Nmap 7.96 Released With New Scanning Features & Upgraded Libraries

The Nmap Project has officially released version 7.96 of its powerful network scanning tool. 

The release introduces a suite of technical enhancements, including dramatically faster DNS resolution, new NSE (Nmap Scripting Engine), and numerous bug fixes that further enhance Nmap’s reputation as an essential tool for network discovery and security auditing. 

Nmap 7.96 has several upgraded libraries, including OpenSSL 3.0.16, Lua 5.4.7, libssh2 1.11.1, libpcap 1.10.5, and libpcre2 10.45. 

These updates provide improved performance and better compatibility with modern systems, ensuring that security professionals have access to the latest technologies for network reconnaissance and vulnerability assessment.

Nmap 7.96 With Parallel DNS, Npcap 1.82, and Dark Mode

One of the most significant improvements in this release is the implementation of parallel DNS lookups. 

As noted in the changelog, “Nmap now performs forward DNS lookups in parallel, using the same engine that has been reliably performing reverse-DNS lookups for nearly a decade”. 

This enhancement dramatically accelerates scanning operations involving large hostname lists. 

In testing, resolving one million website names to both IPv4 and IPv6 addresses took just over an hour, compared to the previous system’s 49 hours for the same dataset.

The Windows version of Nmap 7.96 now includes Npcap 1.82, upgrading from version 1.79. 

This latest version of the packet capture library brings faster packet injection capabilities, VLAN header capture support, and compatibility with SR-IOV adapters. 

The update resolves several issues, including problems with VLAN tagging and packet size verification. For scripting enthusiasts, Nmap 7.96 introduces three new NSE scripts, bringing the total to 612:

• mikrotik-routeros-version – Queries MikroTik’s WinBox router admin service to obtain RouterOS version information
• mikrotik-routeros-username-brute – Performs brute force attacks against MikroTik routers using CVE-2024-54772
• targets-ipv6-eui64 – Generates IPv6 target addresses from MAC addresses using the EUI-64 method

The Zenmap GUI has received a visual upgrade with the addition of dark mode, accessible via “Profile->Toggle Dark Mode” or by configuring the window::dark_mode parameter in zenmap.conf. 

This feature enhances usability in low-light environments and reduces eye strain during extended scanning sessions.

New Scanning Enhancements in Nmap 7.96

Nmap 7.96 introduces a major enhancement to its scanning capabilities with a complete overhaul of DNS resolution. The key improvements are:

• Parallel Forward DNS Lookups: Nmap now performs forward DNS lookups in parallel, utilizing the same high-performance engine previously used for reverse-DNS resolution. This dramatically speeds up scans involving large lists of hostnames. For example, resolving one million website names to both IPv4 and IPv6 now takes just over an hour, compared to 49 hours with the previous approach.
• Custom Stub Resolver: Nmap continues to use its own custom stub resolver for DNS queries, allowing it to perform dozens of requests in parallel rather than relying on slower system DNS libraries. This significantly reduces scan times, especially for large-scale host discovery tasks.
• Flexible DNS Resolution Options: Users can control DNS resolution with options like -n (disable DNS), -R (always resolve), --system-dns (use system resolver), and --dns-servers (specify custom DNS servers). These options help tailor scanning speed and data collection to specific needs.
• Improved DNS Domain Name Parsing: The latest release also improves DNS domain name parsing to avoid recursion and enforce name length limits, addressing potential stack overflow issues with certain crafted DNS server responses.

These enhancements make Nmap 7.96 much faster and more robust for network discovery, particularly when scanning large numbers of hosts or domains.

Bug Fixes and Feature Enhancements

This release addresses several long-standing issues, including fixes for the IOCP Nsock engine on Windows and corrections for TCP Connect scans (-sT) that would incorrectly show “filtered” instead of “closed” ports. 

Nmap can now scan IP protocol 255 and allows users to specify targets both on the command line and in input files with -iL-a capability previously unavailable.

Ncat has also been improved, with changes to its default connection handling mode and the addition of a -q option that delays exit after EOF on standard input, making it more compatible with traditional netcat implementations.

Security professionals can download Nmap 7.96 from the official website (https://nmap.org/download) in various formats, including Windows installers, Linux RPMs, macOS packages, and source code distributions.

With this release, Nmap continues to evolve as an indispensable tool for network administrators, security auditors, and ethical hackers seeking to discover network vulnerabilities and strengthen their defensive posture.

Vulnerability Attack Simulation on How Hackers Rapidly Probe Websites for Entry Points – Free Webinar