Nmap

No entries match these filters. Clear filters

1. Planned pull request, proposed · source
   • ▪This PR adds a native macOS build and packaging path alongside the existing Nmap source tree.
2. v7.992 Oct 12, 2026 · issue 110

   Nmap 7.992 adds a libfuzzer framework for internal function testing, NSE memory (400 MB) and CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. (5 s) guardrails, DHX2 AFPAFPApple Filing Protocol, Apple's legacy network file-sharing protocol for macOS and older Mac OS systems. Cyber tools target or parse it when auditing network shares or credential exposure on Apple-heavy environments. auth, and XML output for two NSE scripts.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v7.992 https://github.com/nmap/nmap.git
   # already have the repo? check out this version:
   $ git checkout v7.992

   • Adds a libfuzzer-based fuzzing framework covering internal functions of Nmap, Ncat, and Nping, with 10 functions instrumented so far.
   • Limits NSE Lua interpreter to 400 MB memory and kills script threads that exceed 5 seconds of execution without yielding.
   • Adds --script-timeout and --host-timeout enforcement for previously uninterruptible NSE script loops in rdp.lua, tn3270.lua, and ospf.lua.
   • Replaces the cryptographically broken DHCAST128 UAM in afp.lua with DHX2, preventing credential decryption from network traffic.
   • Implements XML output for the rsync-list-modules NSE script.

   +3 more show less

   • Implements XML output for the http-config-backup NSE script.
   • Fixes -iR random target generation to detect and halt when all possible addresses are excluded, preventing infinite loops.
   • Uses random (non-sequential) transaction IDs for DNS requests to reduce predictability.

   8 details in Everything

   • New detection SAP HANA database service probe
   • Updated supported platform Bundled library upgrades
3. changes since 2026-09-11 Oct 5, 2026 · issue 095

   Expands dicom.lua into a full DIMSEDIMSEA messaging protocol defined by the DICOM standard for exchanging medical images and metadata between networked healthcare devices, giving cyber tools a structured way to query, retrieve, or push DICOM objects. toolkit (C-STORE/FIND/GET/MOVE, role negotiation, DICOMDICOMAn open standard for storing and transmitting medical imaging data, maintained by NEMA, that defines both the file format and network protocol used to exchange scans between clinical systems.-over-TLS); dns.query() now accepts a host table via the host option.

   • Expands dicom.lua into a full DIMSE toolkit supporting C-STORE, C-FIND, C-GET, C-MOVE, role negotiation, and DICOM-over-TLS.
   • Adds dns.query() support for passing a host table (not just a bare IP address) via the host option in NSE scripts.

   2 details in Everything

   • New detection DICOM auditing NSE scripts
4. changes since 2026-09-11 Oct 3, 2026 · issue 093

   Nmap gains an 8-script DICOMDICOMAn open standard for storing and transmitting medical imaging data, maintained by NEMA, that defines both the file format and network protocol used to exchange scans between clinical systems. auditing suite and a full DIMSEDIMSEA messaging protocol defined by the DICOM standard for exchanging medical images and metadata between networked healthcare devices, giving cyber tools a structured way to query, retrieve, or push DICOM objects. toolkit (C-STORE/FIND/GET/MOVE, role negotiation, DICOM-over-TLS).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Fingerprint all DICOM services on a PACS subnet and surface weak TLS certificates and unauthenticated access in one pass.
   copy

   $ nmap -p 104,11112 --script dicom-info,dicom-cfind-ls,dicom-store-inject <target>

   Fuzz a DICOM C-STORE endpoint to detect crashes or protocol errors in medical imaging devices during a pen test.
   copy

   $ nmap -p 104 --script dicom-store-fuzzer <target>

   Test whether a DICOM archive allows unauthenticated C-MOVE retrieval to an arbitrary destination AE.
   copy

   $ nmap -p 104 --script dicom-cmove,dicom-get <target>

   • Adds dicom-info NSE script to fingerprint a DICOM SCPSCPSecure Copy Protocol, a file-transfer method built on SSH that encrypts data in transit; cyber tools use it to move files to or from remote hosts without exposing credentials or content. via A-ASSOCIATE, reporting Implementation Class UID, Version Name, accepted SOP classes and transfer syntaxes, max PDU, protocol version, and — over TLS — server certificate details (key type/size, signature algorithm, weak-crypto and self-signed flags) and mutual-TLS posture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds dicom-cfind-ls NSE script to perform C-FIND queries enumerating studies, series, and patient-level metadata, flagging unauthenticated query access.
   • Adds dicom-cmove NSE script to exercise C-MOVE and test whether stored studies can be retrieved to an arbitrary destination AE.
   • Adds dicom-get NSE script to retrieve instances over C-GET with SCP/SCU role negotiation and report unauthenticated read access.
   • Adds dicom-store-fuzzer NSE script to fuzz the C-STORE service with a corpus of malformed datasets, classifying each response (accept, reject, timeout, reset, corrupt) and running periodic C-ECHO health checks to detect crashes mid-campaign.

   +3 more show less

   • Adds dicom-store-inject NSE script to test whether an archive accepts an unauthenticated C-STORE by uploading a single crafted instance.
   • Expands dicom.lua into a full DIMSE toolkit supporting C-STORE, C-FIND, C-GET, C-MOVE, role negotiation, and DICOM-over-TLS.
   • Adds dns.query() support for passing a host table (not just a plain IP address) via the host option in NSE scripts.
   • Adds dicom-info NSE script to fingerprint a DICOM SCPSCPSecure Copy Protocol, a file-transfer method built on SSH that encrypts data in transit; cyber tools use it to move files to or from remote hosts without exposing credentials or content. via A-ASSOCIATE, reporting Implementation Class UID, Version Name, accepted SOP classes and transfer syntaxes, max PDU, protocol version, and — over TLS — server certificate details (key type/size, signature algorithm, weak-crypto and self-signed flags) and mutual-TLS posture.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds dicom-cfind-ls NSE script to perform C-FIND queries enumerating studies, series, and patient-level metadata, flagging unauthenticated query access.
   • Adds dicom-cmove NSE script to exercise C-MOVE and test whether stored studies can be retrieved to an arbitrary destination AE.
   • Adds dicom-get NSE script to retrieve instances over C-GET with SCP/SCU role negotiation and report unauthenticated read access.
   • Adds dicom-store-fuzzer NSE script to fuzz the C-STORE service with a corpus of malformed datasets, classifying each response (accept, reject, timeout, reset, corrupt) and running periodic C-ECHO health checks to detect crashes mid-campaign.

   +2 more show less

   • Adds dicom-store-inject NSE script to test whether an archive accepts an unauthenticated C-STORE by uploading a single crafted instance.
   • Expands dicom.lua into a full DIMSE toolkit supporting C-STORE, C-FIND, C-GET, C-MOVE, role negotiation, and DICOM-over-TLS.

   1 more in Everything

5. changes since 2026-09-11 Oct 1, 2026 · issue 092

   Nmap gains NSE execution time and memory limits, plus upgraded libpcaplibpcapA C library, maintained by the tcpdump project, that provides a portable API for capturing and filtering raw network packets, sparing cyber tools from writing platform-specific packet-capture code. 1.10.7, pcre2pcre2A widely used open-source regular expression library maintained by the PCRE2 Project, offering Perl-compatible pattern matching that cyber tools embed for fast, expressive text and binary searching. 10.48, Lua 5.4.9, and libdnetlibdnetA portable C library for low-level network access, covering raw sockets, ARP tables, routing, and interface configuration. Cyber tools use it to manipulate packets and network state without writing platform-specific code. 1.18.2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Upgrades bundled libraries to libpcap 1.10.7, pcre2 10.48, Lua 5.4.9, and libdnet 1.18.2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Ncat in listen mode now forwards termination signals (SIGINT, SIGTERM, SIGHUP, SIGQUIT) only to child processes started for connections when -k and cmdexec are both in effect, instead of the entire process group.
   • Upgrades bundled libraries to libpcap 1.10.7, pcre2 10.48, Lua 5.4.9, and libdnet 1.18.2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

6. changes since 2026-09-06 Sep 11, 2026 · issue 071

   Nmap NSE gains rudimentary 802.1Q802.1QAn IEEE standard that adds a 4-byte VLAN tag to Ethernet frames, letting a single physical link carry traffic for multiple isolated networks. Cyber tools use it to capture or inject traffic on specific VLANs. / 802.1ad802.1adAn IEEE standard extending 802.1Q VLANs by allowing a second VLAN tag, enabling service providers to tunnel customer VLAN traffic across their own tagged network without tag collisions. VLAN tag support for parsing and building tagged Ethernet frames.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds frame.vlans list to packet.Frame:new(), populated with per-tag tables containing tpid, pcp, dei, and vid fields when 802.1Q (0x8100) or 802.1ad (0x88a8) tags are present.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Extends packet.Frame:build_ether_frame() with an optional VLAN list parameter to construct 802.1Q / 802.1ad tagged Ethernet headers from NSE scripts.
   • Adds ETHER_TYPE_8021Q and ETHER_TYPE_8021AD constants to the NSE packet library for use in script-level Ethernet type comparisons.
   • Updates the pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. capture path to correctly skip multiple stacked 802.1Q / 802.1ad VLAN tags when computing L3 offsets, enabling NSE scripts to operate on traffic from tagged (trunk) network segments.
   • Adds frame.vlans list to packet.Frame:new(), populated with per-tag tables containing tpid, pcp, dei, and vid fields when 802.1Q (0x8100) or 802.1ad (0x88a8) tags are present.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds ETHER_TYPE_8021Q and ETHER_TYPE_8021AD constants to the NSE packet library for use in script-level Ethernet type comparisons.

   2 more in Everything

7. changes since 2026-09-02 Sep 6, 2026 · issue 067

   Nmap gains NSE execution time and memory limits, DHX2 AFPAFPApple Filing Protocol, Apple's legacy network file-sharing protocol for macOS and older Mac OS systems. Cyber tools target or parse it when auditing network shares or credential exposure on Apple-heavy environments. auth, and a new afp.uam script argument

   • Adds afp.uam script argument to afp.lua to select the user authentication method, e.g. 'DHCAST128' or 'DHX2'
   • Adds DHX2 (Diffie-Hellman Exchange 2) authentication method support to afp.lua
   • Introduces execution time limits for NSE scripts: threads running more than 5 seconds without yielding are killed
   • Introduces memory allocation limits for NSE scripts: allocations beyond 400 MB throw an error

   4 details in Everything

8. changes since 2026-08-31 Sep 2, 2026 · issue 062

   Nmap NSE gets a 400 MB memory cap and a 5-second execution watchdog that kills non-yielding threads.

   • Enforces a 400 MB memory limit on the Nmap Scripting Engine (NSE) Lua runtime to bound per-scan resource consumption.

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !NSE scripts that legitimately run without yielding for more than 5 seconds will now be forcibly terminated, potentially breaking long-running scripts that do not yield control.
9. changes since 2026-08-27 Aug 31, 2026 · issue 060

   Nmap adds separate IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. trie structures and a new SAP HANA database service probe

10. changes since 2026-08-18 Aug 23, 2026 · issue 054

    Nmap's rsync-list-modules NSE script gains structured XML output

11. changes since 2026-08-09 Aug 18, 2026 · issue 050

    Nmap gains a libfuzzer-based fuzzing framework covering Ncat HTTP, traceroute, DNS, and packet validation routines.

    • Adds a libfuzzer-based fuzzing framework for Nmap internals, with fuzzers for Ncat HTTP functions, decode_reply() in traceroute, gettcpopt_ts, validatepkt(), and several libnetutil functions.
    • Switches DNS transaction IDs (TXID) from sequential to random to reduce predictability in DNS requests.
    • Improves DNS resolver correctness: timeout now starts only after the write completes, late replies are accepted without clobbering existing results, and request ID lookup is tracked per-server.
    • Improves Lua's random number generator to produce more random output.

    4 details in Everything

12. changes since 2026-07-11 Aug 9, 2026 · issue 041

    Nmap gains TLS close_notify tolerance, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. service portrule coverage, and signal propagation to child processes with -k.

    └──▷ TRY IT
    Specify an interface with -e to bind both the outgoing interface and the source address, useful when a host has multiple NICsNICsA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. and you need traffic to leave a specific one.
    copy

    $ nmap -e eth1 -S 192.168.1.50 <target>

    • Adds -k signal propagation: termination signals (INT/TERM/HUP) are now caught and forwarded to the entire process group, then Ncat exits with 128 + signum, ensuring child processes are not orphaned.
    • NSE scripts now include s (SSL-protected) service names — such as amt-soap-https — in their portrules, so scripts run against SSL-wrapped services as well as their standard unencrypted counterparts.
    • Nmap now tolerates TLS peers that do not send close_notify, preventing spurious scan failures against non-compliant TLS targets.
    • http-referer-checker now categorizes but does not fetch off-host URLs, limiting requests to URLs on the target host only.

    4 details in Everything

13. changes since 2026-07-09 Aug 7, 2026 · issue 039

    Nmap 7.991 adds SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. service name matching for portrules and fixes Ncat HTTP proxy hang, libssh2 CVEs, and DNS case matching.

    • Adds 's' service names (e.g. amt-soap-https) to NSE portrules so scripts that run on standard unencrypted services also run on their SSL-protected equivalents.
    • Ncat now propagates termination signals (SIGINT, SIGTERM, SIGHUP) to child processes when using -k keep-open mode, preventing orphaned children on shutdown.

    2 details in Everything

14. 7.991 Aug 6, 2026 · release notes

    Nmap 7.991 adds --stats-every with --noninteractive and builds with OpenSSL 4.0.

    └──▷ USE IT
    Print stats every 10 seconds during an automated headless scan
    shell copy

    nmap --noninteractive --stats-every 10s -sV target.com

    • --stats-every can now be used in conjunction with --noninteractive to print periodic stats without a TTY
    • Nmap can now be built with OpenSSL 4.0

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !--release-memory is now a no-op
    • ▪Latest stable release self-installer: nmap-7.991-setup.exe release notes · source
    • ▪Latest stable release installer: nmap-7.991.dmg release notes · source
    • ▪Nmap binaries for Apple macOS (x86-64) are distributed as a disk image file containing an installer. release notes, unconfirmed · source
15. 7.99 Mar 26, 2026 · release notes

    Nmap 7.99 adds VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. adapter scanning, Zenmap universal wheel install, new NSE URL functions, and improved OS/service fingerprints.

    • Adds --vpn-adapter support for scanning over VPN virtual adapters like OpenVPN TAP
    • Distributes Zenmap as a universal wheel (zenmap-7.99-py3-none-any.whl) for Python 3 installation
    • Updates included OS and service fingerprints with many new IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. entries

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The hostmap-crtsh .lax script argument is required to preserve the old substring-matching behavior
16. 7.96 May 1, 2025 · release notes

    Nmap 7.96 adds parallel forward DNS, new NSE scripts for Mikrotik and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only., Zenmap dark mode, Ncat -q, and Nsock engines via --nsock-engine.

    • Adds mikrotik-routeros-version, mikrotik-routeros-username-brute NSE scripts and new service probes for MikroTik WinBox.
    • Adds targets-ipv6-eui64 NSE script to generate IPv6 addresses from MACs using EUI-64.
    • Adds Zenmap dark mode, accessed via Profile->Toggle Dark Mode or the window::dark_mode config key in zenmap.conf.
    • Nmap now allows specifying targets on both the command line and in an input file (-iL) simultaneously without ignoring command-line targets.
    • Nmap can now scan IP protocol 255.

    +2 more show less

    • Adds Ncat option -q to delay quit after EOF on stdin, matching traditional netcat behavior.
    • Allows setting Nsock engines (e.g., iocp, poll) via the new CLI argument --nsock-engine=<engine>.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Ncat in connect mode no longer defaults to half-closed TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections (use -k to restore old behavior).
17. 7.95 Apr 23, 2024 · release notes

    Nmap 7.95 adds industrial control system NSE scripts and expands OS/service fingerprint databases.

    └──▷ USE IT
    Scan an industrial control network segment for PROFINET devices using multicast discovery.
    shell copy

    nmap --script multicast-profinet-discovery <target_subnet>

    Query a device's manufacturing message specification interface for configuration details.
    shell copy

    nmap -p 1984 --script iec61850-mms <target_ip>

    Identify the device information of a Highway Addressable Remote Transducer (HART) device.
    shell copy

    nmap -p 5672 --script hartip-info <target_ip>

    • Adds four new NSE scripts for industrial control systems: hartip-info, iec61850-mms, multicast-profinet-discovery, and profinet-cm-lookup
    • Adds support for detecting the following protocols via service version detection: grpc, mysqlx, essnet, remotemouse, and tuya
    • Increases OS fingerprint database to 6,036 signatures (including iOS 15/16, macOS Ventura/Monterey, Linux 6.1, OpenBSD 7.1, lwIP 2.2) and service detection signatures to 12,089

    3 details in Everything

18. 7.94 May 19, 2023 · release notes

    Nmap 7.94 adds tftp-version NSE script, UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. support in -sV/Ncat, and partial silent install via /S.

    └──▷ TRY IT
    Identify the software running on a TFTPTFTPTrivial File Transfer Protocol, a minimal UDP-based file transfer protocol standardized in RFC 1350, used by cyber tools when simplicity and low overhead matter more than authentication or error recovery. server without downloading files.
    copy

    $ nmap --script tftp-version <target>

    • Adds tftp-version NSE script to identify TFTP server software by requesting a nonexistent file
    • New /S silent-install flag for the Nmap Windows installer to automate deployment alongside Npcap
    • UDP version scan (-sV) now probes services behind DTLS tunnels, same as TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS probing

    3 details in Everything

19. 7.93 Sep 1, 2022 · release notes

    Nmap 7.93 adds client ID support to DHCP scripts and allows Ncat to bind via SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. hostname targets.

    └──▷ USE IT
    Connect to a remote service through a SOCKS5 proxy where the proxy returns bind addresses as hostnames
    shell copy

    ncat --proxy-type socks5 --proxy hostname.proxy:1080 target.host 443

    • dhcp-discover and broadcast-dhcp-discover NSE scripts now accept a client identifier option, allowing the script to send a specific Client ID in its DHCP Discover packets
    • Nmap output DTD updated to include the <hosthint> element for structured host hint data

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The win32 zipfile distribution is no longer created; users must use the self-installer or extract from a source build.
20. 7.92 Aug 7, 2021 · release notes

    Nmap 7.92 adds --unique flag, new UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. payloads, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Windows support, and NSE script improvements.

    └──▷ TRY IT
    Prevent duplicate scans when scanning a domain that resolves to multiple IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses.
    copy

    $ nmap --unique example.com

    • Support for TLS 1.3 in relevant NSE scripts (e.g., ssl-enum-ciphers) requiring OpenSSL 1.1.1+
    • Three new NSE scripts: nbns-interfaces, openflow-info, and port-states
    • New UDP payloads: TS3INIT1 for port 3389 and DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. for port 3391 (RD Gateway)
    • Redesigned SMB2SMB2A Microsoft network file-sharing protocol (version 2 of SMB) used for remote file, printer, and service access over a network; cyber tools target or implement it to inspect, relay, or exploit Windows file-sharing traffic. dialect handling improves speed of smb-protocols and aligns dialect names with Microsoft standards

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Windows builds no longer support Windows Vista and earlier versions due to the upgrade to Visual Studio 2019
    • !Support for the legacy WinPcap library has been removed; Npcap is now required
21. 7.90 Oct 3, 2020 · release notes

    Nmap 7.90 adds DICOMDICOMAn open standard for storing and transmitting medical imaging data, maintained by NEMA, that defines both the file format and network protocol used to exchange scans between clinical systems. NSE scripts, --discovery-ignore-rst, TLS SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. override, OEM edition, and Nsock iocp default.

    └──▷ USE IT
    Scan hosts that may be spoofing RST packets to avoid false negatives during host discovery.
    shell copy

    nmap --discovery-ignore-rst -sn <target>

    Brute force DICOM servers to find valid Application Entity Titles using the new script.
    shell copy

    nmap --script dicom-brute -p 104 <target>

    Override the TLS Server Name Indication in Ncat for testing or specific server routing.
    shell copy

    ncat --ssl --ssl-servername custom.example.com <host> 443

    • [Windows] Upgraded Npcap to milestone 1.00 release with performance improvements
    • Integrated over 800 service/version detection fingerprints increasing total to 11,878 signatures
    • Added 26 IPv4 OS fingerprints for iOS 12 & 13, macOS Catalina & Mojave, Linux 5.4, and FreeBSD 13
    • Integrated all 67 IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. OS fingerprint submissions from August 2017 to September 2020
    • Added NSE script dicom-brute to brute force DICOM Application Entity Titles

    +15 more show less

    • Added NSE script dicom-ping to discover DICOM servers and test connection permissions
    • Added NSE script uptime-agent-info to collect system information from Idera Uptime agents
    • Released customized Nmap OEM Edition for silent installation in Windows software
    • Removed nmap-update utility that depended on Subversion version control
    • Restricted NMAPDATADIR search path on Windows so it is not searched and --script names are not interpreted as directories unless followed by '/'
    • Added new outlib library for NSE output formatting and structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed.
    • Added new dicom library implementing the DICOM protocol for medical images in NSE
    • Nsock iocp engine is now default on Windows replacing poll for improved performance
    • Reduced CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage of OS scan by 50% avoiding string copy operations
    • Allowed multiple UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. payloads to be specified for a port in nmap-payloads with round-robin fallback
    • Added new option --discovery-ignore-rst to ignore TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. RST responses during host discovery
    • Ncat allows overriding TLS SNI value via --ssl-servername flag
    • Added UDP payload for STUN (Session Traversal Utilities for NAT)
    • SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. scripts are now enabled on non-standard ports where SNMP has been detected
    • Allowed resuming IPv6 scans with --resume flag

    20 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed nmap-update utility
    • !Removed the silent-install command-line option (/S) from the standard Windows installer (remains in Nmap OEM)
    • !Restricted NMAPDATADIR search path on Windows so it is not searched
22. 7.80 Aug 10, 2019 · release notes

    Nmap 7.80 adds AF_VSOCK support to Ncat/Nsock, new --proxy-dns flag, and multiple detection NSE scripts.

    └──▷ TRY IT
    Resolve proxy hostnames at the remote proxy rather than locally
    copy

    $ ncat --proxy host.example.com:8080 --proxy-dns target.example.com 443

    Query the Vulners database for CVEs related to detected services in a scan
    copy

    $ nmap --script vulners -sV target.example.com

    • AF_VSOCK address family added to Nsock and Ncat for VM-to-hypervisor communication
    • New --proxy-dns option in Ncat controls whether proxy destination resolution happens locally or at the remote proxy
    • New broadcast-jenkins-discover NSE script discovers Jenkins servers via LAN broadcast
    • New vulners NSE script queries the Vulners CVE database API using CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. data from service detection

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The bit.lua NSE library has been completely removed; use native Lua bitwise operations or the new bits.lua library instead
23. 7.70 Mar 20, 2018 · release notes

    Nmap 7.70 adds --resolve-all flag, 9 new NSE scripts, and updates bundled Npcap.

    └──▷ USE IT
    Scan all IP addresses associated with a hostname instead of just the primary A record.
    shell copy

    nmap --resolve-all target.com

    Check if a TLS server supports modern protocol negotiation and which protocols are available.
    shell copy

    nmap -p 443 --script tls-alpn target.com

    Identify subdomains exposed through Certificate TransparencyCertificate TransparencyA public, append-only log system maintained by various operators (Google runs several) that records every TLS certificate issued, letting anyone audit CAs for misissued or rogue certificates. logs.
    shell copy

    nmap --script hostmap-crtsh target.com

    • Adds --resolve-all option to resolve and scan all IP addresses of a host
    • Added deluge-rpc-brute NSE script for brute-force credential testing against Deluge BitTorrent RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. services
    • Added hostmap-crtsh NSE script to list subdomains via Google's Certificate Transparency logs
    • Added http-bigip-cookie NSE script to decode unencrypted F5 BIG-IP cookies and reveal backend server IPs
    • Added http-jsonp-detection NSE script to discover JSONP endpoints in web servers

    +6 more show less

    • Added http-trane-info NSE script to obtain information from Trane Tracer SC controllers
    • Added nbd-info NSE script to query Network Block Devices for protocol and file export info
    • Added smb-enum-services NSE script to retrieve the list of services running on a remote Windows machine
    • Added tls-alpn NSE script to check TLS servers for Application Layer Protocol Negotiation (ALPN) support
    • VNC scripts now support Apple Remote Desktop authentication (auth type 30)
    • memcached-info can now gather information from the UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. memcached service in addition to TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed deprecated and undocumented aliases for several long options that used underscores instead of hyphens, such as --max_retries
24. 7.60 Jul 31, 2017 · release notes

    Nmap 7.60 adds Ncat DTLSDTLSA variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic./ALPN support and comprehensive SMB2SMB2A Microsoft network file-sharing protocol (version 2 of SMB) used for remote file, printer, and service access over a network; cyber tools target or implement it to inspect, relay, or exploit Windows file-sharing traffic./3 script library.

    └──▷ USE IT
    Securely tunnel UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. traffic over DTLS for protocols like CoAP or DNS.
    shell copy

    ncat --udp --ssl dtls://<host>:443

    Automate running remote commands on a target via SSH without interactive login.
    shell copy

    nmap --script ssh-run <target>

    Check for naive signing misconfigurations in Puppet CA using the new dedicated script.
    shell copy

    nmap --script puppet-naivesigning <target>

    • Adds Datagram TLS (DTLS) support to Ncat in connect mode with --udp --ssl
    • Adds Application Layer Protocol Negotiation (ALPN) support via Ncat's --ssl-alpn option
    • Replaces smbv2-enabled script with new SMB2/3 scripts: smb-protocols, smb2-capabilities, smb2-time, smb2-security-mode, and smb2-vuln-uptime
    • Adds complete SSH support in NSE via libssh2, including scripts ssh-run, ssh-brute, ssh-auth-methods, ssh-publickey-acceptance, and updated FTP TLS handling

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The smbv2-enabled NSE script was removed and fully replaced by smb-protocols
25. 7.50 Jun 13, 2017 · release notes

    Nmap 7.50 adds OSPF2 discovery, CICS enumeration, Samba/Windows SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. vuln scripts, Ncat IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. fallback and TLS ciphers, new vulns.short arg, and improved HTTP/TLS scripting API

    └──▷ USE IT
    Discover OSPFv2 routers on the local subnet to map routing infrastructure.
    shell copy

    nmap --script broadcast-ospf2-discover

    Enumerate CICS usernames via brute-force on a TN3270 service.
    shell copy

    nmap --script cics-user-brute --script-args userdb=users.txt <target>

    Connect via Ncat using specific TLS ciphers to test cipher support.
    shell copy

    ncat --ssl-ciphers HIGH:MEDIUM:!aNULL <host> 443

    • Adds broadcast-ospf2-discover NSE script to discover OSPFv2 routers and neighbors, supporting OSPFv2 authentication
    • Adds cics-info and cics-user-brute NSE scripts for IBM TN3270 CICS transaction service info gathering and username brute-forcing
    • Adds --ssl-ciphers option to Ncat in client (connect) mode for specifying TLS cipher suites
    • Adds vulns.short script argument to reduce vulns library output to a single line containing target, state, and CVE/title

    4 details in Everything

26. 7.40 Dec 20, 2016 · release notes

    Nmap 7.40 adds scan resume, IP geolocation mapping scripts, --defeat-icmp-ratelimit, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. support, and NSE updates.

    └──▷ TRY IT
    Resume a scan from a previous XML output file to avoid scanning already-completed hosts.
    copy

    $ nmap --resume nmap-output.xml

    Reduce UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. scan duration on rate-limited networks by sacrificing some port state accuracy for speed.
    copy

    $ nmap --defeat-icmp-ratelimit -sU <target>

    Visualize scan results' IP geolocation on Bing Maps for a quick operational overview.
    copy

    $ nmap --script ip-geolocation-map-bing <target>

    • Adds --resume option to restore a canceled scan from -oN, -oG, or -oX output formats
    • Adds ip-geolocation-map-bing NSE script to render IP geolocation data as an image via Bing Maps API
    • Adds ip-geolocation-map-google NSE script to render IP geolocation data as an image via Google Maps API
    • Adds ip-geolocation-map-kml NSE script to record IP geolocation data in a KMLKMLAn XML-based file format maintained by the OGC for storing geographic data such as points, paths, and polygons. Cyber tools use it to visualize location-based intelligence on maps. file for import into other mapping software
    • Adds new service probe and UDP payload for Quick UDP Internet Connection (QUIC) transport

    +6 more show less

    • Adds new option --defeat-icmp-ratelimit to dramatically reduce UDP scan times by relabeling unresponsive ports as closed|filtered
    • Adds tls.servername script-arg to the tls.servername NSE script for forcing a TLS Server Name Indication extension
    • Adds known Diffie-Hellman parameters for haproxy, postfix, and IronPort to the ssl-dh-params NSE script
    • Adds service probe for ClamAV servers (clam)
    • Adds 149 new OS fingerprints including Linux 4.6, macOS 10.12 Sierra, and NetBSD 7.0
    • Adds new tn3270 library accompanying the tn3270-screen NSE script for mainframe telnet services

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removes the ssl-google-cert-catalog NSE script due to Google shutting off that service
27. 7.30 Sep 29, 2016 · release notes

    Nmap 7.30 adds new NSE scripts for CoAP, IPMI, MQTT and PLCs plus enhanced X509v3 SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. parsing.

    └──▷ TRY IT
    Brute-force IPMI service authentication
    copy

    $ nmap --script ipmi-brute <target>

    Subscribe to MQTT topics and capture messages for analysis
    copy

    $ nmap --script mqtt-subscribe -p 1883 <target>

    Retrieve CoAP resources from a target endpoint
    copy

    $ nmap --script coap-resources <target>

    • Adds coap-resources NSE script to retrieve available resources from CoAP endpoints
    • Adds ipmi-brute NSE script for authentication brute-forcing on IPMI services
    • Adds ipmi-cipher-zero NSE script to check for Cipher Zero support allowing passwordless connection
    • Adds ipmi-version NSE script to retrieve protocol version and auth options from ASF-RMCP (IPMI)
    • Adds mqtt-subscribe NSE script to connect to MQTT brokers, subscribe to topics, and list received messages

    +2 more show less

    • Adds pcworx-info NSE script to retrieve PLC model, firmware version, and date from Phoenix Contact PLCs
    • Enhances ssl-cert NSE script to show X509v3 Subject Alternative Name and all extensions in XML output

    7 details in Everything

28. 7.25beta2 Prerelease Sep 1, 2016 · release notes

    Nmap 7.25beta2 adds --script-timeout, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. decoys, Ncat -z, and two new NSE scripts.

    • Adds the --script-timeout option to limit run time for every individual NSE script
    • Adds support for decoys in IPv6 (previously supported only in IPv4)
    • Adds a -z option to Ncat for quick port status checks without sending data
    • Adds the oracle-tns-version NSE script to decode Oracle Database Server's TNS listener version
    • Adds the clock-skew NSE script to analyze and report clock skew between Nmap and services reporting timestamps

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed the bit library in NSE; use bits.lua instead
    • !Replaced base32, base64, and bin libraries with new implementations in NSE
29. 7.25beta1 Prerelease Jul 15, 2016 · release notes

    Nmap 7.25beta1 introduces Npcap backend, new NSE scripts, and local SYN scans on Windows.

    └──▷ USE IT
    Run the new SSLv2-drown script to check for DROWN attack vulnerability against a specific host.
    shell copy

    nmap -sV --script=sslv2-drown <target>

    Check if a web server leaks internal IPs via HTTP/1.0 requests using the new disclosure detection script.
    shell copy

    nmap --script=http-internal-ip-disclosure <target>

    • S switches packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. library to Npcap for modern Windows performance and enables SYN scans against localhost
    • Adds clamav-exec, http-aspnet-debug, http-internal-ip-disclosure, http-mcmp, sslv2-drown, and vnc-title NSE scripts to the default collection
    • Expands OS fingerprint database with 539 IPv4 and 31 IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. submissions including Linux 4.4, Android 6.0, and Windows Server 2016
    • Updates LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. version detection by adding LDAPSearchReq and LDAPSearchReqUDP probes for improved Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. fingerprinting
    • Enhances VNC info extraction to support VeNCrypt and Tight authentication types

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Oldest supported Windows version is now Vista; Windows XP users must upgrade from Nmap 7.12
30. 7.12 Mar 29, 2016 · release notes

    Nmap 7.12 adds NSE STARTTLSSTARTTLSA protocol command that upgrades a plaintext connection to an encrypted TLS session without changing ports, used in SMTP, IMAP, and LDAP so tools can negotiate encryption opportunistically on standard service ports. support for VNC/NNTP/LMTP and OpenVPN probes.

    └──▷ USE IT
    Negotiate TLS for a VNC server to see the real banner or detect hidden features.
    shell copy

    nmap -p 5900 --script vnc-starttls <target>

    • nmap -p <port> --script vnc-starttls enables STARTTLS negotiation in the VNC NSE script
    • --script NNTP-STARTTLS enables STARTTLS support in the NNTP NSE script
    • --script LMTP-STARTTLS enables STARTTLS support in the LMTP NSE script
    • New service probes match OpenVPN running on UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.

    4 details in Everything

31. 7.11 Mar 22, 2016 · release notes

    Nmap 7.11 adds SSH DH group support and MSSQL TDS certificate scanning via NSE

    • ssh2.lua now supports diffie-hellman-group-exchange-* SSH key exchange methods, enabling the ssh-hostkey script to function on servers restricting custom Diffie-Hellman groups

    1 detail in Everything

32. 7.10 Mar 17, 2016 · release notes

    Nmap 7.10 adds Shodan API integration, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. multicast discovery, and explicit -4 address family flag.

    └──▷ USE IT
    Query Shodan's database for open ports on a target using the new NSE script.
    shell copy

    nmap --script shodan-api <target>

    Discover IPv6 multicast listeners on a network segment using MLD probes.
    shell copy

    nmap -6 --script ipv6-multicast-mld-list <target>

    Explicitly force IPv4 scanning mode, making the address family choice clear in scripts.
    shell copy

    nmap -4 <target>

    • Adds shodan-api NSE script to query the Shodan API for open port and service info from Internet-wide scan data
    • Adds ipv6-multicast-mld-list NSE script to discover IPv6 multicast listeners using MLD probes with decoded subscribed addresses
    • Adds -4 option to explicitly indicate IPv4 address family
    • Adds support for DHCP options TFTP server name and Bootfile name in the dhcp.lua script
    • Enables STARTTLSSTARTTLSA protocol command that upgrades a plaintext connection to an encrypted TLS session without changing ports, used in SMTP, IMAP, and LDAP so tools can negotiate encryption opportunistically on standard service ports. support in the sslv2 NSE script for detecting SSLv2 on services that require a post-connection upgrade

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Changed Nmap's idea of reserved and private IP addresses to include 169.254/16 (RFC3927) and remove 6/8, 7/8, and 55/8 networks.
33. 7.00 Nov 19, 2015 · release notes

    Nmap 7.00 adds Ncat --no-shutdown flag and new NSE scripts for TLS DH and IP-HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. detection.

    └──▷ TRY IT
    Keep an Ncat session open after the remote side closes its connection, mimicking traditional netcat behavior.
    copy

    $ ncat --no-shutdown example.com 80

    Scan a host for weak or export-grade Diffie-Hellman TLS parameters using the new NSE script.
    copy

    $ nmap --script ssl-dh-params example.com

    Discover if a host supports Microsoft's IP over HTTPS tunneling protocol via NSE.
    copy

    $ nmap --script ip-https-discover example.com

    • Adds --no-shutdown option to Ncat to prevent shutdown on EOF input
    • New ssl-dh-params NSE script for checking weak Diffie-Hellman parameters in TLS
    • New ip-https-discover NSE script for detecting Microsoft IP over HTTPS tunneling
    • New targets-xml NSE script to extract target addresses from XML results
    • New nje-node-brute NSE script for z/OS JES node name brute-forcing

    +1 more show less

    • New broadcast-sonicwall-discover NSE script for SonicWall information extraction

    6 details in Everything

34. 6.49beta6 Prerelease Nov 3, 2015 · release notes

    Nmap 6.49beta6 adds NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent. auth, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. rDNS, new NSE scripts and nsock API changes

    └──▷ USE IT
    Identify if a target host is a known Tor relay by querying directory authorities.
    shell copy

    nmap -p 9051 --script tor-consensus-checker <tor-node-ip>

    • Integrates new tor-consensus-checker NSE script to identify known Tor nodes via directory authorities
    • Adds hnap-info NSE script to detect and output info for Home Network Administration Protocol devices
    • Changes Nsock API functions from nsp_*/nsi_* prefixes to nsock_pool_*/nsock_iod_*
    • Enables NTLM brute force in http-brute and adds NTLM v2 session response creation in smbauth.lua

    4 details in Everything

35. 6.49beta1 Prerelease Jun 3, 2015 · release notes

    Nmap 6.49beta1 adds --data/--data-string for custom payloads, ZenMap bug tracker integration, and 25 new NSE scripts.

    └──▷ TRY IT
    Send a custom hex payload to probe a service's response behavior
    copy

    $ nmap --data 'ff01' -p 80 example.com

    Scan for devices fingerprinted by the new docker-version script
    copy

    $ nmap --script docker-version -p 2375,2376 example.com

    Detect Supermicro IPMI controllers using the new supermicro-ipmi-conf script
    copy

    $ nmap --script supermicro-ipmi-conf -p 623 example.com

    • Added --data <hex string> and --data-string <string> flags to send custom payloads in scan packet data
    • Nmap now has an official bug tracker on Github Issues (https://github.com/nmap/nmap) via ZenMap
    • 25 new NSE scripts including bacnet-info, docker-version, supermicro-ipmi-conf, and ssl-ccs-injection

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed the non-SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. version of the nmap.org download site, requiring HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. for binary downloads
36. 6.45 Apr 11, 2014 · release notes

    Nmap 6.45 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. idle scan, Ncat SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. support, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. heartbeat detection, and many new NSE scripts.

    └──▷ TRY IT
    Run unit tests in NSE libraries to validate local script changes
    copy

    $ nmap --script=unittest --script-args=unittest.run -d

    Proxy Ncat traffic through a SOCKS5 server
    copy

    $ ncat --socks5 127.0.0.1:9050 <destination_host> <port>

    • Idle scan (via -sI) now supports IPv6 targets, using a new technique to handle the absence of fragment identifiers in IPv6 packets
    • Ncat adds socks5 protocol support for proxying connections through SOCKS5 servers
    • NSE unittest script added to run unit tests found in NSE libraries, executable via --script=unittest with arguments like unittest.run
    • http-vuln-cve2013-7091 (also released as http-vuln-zimbra-lfi) detects a Local File Inclusion vulnerability in Zimbra
    • http-enum NSE script can now use the large Nikto fingerprint database at runtime if provided by the user

    +3 more show less

    • NSE telnet-brute supports multiple parallel guessing threads, connection reuse, and password-only logins
    • Nsock improved performance by handling timers and timeouts via a priority queue (heap)
    • DNS library dns.lua added TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. support

    8 details in Everything

37. 6.40 Jul 29, 2013 · release notes

    Nmap 6.40 adds Ncat --lua-exec, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. scanning, and Nsock proxy support for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections

    └──▷ USE IT
    Execute a Lua script on Ncat that processes data from a socket connection in real-time.
    shell copy

    ncat --lua-exec <scriptname> host port

    Scan a CIDR block of IPv6 addresses using standard Nmap target syntax.
    shell copy

    nmap en.wikipedia.org/120

    Run version detection and NSE scripts through a chain of proxies (HTTP then SOCKS4).
    shell copy

    nmap --proxies http://localhost:8080,socks4://someproxy.example.com -sV target

    • Adds --lua-exec flag to Ncat for running Lua scripts with stdin/stdout redirected to the socket connection
    • Enables Unicast CIDR-style IPv6 range scanning in target specifications (e.g., en.wikipedia.org/120)
    • Adds --proxies option to Nmap to establish TCP connections through CONNECT or SOCKS4 proxy chains for version detection and NSE

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Timeout script-args now use timespec (e.g., 5s, 5000ms) instead of integer milliseconds, so scripts passing raw integers will interpret them as seconds
38. 6.20beta1 Prerelease Nov 16, 2012 · release notes

    Nmap 6.20beta1 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. traceroute with UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery./SCTPSCTPA transport-layer protocol (RFC 4960) maintained by the IETF that delivers messages with optional ordering and built-in multi-homing, giving cyber tools reliable framing without TCP's head-of-line blocking./IPProto probes, Ncat Unix domain socket support (-U/-unixsock), and structured NSE output.

    └──▷ USE IT
    Connect Ncat to a local Unix domain socket to interact with a service listening on the filesystem.
    shell copy

    ncat -U /var/run/service.sock

    • Adds UDP, SCTP, and IPProto (Next Header) probe support for IPv6 traceroute, enabling non-TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./ICMP path discovery on IPv6 targets
    • Adds -U and --unixsock options to Ncat to enable Unix domain socket mode, compatible with Hobbit's original Netcat
    • Enables NSE scripts to return a structured name-value table (in addition to string output) so results are query-able from XML output

    3 details in Everything

39. 6.00 May 21, 2012 · release notes

    Nmap 6.00 introduces --deprecated-xml-osclass flag, new XML <target> element, and several new NSE scripts including stun-version and duplicates.

    └──▷ USE IT
    Restore legacy XML format for compatibility with older Nmap XML parsers that cannot handle nested OS classes.
    shell copy

    nmap -sV --script ssl-enum-ciphers <target> --deprecated-xml-osclass

    Extract STUN server version and external mapped address to understand NAT topology.
    shell copy

    nmap -sU -p 3478 --script stun-version,stun-info <target>

    • Adds --deprecated-xml-osclass flag to restore pre-6.00 XML output structure where <osclass> elements were siblings of <osmatch>
    • Introduces new stun-version NSE script for extracting version information from STUN servers
    • Introduces new stun-info NSE script for extracting external NAT:ed address via STUN
    • Adds new duplicates NSE script to identify duplicate hosts based on collected script data
    • Adds new <target> element to XML output to indicate when a target specification was skipped due to syntax or DNS errors

    +1 more show less

    • Enables comparison of scans in Zenmap that have the same name or command line parameters

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !XML output structure for OS detection has changed: <osclass> elements are now nested inside <osmatch> instead of being direct children of <os>; parsers expecting the old flat structure will break unless --deprecated-xml-osclass is used
40. Nmap 5.61TEST5 [2012-03-09]§ Mar 9, 2012 · release notes

    Nmap 5.61TEST5 adds --nsock-engine CLI flag and host-based NSE registry.

    └──▷ TRY IT
    Force Nmap to use the epoll IO engine on Linux for potentially better scalability with large scans.
    copy

    $ nmap --nsock-engine epoll <target>

    Scan for DHCPv6 servers in a LAN by sending broadcast solicitations and parsing responses.
    copy

    $ nmap --script=broadcast-dhcp6-discover <target>

    • Adds --nsock-engine option to Nmap, Nping, and Ncat to enforce a specific Nsock IO engine (e.g., epoll).
    • [NSE] Added a host-based registry that persists only until all scripts finish scanning the current host.
    • Added 43 new NSE scripts including asn-to-prefix, broadcast-dhcp6-discover, and dns-client-subnet-scan.

    3 details in Everything

41. Nmap 5.61TEST4 [2012-01-02]§ Jan 2, 2012 · release notes

    Nmap 5.61TEST4 adds httpspider library, vulns.lua framework, and script forcing via --script

    └──▷ USE IT
    Run a vulnerability script even if Nmap detects the service is wrong for that port
    shell copy

    nmap --script=http-backup-finder,+http-open-redirect <target>

    • Adds the httpspider NSE library for recursively crawling websites
    • Adds the vulns.lua NSE library to store and report discovered vulnerabilities
    • Enables forcing NSE scripts against non-standard ports by prefixing the script name with a plus (+) in --script

    3 details in Everything

42. Nmap 5.61TEST2 [2011-09-30]§ Sep 30, 2011 · release notes

    Nmap adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. OS detection using machine learning and new NSE scripts including LLTD discovery and Google SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. catalog queries.

    └──▷ TRY IT
    Perform OS detection on an IPv6 target to identify its operating system using the new machine learning engine.
    copy

    $ nmap -6 -O scanme.nmap.org

    Discover active hosts on a local network segment using the Link Layer Topology Discovery protocol.
    copy

    $ nmap -vv --script lltd-discovery <target>

    Check SSL certificates of a target host against Google's Certificate Catalog to verify trust and issuance details.
    copy

    $ nmap -p 443 --script ssl-google-cert-catalog <target>

    • Adds IPv6 OS detection system using a machine learning approach for fingerprinting target operating systems over IPv6
    • Adds lltd-discovery NSE script to discover hosts on a local network using the Microsoft LLTD protocol
    • Adds ssl-google-cert-catalog NSE script to query Google's Certificate Catalog for SSL certificates retrieved from targets
    • Adds quake3-info NSE script to extract information from Quake3-like game servers
    • Moves brute force authentication cracking scripts (*-brute) into a new brute category within the NSE framework

    5 details in Everything

43. Nmap 5.61TEST1 [2011-09-19]§ Sep 19, 2011 · release notes

    Nmap 5.61TEST1 adds CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. output, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. Neighbor Discovery, and 27 new NSE scripts including CVS brute force

    • Adds Common Platform Enumeration (CPE) output for OS and service versions in normal and XML outputs.
    • Integrates new OS fingerprints for Linux 3, FreeBSD 9, and Mac OS X 10.7 (Lion), increasing DB size by 11%.

    2 details in Everything

44. 5.59beta1 Prerelease Jun 30, 2011 · release notes

    Nmap 5.59beta1 adds extensive IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. raw scan support and over 40 new NSE scripts.

    └──▷ TRY IT
    Discover hosts on the local network and add them to the scan queue.
    copy

    $ nmap -sn --script targets-sniffer[nseconds=10,newtargets] 2001:db8::/64

    Perform an IPv6 protocol scan to identify supported protocols.
    copy

    $ nmap -sO 2001:db8::1

    • --exclude and --excludefile now support IPv6 addresses with netmasks
    • Adds targets-sniffer NSE script to discover local network addresses via packet sniffing
    • -sO protocol scan now works over IPv6 with realistic header generation
    • IPv6 traceroute is now supported
    • Adds creds-summary NSE script to list all discovered credentials at end of scan

    +2 more show less

    • Adds mysql-audit NSE script to audit MySQL security configuration against benchmarks
    • Adds ssl-known-key NSE script to check SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificates against a database of problematic keys

    7 details in Everything

45. 5.50 Jan 28, 2011 · release notes

    Nmap 5.50 adds Nping echo mode for packet tracing, a Zenmap script selection UI, and 46 new NSE scripts.

    └──▷ TRY IT
    Trace how packets are modified or dropped between the source and a target host.
    copy

    $ nping --echo-client "public" echo.nmap.org

    Discover hosts using DNS Service Discovery via multicast queries in Nmap scans.
    copy

    $ nmap -sV --script=broadcast-dns-service-discovery <target>

    Resolve all addresses (IPv4/IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.) for hostnames in Nmap's target list instead of just the first record.
    copy

    $ nmap --script=resolveall <hostname>

    • Adds --echo-client flag to Nping to detect NAT, filtering, and routing anomalies by verifying packet integrity in transit
    • Adds Scripting tab to the Zenmap profile editor for selecting scripts and arguments with descriptions
    • Adds 46 new NSE scripts including broadcast-dns-service-discovery, stuxnet-detect, and resolveall

    3 details in Everything

46. Nmap 5.35DC1 [2010-07-16]§ Jul 16, 2010 · release notes

    Nmap 5.35DC1 adds 17 new NSE scripts, supports decimal time units, and exposes NFS/Bitcoin detections.

    └──▷ USE IT
    Discover NTP hosts using the new monitor command detection.
    shell copy

    nmap --script=ntp-monlist <target>

    Identify PHP version on a web server without banner disclosure.
    shell copy

    nmap --script=http-php-version -p 80 <target>

    Scan with explicit time units to avoid ambiguity after default unit change.
    shell copy

    nmap --host-timeout 1000s <target>

    • Adds ntp-monlist NSE script to discover NTP hosts via Private Mode monitor commands
    • Adds dns-fuzz NSE script (category: fuzzer) for DNS server fuzzing attacks
    • Adds support for decimal time specifications in options like --host-timeout and --max-rtt-timeout
    • Adds http-php-version NSE script to identify PHP version via magic queries
    • Adds irc-unrealircd-backdoor NSE script to detect specific UnrealIRCd backdoors

    +10 more show less

    • Adds nfs-ls NSE script to list NFS exported files and attributes (replaces nfs-acls/nfs-dirlist)
    • Adds MS-SQL detection scripts: ms-sql-brute, ms-sql-config, ms-sql-empty-password, ms-sql-hasdbaccess, ms-sql-query, ms-sql-tables, ms-sql-xp-cmdshell
    • Adds DB2 detection scripts: db2-brute and db2-info using new library
    • Adds afp-serverinfo NSE script to retrieve AFPAFPApple Filing Protocol, Apple's legacy network file-sharing protocol for macOS and older Mac OS systems. Cyber tools target or parse it when auditing network shares or credential exposure on Apple-heavy environments. server configuration
    • Adds ftp-libopie NSE script to check for libopie off-by-one stack overflow
    • Adds dns-cache-snoop NSE script for DNS cache snooping via non-recursive queries or response time measurement
    • Adds support for time units (ms, s, m, h) in script arguments using stdnse.parse_timespec
    • Adds print output capability to Zenmap interface
    • Improves OS detection database with 262 new fingerprints including Apple iPad and Cisco IOS 15.X
    • Improves version detection signatures with 279 new entries including Bitcoin and EVE Online game servers

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Default unit for time specifications (e.g. --host-timeout, -d in Ncat, --delay in Nping) changed from milliseconds to seconds; explicit units like s or 1000s are now required for large values.
47. 5.30beta1 Prerelease Mar 29, 2010 · release notes

    Nmap 5.30beta1 adds Alpha Nping packet generator, numerous new NSE scripts (AFMbrute, SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. agent enumeration), and -Pn/-sn syntax preference.

    └──▷ TRY IT
    Brute force Apple AFPAFPApple Filing Protocol, Apple's legacy network file-sharing protocol for macOS and older Mac OS systems. Cyber tools target or parse it when auditing network shares or credential exposure on Apple-heavy environments. authentication credentials using the new script.
    copy

    $ nmap --script afp-brute <target>

    Enumerate Windows services, shares, and users on a target via SNMP using newly added scripts.
    copy

    $ nmap --script snmp-win32-services,snmp-win32-shares,snmp-win32-users <target>

    Use the new preferred syntax to skip host discovery entirely for hosts that block ICMP.
    copy

    $ nmap -Pn <target>

    • Adds Alpha version of nping, a standalone packet generator application.
    • Adds NSE script afp-brute for brute forcing Apple AFP authentication.
    • Adds NSE script afp-path-vuln detecting and exploiting Mac OS X AFP directory traversal.
    • Adds NSE script afp-showmount to display Apple AFP shares and permissions.
    • Adds NSE scripts couchdb-databases and couchdb-stats for CouchDB enumeration.

    +15 more show less

    • Adds NSE script daap-get-library for iTunes/DAAP server library extraction.
    • Adds NSE script db2-das-info to export IBM DB2 Administration Server profiles without auth.
    • Adds NSE script dns-service-discovery to identify services via DNS-SD (Bonjour/Zerconf).
    • Adds NSE script http-methods to discover HTTP methods supported by servers.
    • Adds NSE script http-vmware-path-vuln for VMware path traversal detection.
    • Adds NSE scripts ldap-brute, ldap-rootdse, and ldap-search for LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. operations.
    • Adds NSE scripts mongodb-databases and mongodb-info for MongoDB enumeration.
    • Adds NSE scripts mysql-brute, mysql-databases, mysql-empty-password, mysql-users, and mysql-variables for MySQL operations.
    • Adds NSE scripts nfs-acls, nfs-dirlist, and nfs-statfs for NFS enumeration.
    • Adds NSE script pgsql-brute for PostgreSQL credential guessing.
    • Adds NSE script qscan to probe ports for round-trip time grouping using raw IP sending.
    • Adds NSE scripts snmp-interfaces, snmp-netstat, snmp-processes, snmp-win32-services, snmp-win32-shares, snmp-win32-software, and snmp-win32-users for SNMP agent enumeration.
    • Adds NSE script ssl-enum-ciphers to list SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS ciphers and compressors.
    • Adds NSE script ipidseq to classify IP ID sequence numbers for Idle Scan suitability testing.
    • Establishes -Pn and -sn as preferred syntax for skipping host discovery and port scans respectively, deprecating preference for -PN and -sP (though old names remain supported).

    20 details in Everything

48. 5.20 Jan 20, 2010 · release notes

    Nmap 5.20 adds oracle-sid-brute NSE script and Ncat SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. exec support

    └──▷ HOW TO FIND IT
    Encrypt network traffic for a spawned executable using Ncat's new SSL exec capability.
    📍ncat -l --ssl --exec sh
    Override the User-Agent for HTTP enumeration scripts to mimic a specific browser.
    📍nmap --script http-enum --script-args http.useragent='CustomBot/1.0' <target>
    • -ssl option in Ncat now works with --exec/--sh-exec to wrap subprocess I/O in encrypted transport.
    • New oracle-sid-brute NSE script enumerates Oracle TNS-listener default instance/SID names.
    • New http.useragent argument allows overriding the default User-Agent header in HTTP-based NSE scripts.
    • -p option in Ncat now sets the listening port number when used with -l (listen mode).
    • NSE dependency system replaces the old runlevel mechanism, allowing scripts to declare execution dependencies.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The http.pipeline function no longer accepts the raw option.
49. 5.10beta2 Prerelease Dec 24, 2009 · release notes

    Nmap 5.10beta2 adds NFS, Citrix, and KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application./DB2 UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. probes plus 7 new NSE scripts.

    └──▷ TRY IT
    Enumerate published applications from a Citrix ICA Browser service
    copy

    $ nmap -p 1604 --script citrix-enum-apps <target>

    Retrieve configuration and time details from an NTP service
    copy

    $ nmap -p 123 --script ntp-info <target>

    Detect NFS exports on a target host
    copy

    $ nmap --script nfs-showmount <target>

    • Adds nfs-showmount NSE script to display NFS exports
    • Adds ntp-info NSE script to retrieve NTP service time and configuration details
    • Adds citrix-brute-xml NSE script for credential guessing against Citrix PN Web Agent Service
    • Adds citrix-enum-apps and citrix-enum-apps-xml NSE scripts to list published Citrix applications
    • Adds citrix-enum-servers and citrix-enum-servers-xml NSE scripts to list Citrix servers

    +3 more show less

    • Adds UDP payload and service detection probe for Citrix MetaFrame on port 1604/udp
    • Adds UDP SIPOptions service detection probe
    • Adds service detection probe for Kerberos (udp/88) and IBM DB2 DASDASDirect-Attached Storage: disks connected directly to a host machine rather than over a network, giving tools low-latency, high-throughput access to raw storage without SAN or NAS overhead. (523/UDP)

    8 details in Everything

50. 5.10beta1 Prerelease Nov 23, 2009 · release notes

    Nmap 5.10beta1 adds 14 new NSE scripts including smb-psexec and dhcp-discover, rewrites --traceroute for performance, and updates Zenmap with Ctrl+L host filtering.

    └──▷ TRY IT
    Test remote process execution capability on a Windows server via SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments..
    copy

    $ nmap --script smb-psexec <target_ip>

    Enumerate common web application URLs to identify installed software stacks.
    copy

    $ nmap --script http-enum <target_domain>

    Use the new Zenmap filter to quickly isolate Linux hosts from a large scan result.
    📍In Zenmap, press Ctrl+L after a scan and enter linux in the host filtering interface.
    • Adds the smb-psexec NSE script that implements remote process execution on target servers
    • Adds the dhcp-discover NSE script to send DHCP probes and attempt pool exhaustion
    • Adds the http-enum NSE script to enumerate URLs for popular web applications
    • Adds the ssl-cert NSE script to retrieve and print target server SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certificates
    • Adds the x11-access NSE script to check if X11 server access is allowed

    +13 more show less

    • Adds the db2-info NSE script to detect DB2 database instance details and platform
    • Adds the smbv2-enabled NSE script to check if SMBv2 protocol is enabled on targets
    • Adds the http-favicon NSE script to identify web applications via favicon lookup
    • Adds the http-date NSE script to display HTTP server Date header differences from local time
    • Adds the http-userdir-enum NSE script to enumerate Apache mod_userdir users
    • Adds the pjl-ready-message NSE script to view and set printer status messages via PJL
    • Adds the http-headers NSE script to display HTTP headers from a GET request on root folder
    • Adds the http-malware-host NSE script to discover hosts serving malware
    • Adds the smb-enum-groups NSE script to list remote system groups and membership
    • Renames/updates traceroute behavior: now uses ICMP echo request probe if no working probes are discovered during scanning
    • Adds Ctrl+L keyboard shortcut in Zenmap to open the host filtering interface
    • Expands protocol-specific payload support for UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. ports including 7, 53, 111, 123, 161, and others defined in payload.cc
    • Adds the com.tryssl library function for NSE scripts to handle SSL tunneling detection

    18 details in Everything

51. 4.85beta10 Prerelease Jun 12, 2009 · release notes

    Nmap 4.85beta10 adds SCTPSCTPA transport-layer protocol (RFC 4960) maintained by the IETF that delivers messages with optional ordering and built-in multi-homing, giving cyber tools reliable framing without TCP's head-of-line blocking. scanning and new NSE scripts.

    └──▷ USE IT
    Scan a target's ports using the SCTP INIT stealth method.
    shell copy

    nmap -sY target_host

    Run the new script to check if an IIS server is vulnerable to the WebDAV unicode exploit.
    shell copy

    nmap --script=http-iis-webdav-vuln target_host

    Keep Ncat open to handle multiple sequential connections in listen mode.
    shell copy

    ncat -l --keep-open 12345

    • Adds -sY flag for SCTP INIT chunk port scan
    • Adds -sZ flag for SCTP COOKIE-ECHO chunk port scan
    • Adds -PY flag for host discovery using SCTP INIT packets
    • Adds http-iis-webdav-vuln.nse script to detect MS IIS WebDAV unicode vulnerability
    • Adds socks-open-proxy.nse script to scan for open SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access. proxies

    +2 more show less

    • Adds imap-capabilities.nse script to determine IMAP server capabilities
    • Adds -k/--keep-open option in Ncat to maintain multiple connections

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Ncat listen mode now closes after one connection by default; use -k or --keep-open for previous multi-connection behavior.
52. 4.85beta9 Prerelease May 12, 2009 · release notes

    Nmap 4.85beta9 adds NSE boolean operators to --script and Ncat SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. trust validation features

    • Adds support for and, or, and not Boolean operators to the --script argument in NSE, allowing complex script filtering with wildcarded filenames and parenthetical subexpressions.
    • Ncat gains automatic temporary keypair and certificate generation in memory when acting as an SSL server without explicit --ssl-key and --ssl-cert options.

    2 details in Everything

53. 4.85beta8 Prerelease Apr 21, 2009 · release notes

    Ncat adds HTTP proxy auth via --proxy-auth; NSE core moves to Lua; new p2p-conficker script detects Conficker P2P traffic.

    └──▷ USE IT
    Scan a target network for Conficker infections using the new P2P detection script.
    shell copy

    nmap -p139,445 --script p2p-conficker,smb-check-vulns --script-args checkconficker=1,safe=1 [target networks]

    • Adds --proxy-auth flag to Ncat for authenticated HTTP proxy mode.
    • Introduces the p2p-conficker NSE script for detecting Conficker via P2P update ports.

    2 details in Everything

54. 4.85beta5 Prerelease Mar 30, 2009 · release notes

    Nmap 4.85beta5 adds Conficker detection script, Ndiff OS/service diffs, Ncat UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. exec/chat improvements.

    └──▷ TRY IT
    Scan a network segment specifically looking for Conficker infections using the new safe detection args.
    copy

    $ nmap -PN -T4 -p139,445 -n -v --script=smb-check-vulns --script-args safe=1 <targetnetworks>

    • Adds --script=smb-check-vulns with safe=1 arg to detect the Conficker worm via remote SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. analysis
    • Expands Ndiff to include service (version detection) and OS detection differences in scans
    • Enables Ncat --exec and --sh-exec options in UDP mode for concurrent client handling
    • Adds Ncat chat mode notifications for participant connect/disconnect events and broadcasts of current users

    4 details in Everything

55. 4.85beta1 Prerelease Jan 23, 2009 · release notes

    Nmap 4.85beta1 introduces Ncat, Ndiff, new NSE libraries and scripts

    • Adds Ncat, a cross-platform tool replacing Netcat with SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination., proxy chaining (SOCKS4/connect), NAT brokering, and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support; included by default in binary packages.
    • Adds ndiff utility to compare two Nmap scans and report changed hosts/ports/OSs, outputting XML or text reports.
    • Adds new NSE libraries: msrpc, netbios, and smb for interrogating Windows machines (esp. 2000).
    • Adds new NSE scripts: nbstat.nse, smb-enum-domains.nse, smb-enum-processes.nse, smb-enum-sessions.nse, smb-enum-shares.nse, smb-enum-users.nse, smb-os-discovery.nse, smb-security-mode.nse, smb-server-stats.nse, smb-system-info.nse, and banner.nse.
    • Adds -l option to Ncat without a port number to listen on the default port 31337.

    +2 more show less

    • Increases XML output version (xmloutputversion) to 1.03 with new optional elements for scan profile name, host comments, and interactive text.
    • Adds elapsed attribute in seconds to the XML finished tag.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The NSE script ripeQuery.nse is removed; use whois.nse instead.
    • !The NSE script showSSHVersion.nse is removed as it no longer provides a stealth advantage.
56. 4.76 Sep 12, 2008 · release notes

    Nmap 4.76 introduces the external NSE script category for third-party network resources and improves rpcinfo parsing.

    • Adds the external NSE script category for scripts that send data to any resource outside the target.
    • Initial external scripts: ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses..nse, dns-safe-recursion-port.nse, dns-safe-recursion-txid.nse, ripeQuery.nse, HTTP_open_proxy.nse, and whois.nse.
    • Improved rpcinfo .nse to correctly parse a wider variety of server responses.

    3 details in Everything

57. 4.75 Sep 7, 2008 · release notes

    Nmap 4.75 introduces Zenmap Scan Topology visualization and several new NSE libraries.

    • Adds Scan Topology system to Zenmap for network mapping via RadialNet integration
    • Adds Scan Aggregation feature in Zenmap to visualize results of multiple scans together
    • Adds --top-ports <n> CLI option to scan the most popular ports based on frequency data
    • Adds dns-safe-recursion-port and dns-safe-recursion-txid NSE scripts for testing DNS server security
    • Adds whois.nse script for querying Regional Internet Registries (RIRs)

    +4 more show less

    • Adds ASN.nse script for determining routing AS numbers via Team Cymru
    • Adds popcapa and brutePOP3 NSE scripts for POP3 server interaction and brute-forcing
    • Adds SNMPcommunitybrute NSE script for brute-forcing SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. community strings
    • Adds new NSE libraries: binlib, dns, base64, snmp, pop3, and unpwdb

    9 details in Everything

58. 4.68 Jun 28, 2008 · release notes

    Nmap 4.68 adds Zenmap advanced search, NSE concurrency support via mutexes and timing_level(), and SNMPv3 version detection.

    • Adds mutex support to the NSE API for graceful concurrency handling
    • Introduces timing_level() NSE function to read the -T option value (0-5)
    • Adds UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. SNMPv3 probe and vendor match lines to version detection
    • Adds advanced search functionality to Zenmap via Ctrl-F or Tools->Search Scan Results
    • Adds support for CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. /0 target specification to scan the entire Internet

    5 details in Everything

59. 4.65 Jun 1, 2008 · release notes

    Nmap 4.65 adds default NSE category, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. Zone ID support, host start/end times, macOS installer, and silent install flags.

    • Adds --default as the new default NSE script category for scripts run without explicit argument selection
    • Adds \%2f style RFC 4007 IPv6 Zone ID syntax support (e.g. fe80::...%eth0 on Linux)
    • Adds starttime and endtime attributes to the XML <host> element for individual host scan timing
    • Adds macOS universal installer (.dmg/mpkg) supporting Intel and PPC with OpenSSL and Authorization Services
    • Adds /S silent installation flag for both Nmap and WinPcap Windows installers

    +1 more show less

    • Adds nmap.registry.args table to the NSE Lua environment (empty if --script-args not used)

    6 details in Everything

60. 4.60 Mar 10, 2008 · release notes

    Nmap 4.60 adds the NSE HTTP library and expands OS/service detection databases.

    • Adds http.get_url(), http.request(), and http.get() functions to the NSE HTTP library for scripting
    • Adds target->TargetName() in Nmap proper and host.targetname in NSE scripts to access the original target name specified on the command line
    • Adds tab.lua table library for NSE scripts to deliver better formatted output

    3 details in Everything

61. 4.53 Jan 12, 2008 · release notes

    Nmap 4.53 adds UPnP-info NSE script for discovering UPnP services on network devices.

    • Adds the UPnP-info NSE script to gather information from UPnP services on UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port 1900, including routers, printers, and networked media players.
    • Improves Windows installer uninstallation logic to correctly handle non-default install paths and delete shortcuts on Vista

    2 details in Everything

62. 4.52 Jan 1, 2008 · release notes

    Nmap 4.52 extends host-timeout support and runtime interaction to NSE, adds nmap.fetchfile(), and adds a Trend Micro OfficeScan probe.

    • Extends the existing --host-timeout option to the Nmap Scripting Engine.
    • Enables run-time interaction within Nmap Scripting Engine (NSE) scripts
    • Adds nmap.fetchfile() function for scripts to locate Nmap data files like OS/version detection DBs
    • Adds a new version detection probe for Trend Micro OfficeScan product line

    4 details in Everything

63. 4.51beta Prerelease Dec 21, 2007 · release notes

    Nmap 4.51BETA adds MySQLinfo and rpcinfo NSE scripts plus strftime format codes for output filenames

    └──▷ TRY IT
    Connect to a host's RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. portmapper to discover registered services.
    copy

    $ nmap -p 111 --script rpcinfo <target>

    Retrieve detailed version and status info for a MySQL server.
    copy

    $ nmap -p 3306 --script MySQLinfo <target>

    Generate XML output files with timestamped filenames using new format codes.
    copy

    $ nmap -oX 'scan-%T-%D.xml' <target>

    • Adds rpcinfo NSE script which contacts a listening RPC portmapper and reports the listening services and port information (like rpcinfo -p).
    • Adds MySQLinfo NSE script which prints MySQL server information such as protocol/version numbers, status, thread ID, capabilities, and password salt.
    • Adds strftime()-like format codes to Nmap's output options (-oA, -oX, etc.) for dynamic filename generation: %H, %M, %S, %m, %d, %y, %Y, plus aliases %T (same as %H%M%S), %R (same as %H%M), and %D (same as %m%d%y).

    3 details in Everything

64. 4.49rc6 Prerelease Dec 8, 2007 · release notes

    Nmap 4.49rc6 allows absolute NSE script paths and matches open|filtered ports in shortports

    • --script option now accepts absolute paths to NSE scripts on all platforms
    • NSE shortports() function now matches ports in open|filtered state by default

    2 details in Everything

65. 4.49rc4 Prerelease Dec 7, 2007 · release notes

    NSE script naming flexibility and broadened OS fingerprint database for Nmap 4.49rc4

    • Adds support for specifying NSE scripts by bare name (e.g., bruteTelnet) instead of requiring the .nse extension.
    • Integrates a significantly expanded OS fingerprint database with 1,085 entries, adding support for iPhone, iPod Touch, Mac OS X Leopard, FreeBSD 7.0, Linux 2.6.23, OpenBSD 4.2, and Nokia mobile devices.
    • Adds the netbios-smb-os-discovery NSE script to guess OS versions using NetBIOS and SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. queries.

    3 details in Everything

66. 4.23rc3 Prerelease Nov 27, 2007 · release notes

    Nmap 4.23rc3 introduces promiscuous.nse for sniffers detection and NSE SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. availability check.

    • Adds promiscuous.nse to detect devices running in promiscuous mode on local networks
    • Adds nmap.have_ssl() NSE function to check for OpenSSL availability before probe execution

    2 details in Everything

67. 4.23rc2 Prerelease Nov 18, 2007 · release notes

    Nmap 4.23rc2 adds PPTP version detection script, Zenmap config rename to ~/.zenmap, and NSE reason element access

    • Adds ~/.zenmap directory and zenmap.conf file as the default location for Zenmap configuration, replacing the previous ~/.umit path.
    • Introduces PPTPversion.nse NSE script for PPTP version detection, bringing the total NSE scripts to 38.
    • Exposes a reason element in the NSE port-table API to allow scripts to read port state reasons.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Zenmap configuration files are moved from ~/.umit/umit.conf to ~/.zenmap/zenmap.conf, requiring manual migration for existing custom profiles.
68. 4.23rc1 Prerelease Nov 10, 2007 · release notes

    Nmap 4.23RC1 removes port/protocol limits on host discovery and adds Zenmap RPM packages.

    └──▷ TRY IT
    Scan specific TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery., and SCTPSCTPA transport-layer protocol (RFC 4960) maintained by the IETF that delivers messages with optional ordering and built-in multi-homing, giving cyber tools reliable framing without TCP's head-of-line blocking. ports for host discovery without limits.
    copy

    $ nmap -PS1-1000 target

    Scan specific service-based ports (HTTP, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.) for host discovery.
    copy

    $ nmap -PAhttp,https target

    • Removes the artificial limit on the number of ports or protocols that can be used for host discovery.
    • Makes Zenmap available in RPM format, eliminating separate x86/x86_64 builds for the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !NmapFE is removed as the default GUI; Zenmap replaces it.
69. Nmap 4.22SOC8 [2007-10-28]§ Oct 28, 2007 · release notes

    Nmap 4.22SOC8 adds IPProto ping type -PO with --ttl support for connect scans

    └──▷ USE IT
    Elicit responses from targets using specific IP protocols like ICMP or IGMPIGMPA network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address..
    shell copy

    nmap -PO 1,2,4 <target>

    • Adds IPProto Ping functionality accessible via the new -PO flag, allowing transmission of IP headers with different protocols to elicit responses from targets.
    • Renamed the integrated GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. from Umit to Zenmap, consolidating setup scripts into a single portable setup.py.

    2 details in Everything

70. Nmap 4.22SOC7 [2007-10-11]§ Oct 11, 2007 · release notes

    Nmap 4.22SOC7 adds OS DB expansion, UMIT sorting fixes, and NSE verbosity functions

    • nmap.verbosity() and nmap.debugging() added to the NSE API for scripts to query current verbosity/debug levels.
    • UMIT port numbers sorted numerically instead of alphabetically in results views.
    • Host discovery algorithms improved for better performance and reliability across platforms.

    3 details in Everything

71. Nmap 4.22SOC6 [2007-8-29]§ Aug 29, 2007 · release notes

    Massping engine migration, HTTPpasswd NSE script, and rnd decoy support in Nmap 4.22SOC6

    • Adds HTTPpasswd.nse to detect directory traversal and exposed password files on web servers.
    • Unifies the underlying engines for ping scanning and port scanning.

    2 details in Everything

72. Nmap 4.22SOC3 [2007-8-16]§ Aug 16, 2007 · release notes

    Nmap 4.22SOC3 adds Umit GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. support in Windows install, four new NSE scripts, raw IP packet support, and --script-args flag.

    • Adds Umit to the Nmap Windows executable installer for GUI-based scanning
    • Adds four new NSE scripts: HTTP proxy detection, DNS zone transfer attempt, SQL injectionSQL injectionAn attack that makes an application treat untrusted input as part of a database command. It can expose or modify data by changing what the query does. vulnerability detection, and /robots.txt fetching
    • NSE now supports raw IP packet sending and receiving via underlying patch
    • Adds --script-args option for passing arguments to NSE scripts

    4 details in Everything

73. 4.85beta4 Prerelease Aug 1, 2007 · release notes

    Nmap 4.85beta4 adds smb-brute and smb-pwdump scripts, --stats-every option, Ncat Windows interactivity, and SEQ.CI OS detection test

    └──▷ USE IT
    Run a brute-force attack against SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. to discover valid accounts on a target subnet
    shell copy

    nmap -p 445 --script smb-brute <target>

    Dump password hashes from a remote SMB server for offline cracking
    shell copy

    nmap -p 445 --script smb-pwdump <target>

    Monitor Nmap's progress in real-time when running as a subprocess with updates every 10 seconds
    shell copy

    nmap --stats-every 10s <target>

    • Added smb-brute.nse script for SMB account discovery with lockout detection, username validation, enumeration, and case detection
    • Added smb-pwdump.nse script to dump password hashes from remote machines using Pwdump6 executables
    • Added --stats-every option to Nmap CLI to control timing status update intervals for subprocess monitoring
    • Added stdnse.sleep() function to NSE scripting API allowing scripts to yield control while sleeping
    • Added new OS detection test SEQ.CI to classify target's IP ID sequence generation algorithm on closed ports

    +5 more show less

    • Ncat --chat mode (formerly --talk) now announces connection events and displays user name immediately upon connect
    • Ncat --allow, --deny, --allowfile, and --denyfile options now accept Nmap target specification syntax with early error reporting
    • Ncat --send-only and --recv-only options now work in listen mode as well as connect mode
    • Supports wildcard - in target IP specification to mean 0-255 (e.g., 192.168.-.-)
    • Nmap --exec and --sh-exec options now work on Windows

    10 details in Everything

    └──▷ BREAKING ON UPGRADE

    • ![Ncat] The --talk option has been renamed --chat. --talk remains as an undocumented alias.
74. Nmap 4.22SOC1 [2007-7-8]§ Jul 8, 2007 · release notes

    Nmap 4.22SOC1 adds UMIT GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands., --reason, custom DB flags, NSE libraries, and new scans.

    └──▷ USE IT
    Launch the new UMIT GUI from the source installation.
    shell copy

    umit

    • Includes the UMIT graphical frontend as an alpha release, executable named umit
    • Adds the --reason flag to explain port status assignments (e.g., filtered due no response vs ICMP unreachable)
    • Adds NSE libraries for bit operations (bit), list operations (listop), URL fetching (url), activation rules (shortport), and common functions (stdnse)
    • Adds --servicedb and --versiondb CLI options to specify custom service or version detection database files
    • Adds rnd option to -D flag for generating random decoy IPs automatically

    +1 more show less

    • Enables traceroute when using the -A (Aggressive) scan option

    6 details in Everything

75. 4.21alpha2 Prerelease Mar 15, 2007 · release notes

    Adds --traceroute support and expands OS detection fingerprint database.

    • Adds --traceroute flag to perform network path analysis using Nmap scan data for hop determination
    • Increases OS detection database size by 65% to 381 fingerprints with over 500 new submissions processed
    • Expands nmap-service-probe DB from 415 to 426 service protocols with 206 new signatures
    • Enables --scanflags options ECE, CWR, ALL and NONE for TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. packet crafting

    4 details in Everything

76. 4.21alpha1 Prerelease Dec 10, 2006 · release notes

    Nmap 4.21alpha1 integrates the Nmap Scripting Engine (NSE) into mainline.

    └──▷ USE IT
    Run a default safe script against a target host using the new NSE engine.
    shell copy

    nmap --script=default <target>

    Execute a specific script from the scripts directory to discover information.
    shell copy

    nmap --script=dns-brute <target>

77. 4.20 Dec 7, 2006 · release notes

    Nmap 4.20 adds new OS fingerprints and fixes TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. sequence prediction calculation bugs.

    • Updates the OS fingerprint database (v2 DB) with 231 entries, including Mac OS X Server 10.5 pre-release, NetBSD 4.99.4, and Windows NT.

    1 detail in Everything

78. 4.20alpha9 Prerelease Oct 13, 2006 · release notes

    Nmap 4.20alpha9 adds --open and --unprivileged CLI flags with OS DB updates.

    └──▷ USE IT
    Scan a host and ignore all closed or filtered ports for faster reporting.
    shell copy

    nmap --open <target>

    Run OS detection with limited privileges when raw sockets are unavailable.
    shell copy

    nmap --unprivileged -O <target>

    • Adds --open to display only open ports in scan results
    • Adds --unprivileged flag to treat the user as lacking raw socket privileges
    • Adds --max-os-tries option to control the maximum number of OS fingerprinting retries

    3 details in Everything

79. 4.20alpha8 Prerelease Sep 30, 2006 · release notes

    Nmap 4.20alpha8 updates OS fingerprints and adds verbosity/debugging spin buttons and --randomize-hosts controls to NmapFE.

    • Adds --randomize-hosts option to NmapFE to randomize target ordering
    • NmapFE now uses a spin button for verbosity (-v) and debugging (-d) options

    2 details in Everything

80. 4.20alpha5 Prerelease Aug 31, 2006 · release notes

    Nmap 4.20alpha5 adds --ip-options and --packet-trace TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./IP option inspection

    • Adds --ip-options flag to specify IP header options in hex or shorthand (R, T, U, S/L routes)
    • Extends --packet-trace output to report TCP and IP options.

    2 details in Everything

81. 4.20alpha4 Prerelease Jul 4, 2006 · release notes

    Nmap 4.20alpha4 adds --release-memory flag and verbose XML progress stats.

    • Adds --release-memory CLI option to release memory buffers before quitting for debugging leaks
    • Provides task progress statistics (percent, remaining time) in verbose mode XML output via <taskprogress> tags

    2 details in Everything

82. 4.20alpha1 Prerelease Jun 24, 2006 · release notes

    Nmap 4.20alpha1 integrates the initial second-generation OS detection system.

83. 4.04beta1 Prerelease May 31, 2006 · release notes

    Nmap 4.04beta1 adds --defeat-rst-ratelimit flag and improved ignored port consolidation logic

    • Adds --defeat-rst-ratelimit option to ignore RST rate limits during SYN scans
    • Improves ignored port consolidation in XML output with multiple <extraports> directives and configurable thresholds

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Visual Studio 2003 users will no longer be able to compile Nmap using the new solution files.
84. 4.03 Apr 22, 2006 · release notes

    Nmap 4.03 adds servicefp XML attribute and ships WinPcap 3.1 with a custom installer.

    • Adds servicefp attribute to the service tag in Nmap's XML output when service fingerprints are available but unrecognized by Nmap
    • Ships WinPcap 3.1 binaries and a customized self-installer that omits the phone home feature of the official WinPcap installer

    2 details in Everything

85. 4.02alpha1 Prerelease Mar 13, 2006 · release notes

    Nmap 4.02alpha1 adds --log-errors to copy supported warnings and errors into normal-format output files.

    • Adds --log-errors to also write most interactive-output warnings and errors to a specified normal-format output file; some errors are not supported.

    1 detail in Everything

86. 4.00 Jan 31, 2006 · release notes

    Nmap 4.00 adds ? command to runtime interaction system.

87. 3.98beta1 Prerelease Jan 22, 2006 · release notes

    Nmap 3.98beta1 adds runtime interaction, parallel DNS, and new CLI flags.

    • Adds runtime interaction on UNIX: v, d, and p increase verbosity, debugging, and packet tracing; uppercase variants reverse them.
    • Adds --system_dns flag to use the system resolver instead of Nmap's built-in DNS engine
    • Adds --dns_servers option to specify a custom list of DNS server IP addresses
    • Adds --badsum option to send packets with invalid TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. checksums for firewall/IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. detection

    4 details in Everything

88. 3.96beta1 Prerelease Dec 29, 2005 · release notes

    Nmap 3.96beta1 adds --max_retries capping, time-unit suffixes for timing options, and source port zero scan support.

    └──▷ USE IT
    Cap retransmissions to limit scan time at the cost of accuracy.
    shell copy

    nmap --max_retries 1 -T4 <target>

    Set a host timeout using human-readable minutes instead of raw milliseconds.
    shell copy

    nmap --host_timeout 45m <target>

    Perform a scan using source port zero, which is typically blocked or restricted.
    shell copy

    nmap -g0 <target>

    • Adds --max_retries option for capping the maximum number of retransmissions the port scan engine will do
    • Allows appending s, m, or h to low-level timing options (e.g. --host_timeout, --min_rtt_timeout) to specify values in seconds, minutes, or hours
    • Enables source port zero scans with -g0 flag, which Nmap now allows with a warning

    3 details in Everything

89. 3.94alpha1 Prerelease Nov 27, 2005 · release notes

    Nmap 3.94alpha1 adds --webxml option, comprehensive man page/help screen, and version detection softmatch parsing

    • Adds --webxml option to output XML formatted with the bundled Nmap XSL stylesheet (https://svn.nmap.org/nmap/docs/nmap.xsl) without specifying --stylesheet explicitly.
    • Version detection softmatches now parse normal match line fields (hostname, device type, extra info) when the app name is unknown but the protocol is identified.
    • The nmap-service-probes ports directive is more comprehensive to speed up version detection scans.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Identd scan support has been removed from NmapFE.
90. 3.90 Apr 24, 2005 · release notes

    Nmap 3.90 adds ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. scanning, MAC spoofing, and version detection intensity controls.

    └──▷ TRY IT
    Scan a local subnet for live hosts using ARP instead of ICMP/TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. probes to bypass IP firewalls.
    copy

    $ nmap -PR 192.168.0.0/16

    Scan hosts while spoofing the source MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. to impersonate a specific device or vendor.
    copy

    $ nmap --spoof_mac Cisco 192.168.0.1

    Run a faster version detection scan by only trying the most important probes.
    copy

    $ nmap --version_light -sV target

    • Adds ARP scanning (-PR) to determine whether hosts on a LAN are up using raw ethernet ARP requests
    • Adds --send_eth and --send_ip options to override the automatic choice of packet sending method
    • Adds --spoof_mac option to specify or randomize the source MAC address for all raw ethernet frames
    • Adds --version_intensity, --version_light, and --version_all options to control version detection probe rarity

    4 details in Everything

91. 3.81 Feb 7, 2005 · release notes

    Nmap 3.81 adds --stylesheet, --no-stylesheet, --mtu flags and a new closed|filtered port state.

    • Adds --stylesheet <filename_or_URL> to specify an XSL stylesheet for XML output rendering, defaulting to local file system
    • Adds --no-stylesheet to omit the xml-stylesheet directive from Nmap's XML output
    • Adds --mtu <size> to specify custom fragmentation offset in multiples of 8 bytes for raw IP packet construction

    3 details in Everything

92. 3.75 Oct 18, 2004 · release notes

    Nmap 3.75 adds --max_scan_delay for rate control and updates OS/OS fingerprint databases.

    └──▷ USE IT
    Limit Nmap's adaptive delay during a UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. scan to prevent slowing down while maintaining accuracy.
    shell copy

    nmap --max_scan_delay 50 -sU -T4 target.com

    • Adds --max_scan_delay parameter to control the maximum delay Nmap inserts between probes to reduce network congestion.
    • Updates OS fingerprint database with over 1,353 fingerprints including Linux 2.6.8, Windows XP SP2, and Plan9.
    • Adds a few new Nmap version detection signatures for service identification.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The implicitly read directory for custom data files like nmap-services has moved from ~/nmap to ~/.nmap; users must move their customized files to the new location.
93. 3.70 Aug 31, 2004 · release notes

    Nmap 3.70 introduces parallel ultra_scan engine with hostgroup control and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. scan refinement.

    • Adds --max_hostgroup option to specify the maximum number of hosts Nmap is allowed to scan in parallel
    • Adds --min_hostgroup option to specify the minimum number of hosts Nmap should scan in parallel
    • Overhauls UDP scan: ports that don't respond are now classified as open|filtered (with version detection on these ports)
    • Adds --exclude option to specify a comma-separated list of targets to exclude from the scan
    • Adds --excludefile option to read the exclusion list from a newline-delimited file

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !UDP scan results for unresponsive ports now report as open|filtered instead of open, which may change how downstream tools interpret scan data
    • !Ident scan (-I) removed, requiring users to remove this flag if they were using it
94. 3.55 Jul 7, 2004 · release notes

    Nmap 3.55 adds MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. printing with vendor lookup, --source_port alias, and DESTDIR install support

    • Adds target MAC-address output for directly connected Ethernet targets in normal and XML results; Windows support is not yet available.
    • Adds a vendor attribute to XML <address> elements using an IEEE-derived database to identify network-interface manufacturers.
    • Adds --source_port as a named alias for -g to specify a constant source port for probes, aiding bypass of poorly configured firewalls.
    • Enables installation under a custom root directory using the DESTDIR variable in the Makefile (e.g., make DESTDIR=/tmp/packageroot).
    • Adds the target OUI to fingerprint SInfo lines when available, for example M=00A0CC.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Time field in SInfo lines is renamed to Tm, which may break parsers expecting the original field name.
95. 3.50 Jan 18, 2004 · release notes

    Nmap 3.50 adds version info to grepable output and Oracle TNS fingerprinting with over 1,000 service fingerprints.

    • Adds service-version information between the last two / delimiters in grepable output; / characters in version and owner fields are escaped as |.
    • Integrates Oracle TNS service probe and match lines via nmap-service-probes to detect Oracle databases

    2 details in Everything

96. 3.48 Oct 6, 2003 · release notes

    Nmap 3.48 adds helper functions P() and SUBST() to version detection templates

97. 3.45 Sep 15, 2003 · release notes

    Nmap 3.45 adds HTTPOptions and RTSPRequest probes with expanded service signatures

    • Adds HTTPOptions and RTSPRequest probes for HTTP OPTIONS and RTSP request discovery.
    • Expands service signature database to 378 signatures covering 86 unique protocols.

    2 details in Everything

98. Nmap 3.40PVT17 [2003-9-12]§ Sep 12, 2003 · release notes

    Nmap 3.40PVT17 introduces --version_trace for version scanning debugging and expands service signatures.

    • Adds the --version_trace option to print extensive debugging info about version scanning
    • Expands nmap-service-probes from 295 to 356 signatures representing 85 service protocols
    • Adds caching of SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. sessions for faster reconnection during probing
    • Optimizes the requested SSL cipher list for faster service scanning.

    4 details in Everything

99. Nmap 3.40PVT14 [2003-9-4]§ Sep 4, 2003 · release notes

    Nmap 3.40PVT14 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. service scan support and an sslports directive for prioritizing SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. checks in nmap-service-probes.

    • nmap-service-probes gains an sslports directive to specify which service checks to try first for SSL-wrapped ports.
    • IPv6 is now supported for service scan.

    2 details in Everything

100. Nmap 3.40PVT13 [2003-9-1]§ Sep 1, 2003 · release notes

     Nmap 3.40PVT13 adds SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination.-scan-through for version detection and new service probes

     • Adds --with-openssl=DIR configure option to specify OpenSSL path during build
     • Integrates Novell Netware NCP and MS Terminal Server probes into the default signature set

     2 details in Everything

101. Nmap 3.40PVT12 [2003-8-24]§ Aug 24, 2003 · release notes

     Nmap 3.40PVT12 adds SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. and microsoft-dS service probes with faster default timeout

     • Adds SSL probe (session startup request) to identify services listening on SSL/TLS ports.
     • Adds a microsoft-ds probe using an SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. Negotiate Protocol request.
     • Changes the default read timeout for service probes from 7.5 seconds to 5 seconds, speeding up scan discovery.

     3 details in Everything

102. Nmap 3.40PVT11 [2003-8-23]§ Aug 23, 2003 · release notes

     Nmap 3.40PVT11 improves XML service elements with vendor/product separation for automated analysis

     • Adds structured product, version, and extrainfo attributes to <service> elements in XML output

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !The internal match line format changes from v/[big version string]/ to v/[vendor/productname]/[version]/[extrainfo]/, requiring updates to scripts that parse nmap-service-probes directly (normal output remains unchanged)
103. Nmap 3.40PVT10 [2003-8-18]§ Aug 18, 2003 · release notes

     Nmap adds soft matches for service detection to continue probing after initial recognition

     • Adds soft match capability to nmap-service-probes allowing scans to continue looking for version info after an initial service recognition without stopping.
     • Updates XML output schema to include the new method="probed" attribute for services identified via probing rather than table lookup.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Removed the SERVICEMATCH_STATIC match type from nmap-service-probes.
104. Nmap 3.40PVT8 [2003-8-12]§ Aug 12, 2003 · release notes

     Adds -A option and removes default service scanning in Nmap 3.40PVT8

     • Adds -A flag to enable both OS detection and service detection with a single command.
     • Changes default behavior so service scan (-sV) is now OFF by default, requiring explicit activation.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Service scan is no longer performed by default; users must explicitly pass -sV or -A to detect services.
105. Nmap 3.40PVT2 [2003-7-26]§ Jul 26, 2003 · release notes

     Nmap 3.40PVT2 adds template version detection via match lines in nmap-service-probes and the s regex flag.

     • nmap-service-probes match lines can now specify a template version string to determine version at scan time
     • Added s option to match lines in nmap-service-probes for dot-all regex matching

     2 details in Everything

106. Nmap 3.40PVT1 [2003-7-17]§ Jul 17, 2003 · release notes

     Nmap 3.40PVT1 introduces active service detection probes and libpcre support via --with-libpcre.

     • Adds active service detection to probe ports and identify listening services instead of relying on static port-to-service lookups
     • Introduces the --with-libpcre=DIR configure flag to specify a nonstandard location for the Perl Compatible Regular Expressions library

     2 details in Everything

107. 3.28 Jun 14, 2003 · release notes

     Nmap 3.28 adds --packet_trace support for ECNF flags and unusual ICMP types

     • --packet_trace support for Explicit Congestion Notification (RFC 2481/3168) flags

     1 detail in Everything

108. 3.25 Apr 19, 2003 · release notes

     Nmap 3.25 adds UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. ping scanning (-PU) and --packet_trace for Windows

     • Adds -PU option for UDP-based host discovery (ping scanning)
     • Adds --packet_trace support for Windows

     2 details in Everything

109. 3.20 Mar 18, 2003 · release notes

     Nmap 3.20 adds an argument to the -iR option for random IP scans.

     • The -iR option now takes the number of random IPs to scan; 0 preserves the previous never-ending behavior.

     1 detail in Everything

110. 3.15beta3 Prerelease Mar 16, 2003 · release notes

     Nmap 3.15beta3 improves -T4 and -T Insane timing, adds ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. timestamps in verbose mode, and forces SYN scans through -g port.

     • Adds ISO 8601 timestamps to the Starting nmap line and each host port scan when using the -v flag
     • Changes SYN scan behavior so that all SYN packets are sent from the port specified via -g, regardless of retransmissions

     2 details in Everything

111. 3.15beta2 Prerelease Feb 26, 2003 · release notes

     Nmap 3.15beta2 adds port/protocol 0 scanning, --datadir override, and TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. control

     • --ttl option sets outgoing IPv4 TTL for all raw scan types including ping and OS detection.
     • Allows explicitly scanning TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port 0 and IP protocol 0; protocol 0 is now included by default.
     • --datadir <path> command-line option overrides priority search order for nmap data files.

     3 details in Everything

112. 3.10alpha9 Prerelease Dec 25, 2002 · release notes

     Nmap 3.10alpha9 adds combined ping probes and multiple TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. ports for better filter evasion

     └──▷ TRY IT
     Bypass strict firewalls by probing multiple TCP ports alongside standard ICMP and TPMT probes
     copy

     $ nmap -PS22,53,80 -PT113 -PN -PE <target>

     • Adds support for combining PE, PT, and other ping types in a single invocation to increase odds of passing strict firewalls
     • Adds support for specifying multiple TCP probe ports in raw mode with the -PS flag (e.g., -PS22,53,80)

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The PB ping flag is deprecated and should no longer be used
113. 3.10alpha4 Prerelease Nov 11, 2002 · release notes

     Adds add-port XML tag to verbose output and new translations

     • Adds add-port XML tag (e.g., <addport state="open" portid="22" protocol="tcp"/>) to Nmap's XML output when a new open port is discovered in verbose mode, requiring an update to docs/nmap.dtd
     • Includes German translation of the Nmap man page available at https://nmap.org/man/de/
     • Includes French translation of the Nmap man page available at https://nmap.org/man/fr/

     3 details in Everything

114. 3.10alpha3 Prerelease Sep 15, 2002 · release notes

     Nmap 3.10alpha3 adds --min_parallelism for aggressive scanning and --packet_trace for packet inspection

     • Adds --min_parallelism CLI option to enable more aggressive and faster scans, especially against firewalled hosts
     • Adds --packet_trace to display sent and received packets in a tcpdump-like format; Windows support is not yet included.

     2 details in Everything

115. 3.10alpha1 Prerelease Aug 28, 2002 · release notes

     Nmap 3.10alpha1 adds -6 flag for IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support in TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., connect-ping, and list scans

     • Adds -6 command-line option to enable IPv6 scanning for -sT (TCP scan), -sP (connect-style ping scan), and -sL (list scan)
     • Adds --without-nmapfe configure script option to build Nmap without the graphical frontend
     • Removes arbitrary maximum parallelism limits previously enforced by the -M flag

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Nmap now requires a C++ compiler (e.g. g++) to build, as the project converted to C++
116. 4.62 Jul 31, 2002 · release notes

     Nmap 4.62 adds --min-rate for packet rate control and NSE Datafiles library

     • Adds --min-rate option to specify a minimum packet send rate in packets per second, allowing users to override congestion control algorithms.
     • Added NSE Datafiles library with parse_protocols(), parse_rpc(), and parse_services() functions for parsing nmap data files within scripts.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !XML output version increased from 1.01 to 1.02; the class attribute removed from tcpsequence element.
117. 2.54beta37 Prerelease Jul 10, 2002 · release notes

     Nmap 2.54beta37 makes SYN scan the default for privileged users

     • -sS (SYN scan) is now the default port scanning technique for privileged (root) users, replacing the previous connect() based default.
     • The ./configure script checks for a recent version of GTKGTKA cross-platform widget toolkit maintained by the GNOME project for building graphical user interfaces in C, with bindings for many languages, giving cyber tools a native desktop UI without writing platform-specific rendering code.+ before attempting to build NmapFE, avoiding compiler errors.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !For privileged users, the default scanning technique has changed from connect scan to SYN scan (-sS), altering the stealth profile and behavior of scans without explicit flags.
118. 2.54beta31 Prerelease Mar 20, 2002 · release notes

     Nmap adds ICMP Timestamp/Netmask ping types and usable --scanflags in v2.54beta31

     • Adds ICMP Timestamp (-PP) and Netmask (-PM) ping types to bypass hosts that ignore standard ICMP echo.
     • Adds undocumented --scanflags option for low-level TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. scan control.
     • Extends --data_length support to all ICMP ping types (echo request, netmask, and timestamp).

     3 details in Everything

119. 2.54beta30 Prerelease Oct 14, 2001 · release notes

     Nmap adds -oA for multi-format output and --append_output for non-destructive logging

     └──▷ TRY IT
     Capture scan data in human-readable, machine-grepable, and XML formats simultaneously for downstream processing.
     copy

     $ nmap -oA my_scan 192.168.1.0/24

     Continue logging results into an existing output file rather than deleting the previous data.
     copy

     $ nmap --append_output -oN scan_log.txt target.com

     • Adds -oA convenience option to log in ALL major formats (normal, grepable, and XML) with a single base filename
     • Documents --append_output flag to append scan results to existing output files instead of overwriting them

     2 details in Everything

120. 2.54beta29 Prerelease Aug 10, 2001 · release notes

     Nmap 2.54beta29 adds multi-portlist support via -p allowing distinct TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port specs in one scan.

     └──▷ USE IT
     Scan specific TCP and UDP ports independently in one execution using the new multi-portlist syntax.
     shell copy

     nmap -sSU -p U:53,111,137,T:21-25,80,139 target.com

     • Adds multi-portlist patch enabling separate TCP and UDP port specifications in a single scan (e.g., -p U:53,111,137,T:21-25,80).
     • Updates fingerprint database with new OS/network device signatures including Windows XP RCs, OpenBSD 2.9, MacOS X 10.0.4, Linux 2.4.7, and Alcatel IP Phones.

     2 details in Everything

121. 2.54beta26 Prerelease Jul 9, 2001 · release notes

     Adds -sI Idlescan (IPID blind scan) allowing stealthy port scanning via a third-party host.

     └──▷ USE IT
     Perform a stealth scan using an idle host to hide your real IP address from the target and IDSIDSAn intrusion detection system, monitoring traffic or host activity for suspicious behavior and producing alerts. Detection alone does not necessarily block the activity. systems.
     shell copy

     nmap -sI <zombie_host> <target>

     • Adds Idlescan (IPID blind scan) with usage syntax -sI [zombie] to leverage a zombie host for anonymous or firewall-evasion scanning.
     • Expands the built-in IDS sensor detection database by adding new port numbers contributed by Patrick Mueller.

     2 details in Everything

122. 2.54beta25 Prerelease Jun 4, 2001 · release notes

     Nmap 2.54beta25 adds OS fingerprints for Linux 2.4.x, OpenBSD 2.9, FreeBSD 4.3, Cisco IOS, and macOS X.

     • Adds All zeros IP.ID sequence classification to handle Linux 2.4 kernel behavior
     • Upgraded bundled Libpcap library to version 0.6.2 from tcpdump.org

     2 details in Everything

123. 2.54beta20 Prerelease Mar 5, 2001 · release notes

     Nmap 2.54beta20 adds TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. timestamp OS detection, IPID predictability reports, and XML field expansion

     └──▷ TRY IT
     Force Nmap to perform DNS lookups regardless of configuration
     copy

     $ nmap -R <target>

     Disable all DNS resolution for faster scanning when names are irrelevant
     copy

     $ nmap -n <target>

     • Adds TCP Timestamp sequence checking capability for OS detection and Netcraft-style uptime tests
     • Adds IPID sequence number predictability report, also utilized in OS detection
     • Expands XML output format to include actual IPID, TCP ISN, and TCP timestamp values rather than only cooked results

     3 details in Everything

124. 2.54beta19 Prerelease Jan 2, 2001 · release notes

     Nmap 2.54beta19 adds --win_trace debug flag and new --data_length option for scan packets.

     • Adds --win_trace debugging option to enhance Windows error messages
     • Adds --data_length option to send random data bytes with TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. scan and tcp ping packets

     2 details in Everything

125. 2.54beta6 Prerelease Oct 8, 2000 · release notes

     Nmap 2.54beta6 adds XML output (-oX) for machine-readable scanning results

     └──▷ TRY IT
     Generate XML output for a target network to facilitate parsing by front-end tools or other scripts
     copy

     $ nmap -oX results.xml 192.168.1.0/24

     • Adds -oX flag to produce XML output format for scan results

     1 detail in Everything

     └──▷ BREAKING ON UPGRADE

     • !The previous machine-readable format is now referred to as grepable (-oG) instead of using the -oM shorthand in documentation, though the deprecated flag remains
126. 2.54beta2 Prerelease Aug 1, 2000 · release notes

     Nmap 2.54beta2 adds -sL list scan and optimized SYN shortcut

     └──▷ TRY IT
     Resolve a CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. block to its IP list without scanning for open ports or vulnerabilities.
     copy

     $ nmap -sL 192.168.1.0/24

     Optimize a network-wide SYN scan targeting a specific port (e.g., port 25) to reduce execution time.
     copy

     $ nmap -n -sS -p25 -PS25 10.0.0.0/8

     • Adds -sL (List scan) flag to resolve hosts without scanning them

     1 detail in Everything

127. 2.3beta18 Prerelease Apr 6, 2000 · release notes

     Nmap 2.3beta18 adds #define to bypass vsnprintf on older Solaris and -vv short verbose flag.

     • Supports -vv as a shorthand for -v -v, reducing verbosity argument typing.

     1 detail in Everything

128. 2.3beta17 Prerelease Mar 26, 2000 · release notes

     Nmap 2.3beta17 adds ACK scanning (-sA) and --resume for interrupted scans

     • -sA activates ACK scanning to distinguish filtered/unfiltered ports by waiting for RST packets.
     • --resume logfile allows resuming a large network scan from where it left off, using -oN or -oM log files.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Protocol field in output eliminated; the protocol is now printed next to the port number (e.g., 22/tcp) instead of a separate column.
129. 2.3beta14 Prerelease Jan 28, 2000 · release notes

     Nmap 2.3BETA14 introduces -oS skript kiddie output mode and increases --host_timeout limit

     • Adds skript kiddie output mode, selected with -oS.
     • Increases the --host_timeout max value from ~2,000,000 to ~4,000,000,000 milliseconds

     2 details in Everything

130. 2.3beta12 Prerelease Jan 1, 2000 · release notes

     Nmap 2.3BETA12 introduces interactive mode, -iR random target scanning, and new output flags.

     • Adds --interactive flag to enable interactive session management with an inline help command (h)
     • Adds -iR option to generate and scan a list of random IP addresses
     • Adds --randomize_hosts option to shuffle host scanning order in groups of 2048 for stealth
     • Introduces -oN (normal output) and -oM (machine parseable output) flags, deprecating the old -o flag

     4 details in Everything

131. 2.3beta8 Prerelease Nov 21, 1999 · release notes

     Nmap 2.3BETA8 adds firewall mode timing optimizations and TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. Ping randomization

     • Adds firewall mode timing optimizations to decrease scan time for heavily filtered hosts during SYN or connect scans
     • Adds the min_rtt_timeout timing option.

     2 details in Everything

132. 2.11 Apr 3, 1999 · release notes

     Nmap 2.11 adds -m - for stdout machine-readable logs and IRIX OS scanning fixes

     • Added -m - flag to redirect machine readable logs to stdout for shell pipelining
     • Improved machine readable output to show service names using a nmap specific services file
     • Fixed IRIX support so OS scanning works on that platform

     3 details in Everything

133. 2.05 Feb 8, 1999 · release notes

     Nmap 2.05 adds extensive new OS fingerprints, /dev/random support, and machine-parseable tab-delimited logs.

     • Adds a batch of new OS fingerprints for NetBSD (down to 1.0) and Linux (down to 1.09), increasing fingerprint coverage by more than 25%.
     • Changes default log field separator from spaces to tabs via nmap machine-parseable output format, enabling easier parsing.

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The tab-separated field format for machine-parsable logs replaces the previous space-separated format, potentially breaking parsers relying on the old delimiter.