首页 > 代码库 > nmap_命令详解

nmap_命令详解

1

使用主机名扫描

[root@wl020237 opt]# nmap www.baidu.com


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 16:52 CST

Nmap scan report for www.baidu.com (220.181.111.188)

Host is up (0.0025s latency).

Other addresses for www.baidu.com (not scanned): 220.181.112.244

Not shown: 998 filtered ports

PORT    STATE SERVICE

80/tcp  open  http

443/tcp open  https


Nmap done: 1 IP address (1 host up) scanned in 5.01 seconds


2

使用IP地址扫描

[root@wl020237 opt]# nmap 192.168.20.237


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 16:53 CST

Nmap scan report for 192.168.20.237

Host is up (0.0000060s latency).

Not shown: 997 closed ports

PORT     STATE SERVICE

22/tcp   open  ssh

80/tcp   open  http

3306/tcp open  mysql


Nmap done: 1 IP address (1 host up) scanned in 0.15 seconds


3

扫描使用“-v”选项

使用“ -v “选项后给出了远程机器更详细的信息。

[root@wl020237 opt]# nmap -v www.baidu.com


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 16:54 CST

Initiating Ping Scan at 16:54

Scanning www.baidu.com (220.181.111.188) [4 ports]

Completed Ping Scan at 16:54, 0.02s elapsed (1 total hosts)

Initiating Parallel DNS resolution of 1 host. at 16:54

Completed Parallel DNS resolution of 1 host. at 16:54, 0.02s elapsed

Initiating SYN Stealth Scan at 16:54

Scanning www.baidu.com (220.181.111.188) [1000 ports]

Discovered open port 80/tcp on 220.181.111.188

Discovered open port 443/tcp on 220.181.111.188

Completed SYN Stealth Scan at 16:54, 4.53s elapsed (1000 total ports)

Nmap scan report for www.baidu.com (220.181.111.188)

Host is up (0.0019s latency).

Other addresses for www.baidu.com (not scanned): 220.181.112.244

Not shown: 998 filtered ports

PORT    STATE SERVICE

80/tcp  open  http

443/tcp open  https


Read data files from: /usr/bin/../share/nmap

Nmap done: 1 IP address (1 host up) scanned in 4.68 seconds

           Raw packets sent: 2004 (88.152KB) | Rcvd: 5 (204B)

           

4

扫描多台主机

Nmap命令后加上多个IP地址或主机名来扫描多台主机

[root@wl020237 opt]# nmap  www.baidu.com www.163.com


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 16:56 CST

Nmap scan report for www.baidu.com (220.181.112.244)

Host is up (0.0023s latency).

Other addresses for www.baidu.com (not scanned): 220.181.111.188

Not shown: 998 filtered ports

PORT    STATE SERVICE

80/tcp  open  http

443/tcp open  https


Nmap scan report for www.163.com (175.25.168.40)

Host is up (0.0028s latency).

Not shown: 984 closed ports

PORT      STATE SERVICE

80/tcp    open  http

81/tcp    open  hosts2-ns

88/tcp    open  kerberos-sec

443/tcp   open  https

2323/tcp  open  3d-nfsd

3030/tcp  open  arepa-cas

8080/tcp  open  http-proxy

8081/tcp  open  blackice-icecap

8082/tcp  open  blackice-alerts

8083/tcp  open  us-srv

8088/tcp  open  radan-http

8090/tcp  open  unknown

8888/tcp  open  sun-answerbook

9001/tcp  open  tor-orport

9500/tcp  open  ismserver

20000/tcp open  dnp


Nmap done: 2 IP addresses (2 hosts up) scanned in 17.15 seconds


5

扫描整个子网

使用*通配符来扫描整个子网或某个范围的IP地址

[root@wl020237 opt]# nmap 192.168.20.*


6

使用IP地址的最后一个字节扫描多台服务器

[root@wl020237 opt]# nmap 192.168.20.236,237,238


7

从一个文件中扫描主机列表

运行带“iL” 选项的nmap命令来扫描文件中列出的所有IP地址

[root@wl020237 opt]# more abc.txt

192.168.20.248

192.168.20.235

192.168.20.227

[root@wl020237 opt]# nmap -iL abc.txt


8

扫描一个IP地址范围

nmap 192.168.20.236-238


9

排除一些远程主机后再扫描

[root@wl020237 opt]# nmap 192.168.20.236-238 --exclude 192.168.20.237


10

扫描操作系统信息和路由跟踪

为了启用操作系统和版本检测,脚本扫描和路由跟踪功能,我们可以使用NMAP的“-A“选项。

从下面的输出你可以看到,Nmap显示出了远程主机操作系统的TCP/IP协议指纹,并且更加具体的显示出远程主机上的端口和服务

[root@wl020237 opt]# nmap -A 192.168.20.229


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 17:04 CST

Nmap scan report for 192.168.20.229

Host is up (0.00028s latency).

Not shown: 997 closed ports

PORT     STATE SERVICE VERSION

22/tcp   open  ssh     OpenSSH 5.3 (protocol 2.0)

| ssh-hostkey: 

|   1024 59:14:67:7a:92:dc:30:76:e0:59:9c:f2:eb:d7:dc:77 (DSA)

|_  2048 3a:a8:73:5a:e7:02:34:5d:fe:1e:04:7d:5f:b3:ba:19 (RSA)

80/tcp   open  http    nginx

|_http-server-header: nginx

|_http-title: \xE5\xA5\xBD\xE6\x9C\xA8

8088/tcp open  http    Jetty 7.6.15.v20140411

|_http-server-header: Jetty(7.6.15.v20140411)

|_http-title: Error 404 Not Found

MAC Address: 00:0C:29:6C:03:6A (VMware)

No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).

TCP/IP fingerprint:

OS:SCAN(V=7.40%E=4%D=3/29%OT=22%CT=1%CU=33617%PV=Y%DS=1%DC=D%G=Y%M=000C29%T

OS:M=58DB78C6%P=x86_64-redhat-linux-gnu)SEQ(SP=108%GCD=1%ISR=109%TI=Z%CI=Z%

OS:II=I%TS=U)OPS(O1=M5B4NNSNW9%O2=M5B4NNSNW9%O3=M5B4NW9%O4=M5B4NNSNW9%O5=M5

OS:B4NNSNW9%O6=M5B4NNS)WIN(W1=3908%W2=3908%W3=3908%W4=3908%W5=3908%W6=3908)

OS:ECN(R=Y%DF=Y%T=40%W=3908%O=M5B4NNSNW9%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%

OS:F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T

OS:5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=

OS:Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF

OS:=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40

OS:%CD=S)


Network Distance: 1 hop


TRACEROUTE

HOP RTT     ADDRESS

1   0.28 ms 192.168.20.229


OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 20.09 seconds


11

启用Nmap的操作系统探测功能

使用选项“-O”和“-osscan-guess”也帮助探测操作系统信息

[root@wl020237 opt]# nmap -O 192.168.20.229


12

扫描主机侦测防火墙

扫描远程主机以探测该主机是否使用了包过滤器或防火墙

[root@wl020237 opt]# nmap -sA www.baidu.com


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 17:11 CST

Nmap scan report for www.baidu.com (220.181.112.244)

Host is up (0.0019s latency).

Other addresses for www.baidu.com (not scanned): 220.181.111.188

All 1000 scanned ports on www.baidu.com (220.181.112.244) are filtered     #可以判断出使用了防火墙


Nmap done: 1 IP address (1 host up) scanned in 21.22 seconds


[root@wl020237 opt]# nmap -sA 192.168.20.229


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 17:14 CST

Nmap scan report for 192.168.20.229

Host is up (0.00033s latency).

All 1000 scanned ports on 192.168.20.229 are unfiltered     #未使用防火墙

MAC Address: 00:0C:29:6C:03:6A (VMware)


Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds


13

扫描主机检测是否有防火墙保护

扫描主机检测其是否受到数据包过滤软件或防火墙的保护

[root@wl020237 opt]# nmap -PN www.baidu.com


14

找出网络中的在线主机

使用“-sP”选项,我们可以简单的检测网络中有哪些在线主机,该选项会跳过端口扫描和其他一些检测。

[root@wl020237 opt]# nmap -sP 192.168.20.*


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 17:18 CST

Nmap scan report for 192.168.20.1

Host is up (0.00068s latency).

MAC Address: 68:ED:A4:03:5A:65 (Shenzhen Seavo Technology)

Nmap scan report for 192.168.20.57

Host is up (0.00080s latency).

MAC Address: 14:18:77:27:34:DF (Dell)

Nmap scan report for 192.168.20.211

Host is up (0.00038s latency).

MAC Address: 14:18:77:4F:70:DC (Dell)


15

执行快速扫描

你可以使用“-F”选项执行一次快速扫描,仅扫描列在nmap-services文件中的端口而避开所有其它的端口

[root@wl020237 opt]# nmap -F www.baidu.com


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 17:24 CST

Nmap scan report for www.baidu.com (220.181.112.244)

Host is up (0.0019s latency).

Other addresses for www.baidu.com (not scanned): 220.181.111.188

Not shown: 98 filtered ports

PORT    STATE SERVICE

80/tcp  open  http

443/tcp open  https


Nmap done: 1 IP address (1 host up) scanned in 1.81 seconds


16

查看Nmap的版本

使用“-V”选项来检测你机子上Nmap的版本。

[root@wl020237 opt]# nmap -V


Nmap version 7.40 ( https://nmap.org )

Platform: x86_64-redhat-linux-gnu

Compiled with: liblua-5.3.3 openssl-1.0.1e libpcre-7.8 libpcap-1.4.0 nmap-libdnet-1.12 ipv6

Compiled without:

Available nsock engines: epoll poll select


17

顺序扫描端口

使用“-r”选项表示不会随机的选择端口扫描

[root@wl020237 opt]# nmap -r www.baidu.com


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 17:27 CST

Nmap scan report for www.baidu.com (220.181.111.188)

Host is up (0.0025s latency).

Other addresses for www.baidu.com (not scanned): 220.181.112.244

Not shown: 998 filtered ports

PORT    STATE SERVICE

80/tcp  open  http

443/tcp open  https


Nmap done: 1 IP address (1 host up) scanned in 4.39 seconds


18

打印主机接口和路由

你可以使用nmap的"--iflist”选项检测主机接口和路由信息

从下面的输出你可以看到,nmap列举出了你系统上的接口以及它们各自的路由信息

[root@wl020237 opt]# nmap --iflist 


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 17:28 CST

************************INTERFACES************************

DEV  (SHORT) IP/MASK                     TYPE     UP MTU   MAC

lo   (lo)    127.0.0.1/8                 loopback up 16436

lo   (lo)    ::1/128                     loopback up 16436

eth0 (eth0)  192.168.20.237/24           ethernet up 1500  00:0C:29:14:81:57

eth0 (eth0)  fe80::20c:29ff:fe14:8157/64 ethernet up 1500  00:0C:29:14:81:57


**************************ROUTES**************************

DST/MASK                     DEV  METRIC GATEWAY

192.168.20.0/24              eth0 0

169.254.0.0/16               eth0 1002

0.0.0.0/0                    eth0 0      192.168.20.1

::1/128                      lo   0

fe80::20c:29ff:fe14:8157/128 lo   0

fe80::/64                    eth0 256

ff00::/8                     eth0 256


19

扫描特定的端口

使用Nmap扫描远程机器的端口有各种选项,你可以使用“-P”选项指定你想要扫描的端口,默认情况下nmap只扫描TCP端口

[root@wl020237 opt]# nmap -p 80 www.baidu.com


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 17:34 CST

Nmap scan report for www.baidu.com (220.181.111.188)

Host is up (0.0018s latency).

Other addresses for www.baidu.com (not scanned): 220.181.112.244

PORT   STATE SERVICE

80/tcp open  http


Nmap done: 1 IP address (1 host up) scanned in 0.17 seconds


20

扫描TCP端口

可以指定具体的端口类型和端口号来让nmap扫描

[root@wl020237 opt]# nmap -p T:80,8088 192.168.20.229 


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 17:46 CST

Nmap scan report for 192.168.20.229

Host is up (0.00042s latency).

PORT     STATE SERVICE

80/tcp   open  http

8088/tcp open  radan-http

MAC Address: 00:0C:29:6C:03:6A (VMware)


Nmap done: 1 IP address (1 host up) scanned in 0.18 seconds


21

扫描UDP端口

[root@wl020237 opt]# nmap -sU 192.168.20.229


22

扫描多个端口

还可以使用选项“-P”来扫描多个端口

[root@wl020237 opt]# nmap -p 80,8088 192.168.20.229


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 17:54 CST

Nmap scan report for 192.168.20.229

Host is up (0.0016s latency).

PORT     STATE SERVICE

80/tcp   open  http

8088/tcp open  radan-http

MAC Address: 00:0C:29:6C:03:6A (VMware)


Nmap done: 1 IP address (1 host up) scanned in 0.28 seconds


23

扫描指定范围内的端口

可以使用表达式来扫描某个范围内的端口

[root@wl020237 opt]# nmap -p 80-8088 192.168.20.229 


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 17:58 CST

Nmap scan report for 192.168.20.229

Host is up (0.00025s latency).

Not shown: 7999 closed ports

PORT     STATE SERVICE

80/tcp   open  http

5010/tcp open  telelpathstart

5011/tcp open  telelpathattack

5012/tcp open  nsp

5013/tcp open  fmpro-v6

5015/tcp open  fmwp

5016/tcp open  unknown

5017/tcp open  unknown

6379/tcp open  redis

8088/tcp open  radan-http

MAC Address: 00:0C:29:6C:03:6A (VMware)


Nmap done: 1 IP address (1 host up) scanned in 0.36 seconds


24

查找主机服务版本号

我们可以使用“-sV”选项找出远程主机上运行的服务版本

[root@wl020237 opt]# nmap -sV 192.168.20.237


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 17:59 CST

Nmap scan report for 192.168.20.237

Host is up (0.0000060s latency).

Not shown: 997 closed ports

PORT     STATE SERVICE VERSION

22/tcp   open  ssh     OpenSSH 5.3 (protocol 2.0)

80/tcp   open  http    Apache httpd 2.2.15 ((CentOS))

3306/tcp open  mysql   MySQL 5.6.35


Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 6.80 seconds


25

使用TCP ACK (PA)和TCP Syn (PS)扫描远程主机

有时候包过滤防火墙会阻断标准的ICMP ping请求,在这种情况下,我们可以使用TCP ACK和TCP Syn方法来扫描远程主机

[root@wl020237 opt]# nmap -PS www.baidu.com


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 18:01 CST

Nmap scan report for www.baidu.com (220.181.111.188)

Host is up (0.0040s latency).

Other addresses for www.baidu.com (not scanned): 220.181.112.244

Not shown: 998 filtered ports

PORT    STATE SERVICE

80/tcp  open  http

443/tcp open  https


Nmap done: 1 IP address (1 host up) scanned in 5.99 seconds


26

使用TCP ACK扫描远程主机上特定的端口

[root@wl020237 opt]# nmap -PA -p 80,8088 192.168.20.229


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 18:04 CST

Nmap scan report for 192.168.20.229

Host is up (0.00040s latency).

PORT     STATE SERVICE

80/tcp   open  http

8088/tcp open  radan-http

MAC Address: 00:0C:29:6C:03:6A (VMware)


Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds


27

执行一次隐蔽的扫描

[root@wl020237 opt]# nmap -sS www.baidu.com     


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 18:05 CST

Nmap scan report for www.baidu.com (220.181.112.244)

Host is up (0.0018s latency).

Other addresses for www.baidu.com (not scanned): 220.181.111.188

Not shown: 998 filtered ports

PORT    STATE SERVICE

80/tcp  open  http

443/tcp open  https


Nmap done: 1 IP address (1 host up) scanned in 4.99 seconds


28

使用TCP Syn扫描最常用的端口

[root@wl020237 opt]# nmap -sT www.baidu.com


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 18:06 CST

Nmap scan report for www.baidu.com (220.181.112.244)

Host is up (0.0019s latency).

Other addresses for www.baidu.com (not scanned): 220.181.111.188

Not shown: 998 filtered ports

PORT    STATE SERVICE

80/tcp  open  http

443/tcp open  https


Nmap done: 1 IP address (1 host up) scanned in 4.55 seconds


29

执行TCP空扫描以骗过防火墙

[root@wl020237 opt]# nmap -sN 192.168.20.237


Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-29 18:08 CST

Nmap scan report for 192.168.20.237

Host is up (0.0000060s latency).

Not shown: 997 closed ports

PORT     STATE         SERVICE

22/tcp   open|filtered ssh

80/tcp   open|filtered http

3306/tcp open|filtered mysql


Nmap done: 1 IP address (1 host up) scanned in 1.38 seconds


本文出自 “青春邓勇” 博客,请务必保留此出处http://dengyong.blog.51cto.com/8409869/1911507

nmap_命令详解