Fw: Nmap 3.81 Released; Pr0n; License Non-changes

Tue Feb 8 14:39:18 PST 2005

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I don't understand what's up with the Tenable folks.  I know that many
vendors were integrating their tools into their own (in fact, basically
using Nessus completely *as* their tool).  I can understand how Tenable
needs to be able to make money.  If they licensed using the GPL, those
offchutes would be forced to use the GPL as well.  The viral effects ;)

Granted, that's not as easy as restricting quite fully, but that just suxx.

Myles Green wrote:
| I don't think this is an OT subject, or at least not too far OT. It has
| to do with Nessus' new license - new *expensive* license - and how it
| doesn't mean that nmap will ever follow suite. And something about
| pr0n...
|
| Begin forwarded message:
|
| Date: Mon, 7 Feb 2005 14:34:11 -0800
| From: Fyodor <fyodor at insecure.org>
| To: nmap-hackers at insecure.org
| Subject: Nmap 3.81 Released; Pr0n; License Non-changes
|
|
| Hello everyone,
|
| I'm sorry to report that the most popular pages on Insecure.Org are
| going away.  You might expect the most popular to be the Nmap pages,
| top 75 tools list, or the home page itself.  Nope: The most popular
| (by bandwidth usage) have been the HaXXXor pr0n Nmap training videos
| and files at http://www.insecure.org/nmap/nmap_haxxxor.html ever since
| I posted them a year ago.
|
| Some people found them offensive, but I'm not doing this to please the
| censors.  I simply cannot afford the bandwidth.  On some days E-lita
| generates several terabytes of traffic.  More recently, porn sites
| have discovered the images and began linking them inline to their own
| pages.  Grrrrr!  I may be able to keep the page around for now, but I
| have removed the movies and most of the high-res pics.
|
| In other news, some users have expressed concern about the new Nessus
| license.  If you want to use Nessus and all its plugins for
| consulting, you are now required to fax Tenable a signed license
| agreement requesting permission.  You must also promise not to
| redistribute or reverse-engineer the plugins
| (http://www.nessus.org/plugins/index.php?consultant=1&email=c&product=).
| They also instituted a $1200/year charge for the latest plugins ( a
| delayed feed is available free with registration for certain limited
| uses).  They also now claim that many of the existing Nessus plugins
| were never open source.  At the same time, they rewrote the Nessus web
| page to emphasis that Nessus is "<i>the</i> open-source vulnerability
| scanner".
|
| Note that the Nessus and Nmap projects are completely separate
| organizations.  I am a huge fan of Renaud and the Nessus team's
| excellent work, and won't take any position on their license change.
| They argue that this change is neccessary to maintain quality and
| satisfy sharholders.  They could be right, but I want to reassure
| people that the Nmap project has no plans to follow suit.  All of
| Nmap, including the OS detection and service detection databases,
| remains available under the GNU GPL.  Some of the 3rd party libraries
| it uses (libpcap, libpcre, OpenSSL, etc.) are under different licenses
| such as BSD and LGPL, but they are all open source.  You can continue
| to use it for whatever you want, from consulting, to network
| administration, or even evil haxxoring, without asking permission,
| signing a license agreement, or divulging personal information on a
| registration form.  If you ever decide that I'm an insufferable tyrant
| rather than benevolent steward of the Nmap project, you have the right
| to fork off and redistribute your own version.
|
| And now for the good news!  I'm pleased to release Nmap
| 3.81, which contains dozens of feature enhancements and bug fixes over
| 3.75.  These include an XSL stylesheet by Benjamin Erb that allows you
| to render Nmap's XML output as HTML in a browser.  Fragmentation
| scanning was fixed and enhanced (thanks to Martin Ma?__k) so that you
| can now specify fragment size.  I finally got around to adding
| packet/byte counters so that you know how much traffic Nmap generated.
| Improvements were made to several scan types, a new
| "closed|filtered"state was added, the service detection database grew,
| and some important bugs were fixed.  Here is a more complete and
| detailed list of changes:
|
| o Nmap now ships with and installs (in the same directory as other
|   data files such as nmap-os-fingerprints) an XSL stylesheet for
|   rendering the XML output as HTML.  This stylesheet was written by
|   Benjamin Erb ( see http://www.benjamin-erb.de/nmap/ for examples).
|   It supports tables, version detection, color-coded port states, and
|   more.  The XML output has been augmented to include an
|   xml-stylesheet directive pointing to nmap.xsl on the local
|   filesystem.  You can point to a different XSL file by providing the
|   filename or URL to the new --stylesheet argument.  Omit the
|   xml-stylesheet directive entirely by specifying --no-stylesheet.
|   The XML to HTML conversion can be done with an XSLT processor such
|   as Saxon, Sablot, or Xalan, but modern browsers can do this on the
|   fly -- simply load the XML output file in IE or Firefox.  Some
|   features don't currently work with Firefox's on-the-fly rendering.
|   Perhaps some Mozilla wizard can fix that in either the XSL or the
|   browser itself.  I hate having things work better in IE :).  It is
|   often more convenient to have the stylesheet loaded from a URL
|   rather than the local filesystem, allowing the XML to be rendered on
|   any machine regardless of whether/where the XSL is installed.  For
|   privacy reasons (avoid loading of an external URL when you view
|   results), Nmap uses the local filesystem by default.  If you would
|   like the latest version of the stylesheet load from the web when
|   rendering, specify
|   --stylesheet http://www.insecure.org/nmap/data/nmap.xsl .
|
| o Fixed fragmentation option (-f).  One -f now sets sends fragments
|   with just 8 bytes after the IP header, while -ff sends 16 bytes to
|   reduce the number of fragments needed.  You can specify your own
|   fragmentation offset (must be a multiple of 8) with the new --mtu
|   flag.  Don't also specify -f if you use --mtu.  Remember that some
|   systems (such as Linux with connection tracking) will defragment in
|   the kernel anyway -- so test first while sniffing with ethereal.
|   These changes are from a patch by Martin Ma?__ok
|   (martin.macok(a)underground.cz).
|
| o Nmap now prints the number (and total bytes) of raw IP packets sent
|   and received when it completes, if verbose mode (-v) is enabled.  The
|   report looks like:
|   Nmap finished: 256 IP addresses (3 hosts up) scanned in 30.632 seconds
|                  Raw packets sent: 7727 (303KB) | Rcvd: 6944 (304KB)
|
| o Fixed (I hope) an error which would cause the Windows version of
|   Nmap to abort under some circumstances with the error message
|   "Unexpected error in NSE_TYPE_READ callback.  Error code: 10053
|   (Unknown error)".  Problem reported by "Tony Golding"
|   (biz(a)tonygolding.com).
|
| o Added new "closed|filtered" state.  This is used for Idlescan, since
|   that scan method can't distinguish between those two states.  Nmap
|   previously just used "closed", but this is more accurate.
|
| o Null, FIN, Maimon, and Xmas scans now mark ports as "open|filtered"
|   instead of "open" when they fail to receive any response from the
|   target port.  After all, it could just as easily be filtered as open.
|   This is the same change that was made to UDP scan in 3.70.  Also as
|   with UDP scan, adding version detection (-sV) will change the state
|   from open|filtered to open if it confirms that they really are open.
|
| o Fixed a bug in ACK scan that could cause Nmap to crash with the
|   message "Unexpected port state: 6" in some cases.  Thanks to Glyn
|   Geoghegan (glyng(a)corsaire.com) for reporting the problem.
|
| o Change IP protocol scan (-sO) so that a response from the target
|   host in any protocol at all will prove that protocol is open.  As
|   before, no response means "open|filtered", an ICMP protocol
|   unreachable means "closed", and most other ICMP error messages mean
|   "filtered".
|
| o Patched a Winpcap issue that prevented read timeouts from being
|   honored on Solaris (thus slowing down Nmap substantially).  The
|   problem report and patch were sent in by Ben Harris
|   (bjh21(a)cam.ac.uk).
|
| o Changed IP protocol scan (-sO) so that it sends valid ICMP, TCP, and
|   UDP headers when scanning protocols 1, 6, and 17, respectively.  An
|   empty IP header is still sent for all other protocols.  This should
|   prevent the error messages such as "sendto in send_ip_packet:
|   sendto(3, packet, 20, 0, 192.31.33.7, 16) => Operation not
|   permitted" that Linux (and perhaps other systems) would give when
|   they try to interpret the raw packet.  This also makes it more
|   likely that these protocols will elicit a response, proving that the
|   protocol is "open".
|
| o The windows build now uses header and static library files from
|   Winpcap 3.1Beta4.  It also now prints out the DLL version you are
|   using when run with -d.  I would recommend upgrading to 3.1Beta4 if
|   you have an older Winpcap installed.
|
| o Nmap now prints a warning message on Windows if Winpcap is not found
|   (it then reverts to raw sockets mode if available, as usual).
|
| o Added an NTP probe and matches to the version detection database
|   (nmap-service-probes) thanks to a submission from Martin
|   Ma?__ok (martin.macok at underground.cz).
|
| o Applied several Nmap service detection database updates sent in by
|   Martin Ma?__ok (martin.macok(a)underground.cz).
|
| o The XML nmaprun element now has a startstr attribute which gives the
|   human readable calendar time format that a scan started.  Similarly
|   the finished element now has a timestr attribute describing when the
|   scan finished.  These are in addition to the existing nmaprun/start
|   and finished/time attributes that provided the start and finish time
|   in UNIX time_t notation.  This should help in development of
|   XSLT stylesheets for Nmap XML output.
|
| o Fixed a memory leak that would generally consume several hundred
|   bytes per down host scanned.  While the effect for most scans is
|   negligible, it was overwhelming when Scott Carlson
|   (Scott.Carlson(a)schwab.com) tried to scan 24 million IPs
|   (10.0.0.0/8).  Thanks to him for reporting the problem.  Also thanks
|   to Valgrind ( http://valgrind.kde.org ) for making it easy to debug.
|
| o Fixed a crash on Windows systems that don't include the iphlpapi
|   DLL.  This affects Win95 and perhaps other variants.  Thanks to Ganga
|   Bhavani (GBhavani(a)everdreamcorp.com) for reporting the problem and
|   sending the patch.
|
| o Ensured that the device type, os vendor, and os family OS
|   fingerprinting classification values are scrubbed for XML compliance
|   in the XML output.  Thanks to Matthieu Verbert
|   (mve(a)zurich.ibm.com) for reporting the problem and sending a patch.
|
| o Rewrote the host IP (target specification) parser for easier
|   maintenance and to fix a bug found by Netris (netris(a)ok.kz)
|
| o Changed to Nmap XML DTD to use the same xmloutputversion (1.01) as
|   newer versions of Nmap.  Thanks to Laurent Estieux
|   (laurent.estieux(a)free.fr) for reporting the problem.
|
| o Fixed compilation on some HP-UX 11 boxes thanks to a patch by Petter
|   Reinholdtsen (pere(a)hungry.com).
|
| o Fixed a portability problem on some OpenBSD and FreeBSD machines
|   thanks to a patch by Okan Demirmen (okan(a)demirmen.com).
|
| o Applied Martin Ma?__ok's (martin.macok(a)underground.cz) "cosmetics
|   patch", which fixes a few typos and minor problems.
|
| As always, you can download Nmap from from
| http://www.insecure.org/nmap/nmap_download.html .  The paranoid
| (smart) list members will check the cryptographic hashes and GPG
| signatures available from
| http://www.insecure.org/nmap/dist/sigs/?C=M&O=D .
|
| I hope you like it!  Let me know if you encounter any problems.
|
| Cheers,
| Fyodor
|
|
| --------------------------------------------------
| For help using this (nmap-hackers) mailing list, send a blank email to
| nmap-hackers-help at insecure.org . List archive: http://seclists.org
|
|
|
_______________________________________________
Linux-users mailing list
Linux-users at linux-sxs.org
http://mail.linux-sxs.org/cgi-bin/mailman/listinfo/linux-users

Need to chat further on this subject? Check out #linux-users on
irc.linux-sxs.org !

- --
Matthew Carpenter
matt at eisgr.com                          http://www.eisgr.com/

Enterprise Information Systems
* Network Server Appliances
* Security Consulting, Incident Handling & Forensics
* Network Consulting, Integration & Support
* Web Integration and E-Business
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCCLM+so9lqh4MragRAmihAJ9DC7zQrQljJqBRVZGKO9t3pxf3YgCfVzDG
nKJXMW2g2Ci56g42stNLbx4=
=NiSL
-----END PGP SIGNATURE-----