Nmap is a utility for network exploration and security auditing.
It supports various types of host discovery (determine which hosts
are up), many port scanning techniques for different protocols,
version detection (determine service protocols and application
versions listening behind ports), and TCP/IP stack fingerprinting
(remote host OS or device identification). Nmap also offers
flexible target and port specification, decoy/stealth scanning,
sunRPC scanning, and much more.
Also included is Ncat, the nc(1) work-a-like of the Nmap project.
Refer to the separate port security/zenmap for those parts of the
Nmap toolset which depend on python. The translated manual pages
for Nmap are contained in security/nmap-i18n-man.
See the web page and the Phrack Magazine article (Volume 7, Issue 51
September 01, 1997, article 11 of 17) https://nmap.org/p51-11.html
===> The following configuration options are available for nmap-7.992:
DOCS=on: Build and/or install documentation
LIBSSH2=on: SSH2 protocol support
NLS=on: Native Language Support
OPENSSL=on: SSL/TLS support via OpenSSL
===> Use 'make config' to modify these settings
security/nmap: Update to 7.991 and rework port
* Remove obsolete mirror in MASTER_SITES
* Import upstream PR #3439 [1]
* Convert multiple variables from ?= to =
* Remove old historical references
* Remove .if !defined(MASTERDIR) definition
* Add libpcap from ports as a permanent dependency, also removes
local patch for bundled version
* Update pcre2 dependency definition
* Sort USES
* Unbundle lua, also removes local patches for bundled version
* Don't extract unbundled libraries
* Remove MAKE_JOBS_UNSAFE
* Rename SSH2 to LIBSSH2 for consistency with tree
* Remove DOCS from OPTIONS_DEFAULT as framework always enables DOCS
* Simplify LibreSSL guard
* Follow Porters Handbook's example about stripping binaries in
post-install section
1: https://github.com/nmap/nmap/pull/3439
PR: 297693
Reviewed by: cy (maintainer)
all: drop support for FreeBSD 13, mips and risc64sf
Reviewed by: many (*)
Differential Revision: https://reviews.freebsd.org/D55624
Differential Revision: https://reviews.freebsd.org/D55642 (merged in from bofh)
many (*)
acm arrowd brooks cmt dch decke dinoex eduardo fluffy fuz gahr garga
jbeich joerg jrm kai kenrap martymac matthew mfechner michaelo mizhka
nobutaka pkubaj se tagattie thj
Anton Saietskii
GenericRikka
Gert Doering
Jan Bramkamp
Oleh Hushchenkov
Oleksandr Kryvulia
Ralf van der Enden
Yamagi
desktop kde python tcltk office
security/nmap*: Actually use devel/pcre2
devel/pcre2 is specified as a dependency but not used. Instead nmap
uses its own pcre2, which is missing symbols from its symbol table.
This is not a problem with 16-CURRENT but 15-RELEASE-p2 fails to build.
We fix this by using the pcre2 provided by ports.
PR: 294112
security/nmap{,-devel}: Improve PCAP option
- Replace global LDFLAGS with PCAP_LDFLAGS and
PCAP_USES=localbase:ldflags.
- While here remove unnecessary GNU_CONFIGURE_MANPREFIX.
Approved by: cy (maintainer)
security/nmap*: LibreSSL is not supported
Upstream calls EC_GROUP_method_of(). OpenBSD has removed
EC_GROUP_method_of() from their tree, meaning LibreSSL doesn't
have it either. security/nmap* will not build with LibreSSL.
PR: 286598
security/nmap: Use internal pcre
In preparation for devel/pcre removal, use internal pcre.
Upstream has a patch switching from pcre to pcre2. However this
requires a significant number of prerequisite patches to switch
the build system from make to cmake. A -devel port will be added
to track upstream development instead.
Move more WWW entries from pkg-descr files into Makefiles
The WWW: lines in the pkg-descr files of these ports where not at the
end of those files and have been missed in prior conversion runs.
Approved by: portmgr (implicit)
security: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Aldis Berjoza <aldis@bsdroot.lv>
* Alex Dupre <ale@FreeBSD.org>
* Alex Kapranoff <kappa@rambler-co.ru>
* Alex Samorukov <samm@freebsd.org>
* Alexander Botero-Lowry <alex@foxybanana.com>
* Alexander Kriventsov <avk@vl.ru>
* Alexander Leidinger <netchild@FreeBSD.org>
(Only the first 15 lines of the commit message are shown above )
security/nmap: PCAP option conflicts with pcap in 13-STABLE base
PCAP option also conflicts with pcap in 14-CURRENT base. Mark the option
BROKEN. This is the same fix as b1dcaf64da857d32153590fed40804f460da9bb9
for 14-CURRENT.
PR: 261242
MFH: 2022Q1
security/nmap: Make PCAP option non-default
All supported versions of FreeBSD provide pcap support. Disable the
PCAP option by default.
MFH after: 3 days
security/nmap: PCAP option conflicts with pcap in 14-CURRENT base
PCAP option conflicts with pcap in 14-CURRENT base. Mark the option
BROKEN.
MFH after: 3 days
security/nmap: Fix broken --proxy
Upstream broke --proxy in 7.90 and was fixed after 7.91 and is yet to be
released.
PR: 256968
Submitted by: Ting-Wei Lan <lantw44@gmail.com>
Reported by: Ting-Wei Lan <lantw44@gmail.com>
Obtained from: Upstream 169d7e5a922ef8e63b51ee2bdf4fd4ad60ed2689
MFH: 2020Q3
Force the bundled libpcap headers to be used
This fixes the build when the separate libpcap port is installed
PR: 243108
Approved by: maintainer timeout
security/nmap: Fix build on 11i386, 11arm, 11arm64
Fix patches to configure scripts to only add -libverbs if found in base
PR: 242987
Reported by: Dries Michiels <driesm.michiels@gmail.com>
Reported by: garga
MFH: 2020Q1
security/nmap: Update to 7.80
- Remove local patches incorporated upstream.
- Add patches to add missing libibverbs dependency when linking
libpcap statically (required to allow build on FreeBSD >= 12.0).
(See similar fix applied to port net-mgmt/dhcdrop in r499639).
Changes this release:
https://seclists.org/nmap-announce/2019/0
Approved by: ohauer (maintainer timeout)
Differential Revision: https://reviews.freebsd.org/D22730
Make nmap work with INET4-only kernels:
- add new FreeBSD-specific patch;
- remove invalid comment from Makefile (it did build but produced run-time
error);
- bump PORTREVISION.
PR: 217558
Approved by: ohauer (maintainer timeout, 10 weeks), vsevolod (mentor)
- update to 7.40
- 12 new NSE scripts
- Hundreds of updated OS and version detection detection signatures
- Faster brute force authentication cracking and other NSE library improvements
Full Changelog:
https://nmap.org/changelog.html
- update to 7.31
Nmap 7.31 [2016-10-20]
o Fixed the way Nmap handles scanning names that resolve to the same IP. Due to
changes in 7.30, the IP was only being scanned once, with bogus results
displayed for the other names. The previous behavior is now restored.
[Tudor Emil Coman]
o [GH#350] Fix an assertion failure due to floating point error in equality
comparison, which triggered mainly on OpenBSD:
assertion "diff <= interval" failed: file "timing.cc", line 440
This was reported earlier as [GH#472] but the assertion fixed there was a
different one. [David Carlier]
(Only the first 15 lines of the commit message are shown above )
security/zenmap: Update to 7.25 BETA2 and use security/nmap as MASTERDIR
security/nmap:
- Ensure MAINTAINER and COMMENT do not clobber those of slave port
- Add .if !defined(MASTERDIR) to prevent inclusion in slave port
- Do not include bsd.port.options.mk, as none of the features are used
security/zenmap:
- Convert to slave of security/nmap to ensure they are updated in lockstep
- Inherently update to 7.25 BETA2 (current version of security/nmap)
- Take maintainership
- Remove redundant port header variables included from MASTERDIR
- PKGNAME of zenmap achieved using PKGNAMEPREFIX=ze and PORTNAME=nmap
- Inherit LICENSE_FILE, as zenmap/COPYING states it is the same as nmap
- Set directory variables so they are not inhereted from MASTERDIR
- Convert post-extract to post-patch, as it is modifying WRKSRC files
- Fix REINPLACE command, as it was leaving the line with nothing but a
single ',' and causing the build to fail
- Do not download external zenmap icon, as one is included in distfile
Approved by: ohauer (security/nmap maintainer), mat (mentor)
Differential Revision: https://reviews.freebsd.org/D7880
- update nmap to 7.25BETA2
Full Changelog: https://nmap.org/changelog.html
Changelog (very shortened):
Nmap 7.25BETA2 [2016-09-01]
- [NSE] Upgraded NSE to Lua 5.3
- [NSE] Added 2 NSE scripts, bringing the total up to 534!
- Add 587 new fingerprints
- [NSE] Fix a crash when parsing TLS certificates
- [NSE][GH#531] Fix two issues in sslcert.lua
- [NSE][GH#234] Added a --script-timeout option for limiting run time
- [Ncat][GH#444] Added a -z option to Ncat
- [NSE] ssl-enum-ciphers now warn about 64-bit block ciphers in CBC mode
- [NSE][GH#117] Improve tftp-enum
(Only the first 15 lines of the commit message are shown above )
- update to 7.25BETA1
- s/USE=OPENSSL/USES=ssl/
Some highlighs from the Changelog:
Nmap 7.25BETA1 [2016-07-13]
o [NSE] Added 6 NSE scripts, from 5 authors, bringing the total up to 533!
They are all listed at https://nmap.org/nsedoc/, and the summaries are below
(authors are listed in brackets):
+ clamav-exec detects ClamAV servers vulnerable to unauthorized clamav
command execution. [Paulino Calderon]
+ http-aspnet-debug detects ASP.NET applications with debugging enabled.
[Josh Amishav-Zlatin]
(Only the first 15 lines of the commit message are shown above )
Nmap 7.12 [2016-03-29]
o [NSE] VNC updates including vnc-brute support for TLS security type and
negotiating a lower RFB version if the server sends an unknown higher
version. [Daniel Miller]
o [NSE] Added STARTTLS support for VNC, NNTP, and LMTP [Daniel Miller]
o Added new service probes and match lines for OpenVPN on UDP and TCP.
- update to 7.11
Changes:
o [NSE][GH#341] Added support for diffie-hellman-group-exchange-* SSH key
exchange methods to ssh2.lua, allowing ssh-hostkey to run on servers that
only support custom Diffie-Hellman groups. [Sergey Khegay]
o [NSE] Added support in sslcert.lua for Microsoft SQL Server's TDS protocol,
so you can now grab certs with ssl-cert or check ciphers with
ssl-enum-ciphers. [Daniel Miller]
- upate to version 7.10
- remove support for custom IPv4 only kernel [1]
Short summary:
- 12 new NSE scripts
- hundreds of new OS/version fingerprints
- dozens if smaller improvements and bug fixes
Full Changelog:
https://nmap.org/changelog.html
[1] nmap does no longer build agains custom kernel without IPv6!
- update to 7.01
FreeBSD related changes:
========================
Nmap 7.01 [2015-12-09]
o [NSE] [GH#254] Update the TLSSessionRequest probe in ssl-enum-ciphers to
match the one in nmap-service-probes, which was fixed previously to correct a
length calculation error. [Daniel Miller]
o [NSE] [GH#251] Correct false positives and unexpected behavior in http-*
scripts which used http.identify_404 to determine when a file was not found
on the target. The function was following redirects, which could be an
indication of a soft-404 response. [Tom Sellers]
o [NSE] [GH#241] Fix a false-positive in hnap-info when the target responds
with 200 OK to any request. [Tom Sellers]
o [NSE] [GH#244] Fix an error response in xmlrpc-methods when run against a
non-HTTP service. The expected behavior is no output. [Niklaus Schiess]
o [NSE] Fix SSN validation function in http-grep, reported by Bruce Barnett.
- update to version 7.00
Changelog:
Nmap 7.00 [2015-11-19]
o This is the most important release since Nmap 6.00 back in May 2012!
For a list of the most significant improvements and new features,
see the announcement at: https://nmap.org/7
o [NSE] Added 6 NSE scripts from 6 authors, bringing the total up to 515!
They are all listed at https://nmap.org/nsedoc/, and the summaries are below
(authors are listed in brackets):
+ targets-xml extracts target addresses from previous Nmap XML results files.
[Daniel Miller]
(Only the first 15 lines of the commit message are shown above )
- update to 6.49BETA6
- use new OPTIONS targes
Parts from Changelog [1]
==========================
Nmap 6.49BETA6
o Integrated all of your IPv6 OS fingerprint submissions from April to October
(only 9 of them!). We are steadily improving the IPv6 database, but we need
your submissions. The classifier added 3 new groups, bringing the new total
to 93. Highlights: http://seclists.org/nmap-dev/2015/q4/61 [Daniel Miller]
o Integrated all of your IPv4 OS fingerprint submissions from February to
October (1065 of them). Added 219 fingerprints, bringing the new total to
4985. Additions include Linux 4.1, Windows 10, OS X 10.11, iOS 9, FreeBSD
11.0, Android 5.1, and more. Highlights:
(Only the first 15 lines of the commit message are shown above )
- update to 6.4.7
- add CPE entry
- sort pkg-plist
Changelog (entries related to the command line tools)
Nmap 6.47 [2014-08-20]
o Integrated all of your IPv4 OS fingerprint submissions since June 2013
(2700+ of them). Added 366 fingerprints, bringing the new total to 4485.
Additions include Linux 3.10 - 3.14, iOS 7, OpenBSD 5.4 - 5.5, FreeBSD 9.2,
OS X 10.9, Android 4.3, and more. Many existing fingerprints were improved.
Highlights: http://seclists.org/nmap-dev/2014/q3/325 [Daniel Miller]
o Removed the External Entity Declaration from the DOCTYPE in Nmap's XML. This
(Only the first 15 lines of the commit message are shown above )
Nmap 6.46 [2014-04-18]
o [NSE] Made numerous improvements to ssl-heartbleed to provide
more reliable detection of the vulnerability.
o [Zenmap] Fixed a bug which caused this crash message:
IOError: [Errno socket error] [Errno 10060] A connection attempt failed
because the connected party did not properly respond after a period of
time, or established connection failed because connected host has
failed to
respond
The bug was caused by us adding a DOCTYPE definition to Nmap's XML
output which caused Python's XML parser to try and fetch the DTD
every time it parses an XML file. We now override that DTD-fetching
behavior. [Daniel Miller]
o [NSE] Fix some bugs which could cause snmp-ios-config and
snmp-sysdescr scripts to crash
(http://seclists.org/nmap-dev/2014/q2/120) [Patrik Karlsson]
o [NSE] Improved performance of citrixlua library when handling large XML
responses containing application lists. [Tom Sellers]
- update nmap nselib and scripts to upstream revision r32810
The update includes a working script to detect whether a server
is vulnerable to the OpenSSL Heartbleed bug (CVE-2014-0160)
http://nmap.org/nsedoc/scripts/ssl-heartbleed.html
MFH: 2014Q2
- use internal liblua instead the one from ports [1]
- update internal liblua from 5.2.2 -> 5.2.3
- bump PORTREVISION
[1] nmap use static lua for nmap, nping and ncat, after
build lua is no longer needed.
- update nmap to version 6.25
- fix build with clang and stdlib=libc++ [1]
Nmap 6.25 [2012-11-29]
o [NSE] Added CPE to smb-os-discovery output.
o [Ncat] Fixed the printing of warning messages for large arguments to
the -i and -w options. [Michal Hlavinka]
o [Ncat] Shut down the write part of connected sockets in listen mode
when stdin hits EOF, just as was already done in connect mode.
[Michal Hlavinka]
o [NSE] Added new fingerprints for http-enum: Sitecore, Moodle, typo3,
SquirrelMail, RoundCube. [Jesper Kuckelhahn]
o Added some new checks for failed library calls. [Bill Parker]
PR: 172358174817
Submitted by: arrowdodger <6yearold@gmail.com> [1]
Anders N. <wicked@baot.se> (general update request)
- update nmap to version 6.0.1
Announcement: http://seclists.org/nmap-hackers/2012/3
Changelog: http://nmap.org/changelog.html
Some relevant changes in 6.01:
o Fixed a bug that caused Nmap to fail to find any network interface when
at least one of them is in the monitor mode. The fix was to define the
ARP_HRD_IEEE80211_RADIOTAP 802.11 radiotap header identifier in the
libdnet-stripped code. Network interfaces that are in this mode are used
by radiotap for 802.11 frame injection and reception. The bug was
reported by Tom Eichstaedt and Henri Doreau.
http://seclists.org/nmap-dev/2012/q2/449http://seclists.org/nmap-dev/2012/q2/478
[Djalal Harouni, Henri Doreau]
o Fixed the greppable output of hosts that time-out (when --host-timeout was
used and the host timed-out after something was received from that host).
This issue was reported by Matthew Morgan. [jah]
- update to version 6.00
Changelog:
==========
Nmap 6.00
o Most important release since Nmap 5.00 in July 2009! For a list of
the most significant improvements and new features, see the
announcement at: http://nmap.org/6
o In XML output, <osclass> elements are now child elements of the
<osmatch> they belong to. Old output was thus:
<os><osclass/><osclass/>...<osmatch/><osmatch/>...</os>
New output is:
<os><osmatch><osclass/><osclass/>...</osmatch>...</os>
(Only the first 15 lines of the commit message are shown above )
- update to version 5.61TEST5
small snippet from changelog:
http://nmap.org/changelog.html
o Integrated all of your IPv4 OS fingerprint submissions since June 2011 (about
1,900 of them)
Added about 256 new fingerprints (total 3,572)
o Integrated all of your service/version detection fingerprints submitted since
November 2010
(signature count increased to 7,423)
o Integrated your latest IPv6 OS submissions and corrections
o [NSE] Added 43(!) NSE scripts, bringing the total up to 340
o [NSE] Added 14 new protocol libraries
o [CPE] (Common Platform Enumeration) OS classification is now supported for
IPv6 OS detection
o Added a new --script-args-file option
o [NSE] Added support for decoding EIGRP broadcasts from Cisco routers to
broadcast-listener
o [NSE] Added redirect support to the http library
o Update to the latest MAC address prefix assignments from IEEE as of March 8,
2012
Test builds sponsored by redports.org
Feature safe: yes
- update to 5.61TEST4
For detailed Changes see http://nmap.org/changelog.html
(List is simply to long ...)
Some highlights
* [NSE] Added a new httpspider library which is used for recursively
crawling web sites for information. New scripts using this
functionality include http-backup-finder, http-email-harvest,
http-grep, http-open-redirect, and http-unsafe-output-escaping. See
http://nmap.org/nsedoc/ or the list later in this file for details
on these.
* [NSE] Added a vulnerability management library (vulns.lua) to store and to
report discovered vulnerabilities.
* [NSE] Added a new script force feature. You can force scripts to
run against target ports (even if the "wrong" service is detected)
by placing a plus in front of the script name passed to --script.
See http://nmap.org/book/nse-usage.html#nse-script-selection.
* [NSE] Added 51(!) NSE scripts, bringing the total up to 297.
Build tests sponsored by redports.org
- update to version 5.61TEST2
- add workaround for system build with WITHOUT_INET6 [1]
Thanks to Kim Scarborough for sharing the libpcap workaround
PR: ports/159376 [1]
Submitted by: Alexander Panyushkin [1]
- Add LDFLAGS to CONFIGURE_ENV and MAKE_ENV (as it was done with LDFLAGS)
- Fix all ports that add {CPP,LD}FLAGS to *_ENV to modify flags instead
PR: 157936
Submitted by: myself
Exp-runs by: pav
Approved by: pav
- update to 5.61TEST1
Here is the (partial) CHANGELOG since 5.59BETA1:
Nmap 5.61TEST1 [2011-09-19]
o The changelog entries below for this test release are not yet
finished or comprehensive. We'll update them soon.
o [Ncat] Updated ca-bundle.crt (primarily to remove DigiNotar).
o Fixed compilation on OS X 10.7 Lion. Thanks to Patrik Karlsson and
Babak Farroki for researching fixes.
o [NSE] Fixed SSL compressor names in ssl-enum-ciphers.nse, and
(Only the first 15 lines of the commit message are shown above )
- update to version 5.59BETA1
This version includes:
o 40 new NSE scripts (plus improvements to many others)
o even more IPv6 goodness than our informal World IPv6 Day release
o 7 new NSE protocol libraries
o hundreds of bug fixes
o and much more see http://seclists.org/nmap-hackers/2011/3
- update to version 5.51
Nmap 5.51 [2011-02-11]
o [Ndiff] Added support for prerule and postrule scripts. [David]
o [NSE] Fixed a bug which caused some NSE scripts to fail due to the
absence of the NSE SCRIPT_NAME environment variable when loaded.
Michael Pattrick reported the problem. [Djalal]
o [Zenmap] Selecting one of the scan targets in the left pane is
supposed to jump to that host in the Nmap Output in the right pane
(but it wasn't). Brian Krebs reported this bug. [David]
o Fixed an obscure bug in Windows interface matching. If the MAC
(Only the first 15 lines of the commit message are shown above )
- update to version 5.50
- always enable bpf in libdnet-stripped to support build in Jail [1]
Announcement and Changelog are very long and covered by last updates.
Announcement: http://seclists.org/nmap-hackers/2011/0
Changelog: http://nmap.org/changelog.html
PR: ports/154353 [1]
Submitted by: Mars G Miro <spry _at_ anarchy.in.the.ph> [1]
Feature safe: yes
- update nmap to version 5.36TEST3
- remove dead mirror servers
Changelog: http://nmap.org/changelog.html
Mayjor changes are NSE script related, some highlihts:
o [NSE] Added stuxnet-detect.nse
o [NSE] Added the ftp-proftpd-backdoor.nse
and many more interesting NSE scripts.
- update nmap to version 5.35DC1
- remove MD2 code from nse_openssl.cc (already removed in nmap svn)
- remove naming conflict if openssl-1.x is build with SCTP support
Approved by: glarkin (mentor)
- Add patch to work around versions of FreeBSD with broken
getaddrinfo(3) (7.1 and earlier, and -CURRENT before the end of March
2009).
PR: ports/133779
Submitted by: Daniel Roethlisberger <daniel@roe.ch> (maintainer)
Number of commits found: 193 (showing only 100 on this page)
