|
The Nmap project has participated in all five previous Google Summers of Code, and they were a tremendous success for us and the student
participants, as described in
this Google
Open Source Blog article (and a 2009 update). So we are delighted to apply again for
2010! This innovative and extraordinarily generous program provides
$4,500 stipends to 1,000 university students to create and
enhance open source software during their summer break. Students get
paid, gain valuable experience and a great resume booster, and write
code which will be used by millions of people!
If you have the time and motivation, submit an application! It
doesn't even require a postage stamp. The big decision to make is
what project you wish to take on. There are many great
mentoring organizations, but our biased suggestion is the
Nmap Security Scanner, a free tool for network exploration or security auditing. Several project ideas are suggested below, or
you can come up with your own clever project. Maybe there is a
feature that you have wanted for years, but nobody has yet stepped up
to the plate to implement it.
Applications are only accepted from March 29 through April
9. If you apply (or plan to), please join the
temporary Nmap
SoC mailing list. Also, we have
written some tips for preparing a great
application.
Note that there are some basic requirements which apply to all sponsored projects.
If you have any questions about your ideas, the best place to post them is the nmap-dev@insecure.org mailing list. You can also join the list or read the archives online. Questions specific to the Nmap SoC program may be sent to Nmap-dev, or the Nmap SoC list.
While we hope you apply for Nmap, you are allowed to apply to multiple organizations and doing so increases your odds (if you put enough time into each app). Many great security projects participated in SoC last year:
Freenet (a crypto anonymity system),
Honeynet Project,
Nmap Security Scanner,
OpenSSH,
Tor (anonymizing proxy),
Umit Project,
and Xelerance (OpenSwan/DNSSec/OTR).
While you can submit a proposal for whatever cool idea your heart
desires, here are some suggestions that would be extremely helpful to
the Nmap project and its users:
Index
Nmap Scripting Engine—Script Developer
Key requirements: Know or willing to quickly learn the Lua scripting language. Significant network security and/or network administration skills.
In 2006, Diman Todorov worked as a GSoC student
with Fyodor to create
the Nmap Scripting Engine. It has become one of Nmap's most
powerful features, allowing users to write (and share) simple scripts
to automate a wide variety of networking tasks. We now have more than 100 scripts, all documented at the NSEDoc Reference Portal. They run the gamut from simple discovery tasks like whois lookups, retrieving web site titles, and banner grabbing, to complex functions like spidering a web server to find SQL injection vulnerabilities and brute force authentication cracking of MSRPC (SMB) servers.
It is time we make the most of this extraordinarily powerful and
fast scripting system! We need talented, creative developers (we
might sponsor several) to help by identifying useful scripts (through
research and community input) and then implementing them. Future
script developers will surely review these scripts as examples, so
this is a chance to really set precedent and customs for readable,
efficient, maintainable scripts. Script developers may identify bugs
in NSE or have infrastructure suggestions for making script writing
easier or execution more efficient. These are good opportunities to
learn about and improve the scripting engine itself.
The script developers will also likely write some new
libraries/modules that their scripts depend on. It is best to use
libraries for general task which many scripts might find useful,
rather than locking the code up in a single NSE script. In addition to
writing scripts, developers help with testing and reviewing each
other's scripts.
We might sponsor one student just for HTTP-related scripts (you
might look at tools such
as w3af for inspiration),
and another student for other protocols. Take a look
at all of our existing scripts
to understand what we're looking for. If you can suggest some of your own new script ideas in your application, that really helps!
Nmap Cloud Scanning Platform
Key requirements: Strong web development skills, and reasonably good web design skills as well.
Nmap is moving into the cloud! Create a hosted application which allows users to log in and
execute Nmap scans. They should be able to view the results online
(using Nmap XML output, rendered to XHTML or HTML using the nmap.xsl
stylesheet distributed with Nmap) or have the normal (-oN) output
emailed to them. Users should also be able to view online (or have
mailed to them) differences since the last time they executed a
particular scan. See the cloud scan
requirements doc for more information. The Nmap project will pay for virtual machine hosting (probably a Linode instance) for the project duration.
Zenmap GUI developer
Key requirements: Python experience and strong user interface design skills.
While Nmap offered the NmapFE front end for many years, it was a
simple wrapper over the Nmap command-line executable and didn't
provide much extra value. In 2005 and continuing in 2006, Adriano
Monteiro Marques was sponsored by Nmap SoC to write a new,
cross-platform Nmap GUI and advanced results viewer. We eventually
incorporated it into Nmap as
Zenmap and have
been improving it ever since. We're particularly proud of the
network
topology, host filtering, scan comparison (using Ndiff), and language localization features.
For 2010, we have numerous new features in mind and are open to
more suggested by applicants. For example, we would like a better way
to handle Nmap Scripting
Engine script selection and argument passing. A graphical
selection dialogue would be great for people who don't have the dozens
of script names and arguments memorized! Performance is key too--topology graph
building can be quite slow when there are many nodes. We will
probably not try to define all the tasks in advance--just the initial
tasks. That leaves us more room for spontaneity in taking the project
in new directions or coming up with and implementing great features.
Feature Creepers and Bug Wranglers
Key requirements: Strong C/C++ skills. Python and LUA skills are valuable as well.
There are many small Nmap bugs and desired features which are quite
valuable but may take only a couple days to handle rather than a whole
summer. Others may take weeks or even a month. The feature creeper
and bug wranglers handle many such tasks during the summer. This lets
them explore and contribute to a wide variety of the Nmap code base
rather than spending the whole summer working on just one subsystem.
The exact tasks won't all be itemized in advance, but you can look at
the Nmap TODO list for the
current list of pending tasks. If you apply for this task, you might
mention several of the TODO items which you would be interested in and
qualified for. Here are some more ideas:
- Write a general scanning engine for abusing applications for port
scanning purposes. This would handle scanning through SOCKS and HTTP
proxies, and the existing FTP bounce scan would also be ported to this
engine. Proxy chaining must be supported.
- Raw IPv6 Scan Support (we currently only offer the connect()-style
TCP port scan under IPv6. Supporting the raw scans (such as SYN scan
and UDP scan) would be great.
- When high-priority bugs are discovered, bug wranglers get on the case and solve them.
- Reorganize Nmap into a C/C++ library, and then change Nmap and
Zenmap to interact with Nmap through that library. Of course Zenmap
would need some sort of Python bindings to do so.
Rather than take a specific role (bug wrangler or feature creeper),
the individual(s) sponsored for this position will do some of each.
But if you have ideas for small feature-creeping/bug-wrangling tasks,
we'd love to hear about them in your application.
Nmap and Zenmap on Mobile Devices (iPhone, Android, Maemo, etc.)
Key requirements: Embedded device development experience. Strong C++ and Python skills are a plus. Candidates should already carry a smart phone of some sort.
Most techies now carry smart phones which allow them to perform
many computing tasks on the go. It is possible to use Nmap on many of
these devices, but not as easily or as capably as on a "real
computer". The goal of this project is to improve this situation by
porting and documenting Nmap on the major mobile platforms. In
particular, this includes the Apple iPhone, Android devices (such as
the G1, Droid, and Nexus One), and Maemo (e.g. Nokia N900). The goal
is to make Nmap as easy to install (e.g. included with the default app
store or repository) and as powerful (e.g. including privileged
operations such as OS detection) as possible. It should support
Zenmap, which is easier to use than the command line on most small
devices. The Nmap project will pay for the hardware where necessary,
but it is expected that sponsored students will try to minimize
expenses by using mobile development virtual machines and the like
whenever possible.
Slacker
Nmap developers are known as some of the most productive in the
open source world. In order to crank out more code, many eschew
luxuries like classes, social lives, sex, and sleep. To
counterbalance all of this planned productivity, we may need some
experienced slackers to spend the summer playing video games, watching
TV, reading Slashdot, and dating. You will report these activities in
a weekly status report so the rest of us can live our lives
vicariously through yours.
Since laziness is a virtue for this position, our normal application form is not required. Just
tell us your best time-wasting story or any other relevant credentials for this critical role.
Nmap Scripting Engine—Infrastructure manager
Key requirements: Substantial experience with the Lua, C, and C++ languages. You will also need to demonstrate substantial experience with Nmap and/or other vulnerability detection or network scanning tools.
We might sponsor someone to focus on the NSE infrastructure itself. This includes bug fixing, performance tuning, and potentially projects such as:
- NSE debugger
- TODO: List more examples :).
As much of the infrastructure is already developed, the
infrastructure manager may also spend a lot of time writing and
reviewing scripts. We will not try to define all the tasks in
advance--just the initial tasks. That leaves us more room for
spontaneity in taking the project in new directions or coming up with
and implementing great features.
Ncrack Developer
Key requirements: Strong C++ skills and a passion for application performance. Competition for this position is extremely fierce, so we recommend applying for a different project if there is one you like equally well.
For Nmap GSoC 2009, Ithilgore created Ncrack, a high speed network authentication cracker. This year we hope to expand its libraries of cracking modules (so far it has http, ssh, telnet, and ftp) as well as improving the engine and fixing any bugs discovered.
Nping Developer
Key requirements: Strong C++ skills and a passion for application performance. Competition for this position is extremely fierce, so we recommend applying for a different project if there is one you like equally well.
For Nmap GSoC 2009, Luis MartinGarcia
created Nping, a tool for network
packet generation, response analysis and response time measurement.
You can think of it as Hping on
steroids (and actively maintained). This year we hope to add an
innovated echo mode which allows an Nping listener to run on the
target system and report back to clients exactly what packets were
received. This helps identify whether a probe packet was
dropped/filtered on the way to the target, or on the way back, and it
also identifies network mangling such as network address translation.
We have other features in mind (particularly those which haven't yet
been met from the original
specifications, and also plan to significantly clean up the
codebase for incorporation into Nmap.
Your Own Creative Idea!
Key requirements: Creativity
Don't feel constrained to the ideas we have suggested here. If you
are very familiar with Nmap and have your own great idea for
improvement, propose it! There will be dozens of applicants for each
position listed on this page, but your suggestions have less
competition. Before writing a whole proposal, we recommend that you
send a paragraph or two describing your idea to
the nmap-dev list for
feedback. Note that even if we don't accept your project idea (maybe
the timing is not right or it doesn't fit in the Nmap roadmap), we pay
close attention to the credentials of every applicant and if you
demonstrate substantial talents we will try to place you in a
different Nmap project if possible. So even submitting your own "long
shot" idea is often more successful than cut & pasting one of the
canned ideas on this page.
Ready to apply? Great! Please visit our SoC Application Notes page for instructions.
| 
