323) to guess when a machine
              was  last  rebooted.   This  is  only  reported for
              machines which provide this information.

              Another  test  enabled  by  -O  is   TCP   Sequence
              Predictability  Classification.   This is a measure
              that describes approximately  how  hard  it  is  to
              establish  a  forged  TCP  connection  against  the
              remote host.  This is useful for exploiting source-
              IP based trust relationships (rlogin, firewall fil
              ters, etc) or for hiding the source of  an  attack.
              The  actual difficulty number is based on statisti
              cal sampling and may fluctuate.   It  is  generally
              better  to  use  the English classification such as
              "worthy challenge" or "trivial joke".  This is only
              reported in normal output with -v.

              When verbose mode (-v) is on with -O, IPID Sequence
              Generation is also reported.  Most machines are  in
              the  "incremental"  class,  which  means  that they
              increment the "ID" field in the IP header for  each
              packet  they  send.   This makes them vulnerable to
              several advanced information gathering and spoofing
              attacks.

       -I     This  turns on TCP reverse ident scanning. As noted
              by Dave Goldsmith in a 1996 Bugtraq post, the ident
              protocol  (rfc  1413)  allows for the disclosure of
              the username that owns any  process  connected  via
              TCP,  even if that process didn't initiate the con
              nection. So you can, for example,  connect  to  the
              http  port  and then use identd to find out whether
              the server is running as root.  This  can  only  be
              done  with a full TCP connection to the target port
              (i.e. the -sT scanning option).  When -I  is  used,
              the  remote  host's identd is queried for each open
              port found.  Obviously this won't work if the  host
              is not running identd.

       -f     This option causes the requested SYN, FIN, XMAS, or
              NULL scan to use tiny fragmented IP  packets.   The
              idea  is  to  split  up the TCP header over several
              packets to  make  it  harder  for  packet  filters,
              intrusion  detection  systems, and other annoyances
              to detect what you are doing. Be careful with this!
              Some  programs  have  trouble  handling  these tiny
              packets. My favorite sniffer  segmentation  faulted
              immediately  upon receiving the first 36-byte frag
              ment. After that comes a 24 byte  one!  While  this
              method  won't  get  by packet filters and firewalls
              that  queue  all  IP  fragments  (like   the   CON
              FIG_IP_ALWAYS_DEFRAG  option  in the Linux kernel),
              some networks can't afford the performance hit this
              causes and thus leave it disabled.

              Note  that I do not yet have this option working on
              all systems.  It works fine for my Linux,  FreeBSD,
              and  OpenBSD  boxes  and  some people have reported
              success with other *NIX variants.

       -v     Verbose mode.  This is a highly recommended  option
              and  it  gives  out  more information about what is
              going on.  You can use it twice for greater effect.
              Use  -d a couple of times if you really want to get
              crazy with scrolling the screen!

       -h     This handy option display a quick reference  screen
              of  nmap  usage  options.  As you may have noticed,
              this man page is not exactly a 'quick reference' :)

       -oN <logfilename>
              This  logs  the  results  of your scans in a normal
              human readable form into the file you specify as an
              argument.

       -oX <logfilename>
              This  logs  the  results  of your scans in XML form
              into the file you specify  as  an  argument.   This
              allows  programs  to  easily  capture and interpret
              Nmap results.  You can give the argument ´-´ (with
              out  quotes) to shoot output into stdout (for shell
              pipelines, etc).  In this case normal  output  will
              be suppressed.  Watch out for error messages if you
              use this (they will still go to stderr).  Also note
              that  ´-v´  may  cause some extra information to be
              printed.  The Document Type Definition (DTD) defin
              ing  the  XML  output  structure  is  available  at
              http://www.insecure.org/nmap/nmap.dtd .

       -oG <logfilename>
              This logs the results of your scans in  a  grepable
              form  into  the  file  you  specify as an argument.
              This simple format provides all the information  on
              one  line  (so  you  can easily grep for port or OS
              information and see all the IPs.  This used  to  be
              the  preferred  mechanism  for programs to interact
              with Nmap, but now we  recommend  XML  output  (-oX
              instead).   This  simple  format may not contain as
              much information as the  other  formats.   You  can
              give  the  argument  ´-´  (without quotes) to shoot
              output into stdout (for shell pipelines, etc).   In
              this  case normal output will be suppressed.  Watch
              out for error messages if you use this  (they  will
              still  go  to  stderr).   Also  note that ´-v´ will
              cause some extra information to be printed.

       -oA <basefilename>
              This tells Nmap to log in ALL  the  majore  formats
              (normal,  grepable,  and XML).  You give a base for
              the  filename,  and  the  output  files   will   be
              base.nmap, base.gnmap, and base.xml.

       -oS <logfilename>
              thIs  l0gz  th3  r3suLtS  of YouR ScanZ iN a s|<ipT
              kiDd|3 f0rM iNto THe fiL3 U sPecfy 4s an  arGuMEnT!
              U  kAn  gIv3  the  4rgument ´-´ (wItHOUt qUOteZ) to
              sh00t output iNT0 stDouT!@!!

       --resume <logfilename>
              A network scan that is cancelled due to  control-C,
              network  outage,  etc.  can  be  resumed using this
              option.  The logfilename must be  either  a  normal
              (-oN)  or  machine  parsable  (-oM)  log  from  the
              aborted scan.  No other options can be given  (they
              will  be  the same as the aborted scan).  Nmap will
              start on the machine after the  last  one  success
              fully scanned in the log file.

       --append_output
              Tells  Nmap  to  append  scan results to any output
              files you have specified  rather  than  overwriting
              those files.

       -iL <inputfilename>
              Reads target specifications from the file specified
              RATHER than from the command line.  The file should
              contain  a  list  of  host  or  network expressions
              seperated by spaces,  tabs,  or  newlines.   Use  a
              hyphen  (-)  as  inputfilename  if you want nmap to
              read host expressions from stdin (like at  the  end
              of  a  pipe).  See the section target specification
              for more information on the  expressions  you  fill
              the file with.

       -iR    This option tells Nmap to generate its own hosts to
              scan by simply picking random numbers :).  It  will
              never end.  This can be useful for statistical sam
              pling of the Internet to estimate  various  things.
              If  you  are ever really bored, try nmap -sS -iR -p
              80 to find some web servers to look at.

       -p <port ranges>
              This option specifies what ports you want to  spec
              ify.  For  example '-p 23' will only try port 23 of
              the target host(s).   ´-p  20-30,139,60000-´  scans
              ports  between  20  and 30, port 139, and all ports
              greater than 60000.  The default  is  to  scan  all
              ports  between  1  and  1024  as  well as any ports
              listed in the services file which comes with  nmap.
              For  IP protocol scanning (-sO), this specifies the
              protocol number you wish to scan for (0-255).

              When scanning both TCP and UDP ports, you can spec
              ify  a  particular  protocol  by preceding the port
              numbers by "T:" or "U:".  The qualifier lasts until
              you  specify  another  qualifier.  For example, the
              argument   "-p    U:53,111,137,T:21-25,80,139,8080"
              would scan UDP ports 53,111,and 137, as well as the
              listed TCP ports.  Note that to  scan  both  UDP  &
              TCP,  you  have to specify -sU and at least one TCP
              scan type (such as -sS, -sF, or -sT).  If no proto
              col  qualifier is given, the port numbers are added
              to all protocol lists.

       -F Fast scan mode.
              Specifies that you only  wish  to  scan  for  ports
              listed  in  the services file which comes with nmap
              (or the protocols file for -sO).  This is obviously
              much  faster  than  scanning  all  65535 ports on a
              host.

       -D <decoy1 [,decoy2][,ME],...>
              Causes a decoy scan to be performed which makes  it
              appear  to  the  remote  host  that the host(s) you
              specify as decoys are scanning the  target  network
              too.   Thus  their IDS might report 5-10 port scans
              from unique IP addresses, but they won't know which
              IP  was  scanning  them  and  which  were  innocent
              decoys.  While this can be defeated through  router
              path tracing, response-dropping, and other "active"
              mechanisms, it is generally an extremely  effective
              technique for hiding your IP address.

              Separate  each  decoy host with commas, and you can
              optionally use 'ME' as one of the decoys to  repre
              sent  the  position  you want your IP address to be
              used.  If your put 'ME'  in  the  6th  position  or
              later,  some  common  port  scan detectors (such as
              Solar Designer's excellent scanlogd) are  unlikeley
              to  show  your IP address at all.  If you don't use
              'ME', nmap will put you in a random position.

              Note that the hosts you use as decoys should be  up
              or  you  might  accidently  SYN flood your targets.
              Also it will be pretty easy to determine which host
              is  scanning if only one is actually up on the net
              work.  You might want to use IP  addresses  instead
              of  names  (so  the decoy networks don't see you in
              their nameserver logs).

              Also note that some (stupid) "port scan  detectors"
              will  firewall/deny  routing  to hosts that attempt
              port scans.  Thus you might inadvertantly cause the
              machine  you  scan  to  lose  connectivity with the
              decoy machines you are using.  This could cause the
              target  machines  major  problems  if the decoy is,
              say, its  internet  gateway  or  even  "localhost".
              Thus  you  might want to be careful of this option.
              The real moral of the story is  that  detectors  of
              spoofable port scans should not take action against
              the machine that seems like  it  is  port  scanning
              them.  It could just be a decoy!

              Decoys  are  used  both  in  the  initial ping scan
              (using ICMP, SYN, ACK, or whatever) and during  the
              actual  port  scanning phase.  Decoys are also used
              during remote OS detection ( -O ).

              It is worth noting that using too many  decoys  may
              slow  your  scan  and potentially even make it less
              accurate.  Also, some ISPs  will  filter  out  your
              spoofed  packets, although many (currently most) do
              not restrict spoofed IP packets at all.

       -S <IP_Address>
              In some circumstances, nmap  may  not  be  able  to
              determine  your source address ( nmap will tell you
              if this is the case).  In this  situation,  use  -S
              with  your IP address (of the interface you wish to
              send packets through).

              Another possible use of this flag is to  spoof  the
              scan to make the targets think that someone else is
              scanning them.  Imagine a company being  repeatedly
              port  scanned  by a competitor!  This is not a sup
              ported usage (or the main purpose) of this flag.  I
              just  think  it  raises  an interesting possibility
              that people should  be  aware  of  before  they  go
              accusing  others  of  port scanning them.  -e would
              generally be required for this sort of usage.

       -e <interface>
              Tells nmap what interface to send and receive pack
              ets  on.  Nmap should be able to detect this but it
              will tell you if it cannot.

       -g <portnumber>
              Sets the source port number used  in  scans.   Many
              naive firewall and packet filter installations make
              an exception in their ruleset to allow DNS (53)  or
              FTP-DATA (20) packets to come through and establish
              a connection.  Obviously this  completely  subverts
              the  security  advantages  of  the  firewall  since
              intruders can just masquerade as FTP or DNS by mod
              ifying their source port.  Obviously for a UDP scan
              you should try 53 first and TCP scans should try 20
              before  53.   Note  that  this is only a request --
              nmap will honor it only if and when it is able  to.
              For example, you can't do TCP ISN sampling all from
              one host:port to one host:port, so nmap changes the
              source port even if you used -g.

              Be  aware that there is a small performance penalty
              on some scans for  using  this  option,  because  I
              sometimes  store  useful  information in the source
              port number.

       -n     Tells Nmap to NEVER do reverse  DNS  resolution  on
              the  active  IP  addresses  it finds.  Since DNS is
              often slow, this can help speed things up.

       -R     Tells Nmap to ALWAYS do reverse DNS  resolution  on
              the  target  IP  addresses.   Normally this is only
              done when a machine is found to be alive.

       -r     Tells Nmap NOT to  randomize  the  order  in  which
              ports are scanned.

       --randomize_hosts
              Tells  Nmap  to  shuffle  each  group of up to 2048
              hosts before it scans  them.   This  can  make  the
              scans  less  obvious  to various network monitoring
              systems, especially when you combine it  with  slow
              timing options (see below).

       -M <max sockets>
              Sets  the  maximum  number  of sockets that will be
              used in parallel for  a  TCP  connect()  scan  (the
              default).   This  is useful to slow down the scan a
              little bit  and  avoid  crashing  remote  machines.
              Another  approach is to use -sS, which is generally
              easier for machines to handle.

       TIMING OPTIONS
              Generally Nmap does a good  job  at  adjusting  for
              Network  characteristics at runtime and scanning as
              fast as possible while minimizing that  chances  of
              hosts/ports  going  undetected.  However, there are
              same cases where Nmap's default timing  policy  may
              not  meet  your  objectives.  The following options
              provide a fine level of control over the scan  tim
              ing:

       -T <Paranoid|Sneaky|Polite|Normal|Aggressive|Insane>
              These  are  canned timing policies for conveniently
              expressing your priorities to Nmap.  Paranoid  mode
              scans  very  slowly in the hopes of avoiding detec
              tion by IDS systems.  It serializes all  scans  (no
              parallel  scanning)  and generally waits at least 5
              minutes between sending packets.  Sneaky  is  simi
              lar,  except it only waits 15 seconds between send
              ing packets.  Polite is meant to ease load  on  the
              network   and   reduce   the  chances  of  crashing
              machines.  It serializes the probes  and  waits  at
              least  0.4  seconds  between  them.   Normal is the
              default Nmap  behaviour,  which  tries  to  run  as
              quickly as possible without overloading the network
              or missing hosts/ports.  Aggressive mode adds  a  5
              minute  timeout  per  host  and it never waits more
              than 1.25 seconds for probe responses.   Insane  is
              only  suitable  for very fast networks or where you
              don't mind losing some information.  It  times  out
              hosts  in 75 seconds and only waits 0.3 seconds for
              individual probes.  It does allow  for  very  quick
              network  sweeps  though :).  You can also reference
              these by number (0-5).  For example, ´-T  0´  gives
              you Paranoid mode and ´-T 5´ is Insane mode.

              These  canned  timing  modes  should NOT be used in
              combination with the  lower  level  controls  given
              below.

       --host_timeout <milliseconds>
              Specifies  the  amount  of  time Nmap is allowed to
              spend scanning a single host before  giving  up  on
              that IP.  The default timing mode has no host time
              out.

       --max_rtt_timeout <milliseconds>
              Specifies  the  maximum  amount  of  time  Nmap  is
              allowed   to  wait  for  a  probe  response  before
              retransmitting or timing out that particular probe.
              The default mode sets this to about 9000.

       --min_rtt_timeout <milliseconds>
              When  the target hosts start to establish a pattern
              of responding very quickly, Nmap  will  shrink  the
              amount of time given per probe.  This speeds up the
              scan,  but  can  lead  to  missed  packets  when  a
              response takes longer than usual.  With this param
              eter you can guarantee that Nmap will wait at least
              the  given  amount  of  time  before giving up on a
              probe.

       --initial_rtt_timeout <milliseconds>
              Specifies the initial probe timeout.  This is  gen
              erally  only  useful  when scanning firwalled hosts
              with -P0.  Normally Nmap can obtain good RTT  esti
              mates  from the ping and the first few probes.  The
              default mode uses 6000.

       --max_parallelism <number>
              Specifies the  maximum  number  of  scans  Nmap  is
              allowed  to  perform  in parallel.  Setting this to
              one means Nmap will never try to scan more  than  1
              port  at  a  time.   It also effects other parallel
              scans such as ping sweep, RPC scan, etc.

       --scan_delay <milliseconds>
              Specifies the minimum amount of time Nmap must wait
              between  probes.   This  is mostly useful to reduce
              network load or to slow the scan way down to  sneak
              under IDS thresholds.

TARGET SPECIFICATION

       Everything  that  isn't  an option (or option argument) in
       nmap is treated as a target host specification.  The  sim
       plest  case is listing single hostnames or IP addresses on
       the command line.  If you want to  scan  a  subnet  of  IP
       addresses,  you  can  append '/mask' to the hostname or IP
       address.  mask must be between 0 (scan the whole internet)
       and  32 (scan the single host specified).  Use /24 to scan
       a class 'C' address and /16 for a class 'B'.

       Nmap also has a more  powerful  notation  which  lets  you
       specify an IP address using lists/ranges for each element.
       Thus you can scan the whole class 'B' network  192.168.*.*
       by  specifying  '192.168.*.*'  or '192.168.0-255.0-255' or
       even ´192.168.1-50,51-255.1,2,3,4,5-255'.  And  of  course
       you  can  use  the mask notation: '192.168.0.0/16'.  These
       are all equivalent.  If you use asterisks ('*'),  remember
       that  most  shells  require  you  to escape them with back
       slashes or protect them with quotes.

       Another interesting thing to do is slice the Internet  the
       other  way.   Instead of scanning all the hosts in a class
       specifying hosts to scan, see the examples section.

EXAMPLES

       Here are some examples of using nmap, from simple and nor
       mal  to  a little more complex/esoteric.  Note that actual
       numbers and some actual domain  names  are  used  to  make
       things  more  concrete.  In their place you should substi
       tute addresses/names from your  own  network.   I  do  not
       think  portscanning  other networks is illegal; nor should
       portscans be construed by others as  an  attack.   I  have
       scanned   hundreds  of  thousands  of  machines  and  have
       received only one complaint.  But I am not  a  lawyer  and
       some  (anal)  people  may  be annoyed by nmap probes.  Get
       permission first or use at your own risk.

       nmap -v target.example.com

       This option scans all reserved TCP ports  on  the  machine
       target.example.com .  The -v means turn on verbose mode.

       nmap -sS -O target.example.com/24

       Launches  a  stealth SYN scan against each machine that is
       up out of the 255 machines on class 'C' where target.exam
       ple.com  resides.  It also tries to determine what operat
       ing system is running on each host that is up and running.
       This  requires root privileges because of the SYN scan and
       the OS detection.

       nmap -sX -p 22,53,110,143,4564 198.116.*.1-127

       Sends an Xmas tree scan to the first half of each  of  the
       255  possible  8  bit  subnets  in  the  198.116 class 'B'
       address space.  We are testing  whether  the  systems  run
       sshd,  DNS,  pop3d,  imapd,  or port 4564.  Note that Xmas
       scan doesn't work on Microsoft boxes due  to  their  defi
       cient  TCP  stack.  Same goes with CISCO, IRIX, HP/UX, and
       BSDI boxes.

       nmap -v --randomize_hosts -p 80 '*.*.2.3-5'

       Rather than focus on a specific IP range, it is  sometimes
       interesting  to  slice  up  the entire Internet and scan a
       small sample from each slice.  This command finds all  web
       servers  on  machines  with  IP  addresses ending in .2.3,
       .2.4, or .2.5 find more interesting machines  starting  at
       127.  so  you  might  want to use '127-222' instead of the
       first asterisks because that section has a greater density
       of interesting machines (IMHO).

       host -l company.com | cut '-d ' -f 4 | ./nmap -v -iL -

       Do  a  DNS  zone transfer to find the hosts in company.com
       and then feed the IP addresses to nmap.   The  above  com
       mands  are  for  my GNU/Linux box.  You may need different
       commands/options on other operating systems.

BUGS

       Bugs?  What bugs?  Send me any that you find.  Patches are
       nice  too  :) Remember to also send in new OS fingerprints
       so we can grow the database.  Nmap will give you a submis
       sion URL when an appropriate fingerprint is found.

AUTHOR

       Fyodor <fyodor@insecure.org>

DISTRIBUTION

       The   newest   version   of  nmap  can  be  obtained  from
       http://www.insecure.org/nmap/

       nmap is (C) 1995-2001 by Insecure.Com LLC

       libpcap is also distributed along with nmap.  It is  copy
       righted  by  Van Jacobson, Craig Leres and Steven McCanne,
       all of the Lawrence Berkeley National Laboratory,  Univer
       sity of California, Berkeley, CA.  The version distributed
       with nmap may be modified, pristine sources are  available
       from ftp://ftp.ee.lbl.gov/libpcap.tar.Z .

       This  program  is  free  software; you can redistribute it
       and/or modify it under the terms of the GNU General Public
       License as published by the Free Software Foundation; Ver
       sion 2.  This guarantees your right to  use,  modify,  and
       redistribute  Nmap  under  certain  conditions.   If  this
       license is unacceptable to you, Insecure.Org may be  will
       ing  to  sell  alternative  licenses (contact fyodor@inse
       cure.org).

       Source is provided to this  software  because  we  believe
       users have a right to know exactly what a program is going
       to do before they run it.  This also allows you  to  audit
       the  software  for security holes (none have been found so
       far).

       Source code also allows you to port Nmap to new platforms,
       fix bugs, and add new features.  You are highly encouraged
       to send your changes to fyodor@insecure.org  for  possible
       incorporation  into  the  main  distribution.   By sending
       these changes to Fyodor or one the  insecure.org  develop
       ment  mailing  lists,  it is assumed that you are offering
       Fyodor the unlimited, non-exclusive right to  reuse,  mod
       ify,  and  relicense  the code.  This is important because
       the inability to relicense  code  has  caused  devastating
       problems for other Free Software projects (such as KDE and
       NASM).  Nmap will always be available Open Source.  If you
       wish to specify special license conditions of your contri
       butions, just say so when you send them.

       This program is distributed in the hope that  it  will  be
       useful, but WITHOUT ANY WARRANTY; without even the implied
       warranty of MERCHANTABILITY or FITNESS  FOR  A  PARTICULAR
       PURPOSE.   See  the  GNU  General  Public License for more
       details (it is in the COPYING file of the  nmap  distribu
       tion).

       It  should also be noted that Nmap has been known to crash
       certain poorly written applications,  TCP/IP  stacks,  and
       even  operating systems.  Nmap should never be run against
       mission critical systems unless you are prepared to suffer
       downtime.   We  acknowledge  here that Nmap may crash your
       systems or networks and we disclaim all liability for  any
       damage or problems Nmap could cause.

       Because  of  the  slight risk of crashes and because a few
       black hats like to use Nmap for  reconnaissance  prior  to
       attacking  systems,  there  are  administrators who become
       upset and may  complain  when  their  system  is  scanned.
       Thus,  it  is often advisable to request permission before
       doing even a light scan of a network.

       Nmap should never be run with privileges  (eg  suid  root)
       for security reasons.

       All  versions  of  Nmap  equal  to or greater than 2.0 are
       believed to be Year 2000 (Y2K) compliant in all  respects.
       There  is  no  reason to believe versions earlier than 2.0
       are susceptible to problems, but we have not tested  them.


What's new in version 1.2.0

Release date: 12/05/2002

New features:

  • Better Documentation: nmapwin has now documentation in Microsoft HtmlHelp format. This includes the nmap manual pages.
  • WinPCap: WinPCap version 2.3 included. WinPcap 2.3 has to be installed prior to install NMapWin.
The demo version can be downloaded for free from here. The full version can be downloaded from here.


What's new in version 1.2.1

Release date: 14/05/2002

Bug fixes:

  • Fixed bug in nmapserv: nmapserv has a bug which caused the service to start a nmap scan every minute after the start time passed. This has been fixed.
  • Fixed bug in nmapwin: nmapwin has a bug which caused a wrong parsing of the registry keys. Not all parameters were correctly set. This has been fixed.
  • CCGNU32: GNU CommonC++ thread library was missing from distribution.
The demo version can be downloaded for free from here. The full version can be downloaded from here.


What's new in version 1.2.2

Release date: 16/05/2002

Bug fixes:

  • Bad executable on SourceForge: by accident the binary was corrupted on sourceforge.


What's new in version 1.2.3

Release date: 18/05/2002

Bug fixes:

  • NMapServ: Endless loop in nmapserv when interval = 0. Now, minimum interval is 1h.
  • Install: Fixed bug in installation script, which caused an error message to be displayed when it tries to install the servive.

New Features:

  • License: Put everything under GPL (GNU Public License).


What's new in version 1.2.4

Release date: 25/05/2002

Bug fixes:

  • Help: HTML Help file was not accesible from inside NMapWin.
  • Source Port: The source port check box was not removing the command line options when checked and afterwards unchecked.
  • Source Address: Source address (-S) was missing from the GUI.
  • Source Address/Port: Widgets have been renamed and rearranged.
  • Resume: Resume an interrupted scan was not included as an options on the options page.
  • FilePage: Input/Ouput Button was not enabled when page was loaded from registry.
  • NMapServ: Service was not correctly calculating the next scan time.

New features:

  • NMap: NMap v2.54beta34 included.
  • NMapWin: NMapWin installation procedure supports Windows XP and Windows/NT now Windows/XP and Windows/NT are not fully tested at the moment.


What's new in version 1.2.5

Release date: 07/06/2002

Bug fixes:

  • Install Fixed bug in XP/NT4 installation. The install wizard was not creating %NMAPDIR%\bin directory.
  • nmapwin Removed all debug information and used better compressiong for installation executable.

New features:

  • NMapWin: new page "Win32" with windows specific options and some windows specific features, like listing the available interface.


What's new in version 1.2.6

Release date: 10/06/2002

Bug fixes:

  • Install Fixed bug in Windows XP Pro installation.


What's new in version 1.2.7

Release date: 11/06/2002

Bug fixes:

  • Install CCGNU32.dll was corrupt.


What's new in version 1.2.8

Release date: 09/07/2002

Bug fixes:

  • Install: New InstallShield script. No bogus error message about beta version anymore.
  • NMapWin: Maximum log file name length increased to 256.
  • NMapServ: The Win32 service will stop all running nmap instances during service shutdown.

New Features

  • NMapWin: Changed log output window to CEdit class. This allows to copy the content of the log output window to be copied to the clipboard.
  • NMap: Version 2.54beta36 included.
  • NMap: Default scan method set to SYN.


What's new in version 1.2.9

Release date: 10/07/2002

Bug fixes:

  • Install: Fixed bug during service installation. This caused the installation to hang during service installation.


What's new in version 1.2.10

Release date: 12/07/2002

Bug fixes:

  • Install: Removed autostart service from installation script. It's now an options to start the service or not


What's new in version 1.2.11

Release date: 14/07/2002

Bug fixes:

  • Install: Included WinPCap installation as feature in the installation script. This will install the WinPCap packet driver. On uninstallation this driver will NOT be uninstalled (as it's probably used by other programs).
  • NMapWin: Fixed bug in NMapWin, which caused the executable to crash when launched from the installation script.
  • NMapWin: NMAPDATADIR environment variable removed from installation. It's not needed anymore.


What's new in version 1.2.12

Release date: 16/07/2002

Bug fixes:

  • NMap: In v 1.2.11, under some circumstances the nmap data files are not found anymore. This has been fixed.


What's new in version 1.2.13

Release date: 26/07/2002

New features:

  • NMapWin: Clicking the service page will automatically retrieve the latest service parameters from the registry.
  • NMapWin: New check box 'AutoStart'. If checked the service will start scanning, otherwise the service does not scan the network until 'AutoStart' is checked and the change is written to the registry (using the 'Set Param' button). Per default (after installation), AutoStart is set to 'OFF' and the service is not scanning any network until AutoStart is set to 'ON'. The 'AutoStart' change is written directly into the registry and the service gets a notification that the service parameters have been changed. Nevertheless this change will not take effect immediately. Depending on the scan interval the next scan will be executed after the scan interval. See below for the immediately flag.
  • NMapWin: Immediately flag. If checked the service will start one scan job immediately, independently from the interval setting.
  • NMapWin: Button names changed to Get Param, Set Param, Start Service and Stop Service.

Bug fixes:

  • NMapWin: Message box when hostfield contains '127.0.0.1'. Local loopback cannot be scanned.
  • NMapWin: Message box when one of the scan options textfields is empty while the check box is checked.
  • NMapWin: Message box when host field is empty and no input file defined.
  • NMapWin: Status line shows command which will be executed, even after a '--win_list_interfaces'.
  • NMapWin: Interval time combo box on the service page made bigger, so all options can be seen.
  • NMapServ: Default network is 127.0.0.1. As the local loopback is not scanned, this is secure and should not cause any alarms.
  • Help: When pressing the help button, the default page was displayed with images.

Copyright © 2001 - 2002 JV Software


What's new in version 1.3.0

Release date: 10/08/2002

New Features:

  • nmap: New nmap 3.0 included.


What's new in version 1.3.1

Release date: 20/11/2002

Bug fixes:

  • nmapwin: Some mnemonics for the main page
  • nmapwin: When a scan with a input file was finished, the host field was automatically set to editable. This has been fixed. The host field stays ineditable.
  • winpcap: Included WinPCap 3.0 alpha 4, which seems to be much more stable on WindowsXP.
  • install: The InstallShield installation is not installing the WinPCap library/driver anymore. Instead the installation script checks whether WinPCap is installed and issues a warning. In this case WinPCap should be installed from %NMAPDIR%\wpcap before one can use NMapWin/nmap.
  • install: Using new InstallShield 7.04 with new MSI hotfix. I hope this is fixing the problem with WindowsXP. The installation was tested on WindowsXP and WindowsXP sp1 and didn't show any errors.


Option Folder

Copyright © JV Software