Nmap亦称为Network Mapper(网络映射)是一个开源并且通用的用于Linux系统/网络管理员的工具。nmap用于探查网络、执行安全扫描、网络核查并且在远程机器上找出开放端口。它可以扫描在线的主机、操作系统、包过滤器和远程主机上的开放端口。

Nmap 命令和示例

我会分两个章节讲述NMAP的常见的使用方法，这篇是nmap系列的第一部分(译注:原文为I’ll be covering most of NMAP usage in two different parts and this is the first part of nmap serious,这里serious可能为笔误，应该为series)。在这个步骤里，我用两个没有防火墙的服务器来测试nmap命令的工作。

  • 192.168.0.100 – server1.tecmint.com
  • 192.168.0.101 – server2.tecmint.com

Nmap 命令使用

  1. # nmap [Scan Type(s)] [Options] {target specification}

如何在Linux上安装nmap

如今大部分Linux发行版像Red Hat, CentOS, Fedoro, Debian 和 Ubuntu已经在它们默认的包管理仓库中包含了nmap，可以通过Yum 和 APT安装、管理和更新软件包。在这些发行版上安装nmap，可以使用下面的命令。

  1. # yum install nmap      [基于 Red Hat 的发行版]
  2. $ sudo apt-get install nmap [基于 Debian 的发行版]

安装了最新的nmap程序之后，你就可以跟着这篇文章中的示例指令来学习了。

1. 带主机名和IP地址扫描系统

nmap工具提供了不同的方法来扫描一个系统。在这个例子中，我使用主机名为server2.tecmint.com的机器执行扫描来找出所有开放端口，服务和系统上的MAC地址。

使用主机名扫描

  1. [root@server1 ~]# nmap server2.tecmint.com
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:42 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14.  
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.415 seconds
  16. You have new mail in /var/spool/mail/root

使用IP地址扫描

  1. [root@server1 ~]# nmap 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 11:04 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 958/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14.  
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.465 seconds
  16. You have new mail in /var/spool/mail/root

2. 使用"-v"选项扫描

你可以看到带"-v"选项的命令给出了关于远程机器的更多信息。

  1. [root@server1 ~]# nmap -v server2.tecmint.com
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:43 EST
  4. Initiating ARP Ping Scan against 192.168.0.101 [1 port] at 15:43
  5. The ARP Ping Scan took 0.01s to scan 1 total hosts.
  6. Initiating SYN Stealth Scan against server2.tecmint.com (192.168.0.101) [1680 ports] at 15:43
  7. Discovered open port 22/tcp on 192.168.0.101
  8. Discovered open port 80/tcp on 192.168.0.101
  9. Discovered open port 8888/tcp on 192.168.0.101
  10. Discovered open port 111/tcp on 192.168.0.101
  11. Discovered open port 3306/tcp on 192.168.0.101
  12. Discovered open port 957/tcp on 192.168.0.101
  13. The SYN Stealth Scan took 0.30s to scan 1680 total ports.
  14. Host server2.tecmint.com (192.168.0.101) appears to be up ... good.
  15. Interesting ports on server2.tecmint.com (192.168.0.101):
  16. Not shown: 1674 closed ports
  17. PORT     STATE SERVICE
  18. 22/tcp   open  ssh
  19. 80/tcp   open  http
  20. 111/tcp  open  rpcbind
  21. 957/tcp  open  unknown
  22. 3306/tcp open  mysql
  23. 8888/tcp open  sun-answerbook
  24. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  25.  
  26. Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds
  27.                Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)

扫描多台主机

你可以简单地通过在namap后写上它们的IP地址或者主机名来扫描多台主机。

  1. [root@server1 ~]# nmap 192.168.0.101 192.168.0.102 192.168.0.103
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:06 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14. Nmap finished: 3 IP addresses (1 host up) scanned in 0.580 seconds

4. 扫描整个子网

你可以通过通配符来使nmap扫描整个子网或者IP段。

  1. [root@server1 ~]# nmap 192.168.0.*
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:11 EST
  4. Interesting ports on server1.tecmint.com (192.168.0.100):
  5. Not shown: 1677 closed ports
  6. PORT    STATE SERVICE
  7. 22/tcp  open  ssh
  8. 111/tcp open  rpcbind
  9. 851/tcp open  unknown
  10.  
  11. Interesting ports on server2.tecmint.com (192.168.0.101):
  12. Not shown: 1674 closed ports
  13. PORT     STATE SERVICE
  14. 22/tcp   open  ssh
  15. 80/tcp   open  http
  16. 111/tcp  open  rpcbind
  17. 957/tcp  open  unknown
  18. 3306/tcp open  mysql
  19. 8888/tcp open  sun-answerbook
  20. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  21.  
  22. Nmap finished: 256 IP addresses (2 hosts up) scanned in 5.550 seconds
  23. You have new mail in /var/spool/mail/root

从上面的输出你可以看到nmap扫描了整个子网，并给出了网络中在线主机的信息。

5. 使用IP地址的最后一段扫描多台主机

你可以简单地通过指定IP地址的最后8位执行扫描多台主机。比如说，这里我在IP地址为192.168.0.101, 192.168.0.102 and 192.168.0.103的机器上执行了扫描。

  1. [root@server1 ~]# nmap 192.168.0.101,102,103
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:09 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14.  
  15. Nmap finished: 3 IP addresses (1 host up) scanned in 0.552 seconds
  16. You have new mail in /var/spool/mail/root

6. 从文件中扫描主机列表

如果你有更多的主机要扫描，并且所有的主机都写在一个文件中，你可以直接让namp读取它并执行扫描。让我们看看要怎么做。

创建一个名为“nmaptest.txt”的文本文件，并定义所有你想要扫描的IP地址或者服务器的主机名。

  1. [root@server1 ~]# cat > nmaptest.txt
  2.  
  3. localhost
  4. server2.tecmint.com
  5. 192.168.0.101

接着，带“iL”参数运行nmap命令来扫描文件中所有列出的IP地址。

  1. [root@server1 ~]# nmap -iL nmaptest.txt
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 10:58 EST
  4. Interesting ports on localhost.localdomain (127.0.0.1):
  5. Not shown: 1675 closed ports
  6. PORT    STATE SERVICE
  7. 22/tcp  open  ssh
  8. 25/tcp  open  smtp
  9. 111/tcp open  rpcbind
  10. 631/tcp open  ipp
  11. 857/tcp open  unknown
  12.  
  13. Interesting ports on server2.tecmint.com (192.168.0.101):
  14. Not shown: 1674 closed ports
  15. PORT     STATE SERVICE
  16. 22/tcp   open  ssh
  17. 80/tcp   open  http
  18. 111/tcp  open  rpcbind
  19. 958/tcp  open  unknown
  20. 3306/tcp open  mysql
  21. 8888/tcp open  sun-answerbook
  22. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  23.  
  24. Interesting ports on server2.tecmint.com (192.168.0.101):
  25. Not shown: 1674 closed ports
  26. PORT     STATE SERVICE
  27. 22/tcp   open  ssh
  28. 80/tcp   open  http
  29. 111/tcp  open  rpcbind
  30. 958/tcp  open  unknown
  31. 3306/tcp open  mysql
  32. 8888/tcp open  sun-answerbook
  33. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  34.  
  35. Nmap finished: 3 IP addresses (3 hosts up) scanned in 2.047 seconds

7. 扫描一个IP范围

在使用nmap扫描时，你可以指定一个IP范围。

  1. [root@server1 ~]# nmap 192.168.0.101-110
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:09 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14.  
  15. Nmap finished: 10 IP addresses (1 host up) scanned in 0.542 seconds

8. 扫描网络时排除部分主机

你可以在执行全网扫描的时候排除一些主机，或者在使用通配符扫描时使用“–exclude”选项。

  1. [root@server1 ~]# nmap 192.168.0.* --exclude 192.168.0.100
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:16 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14.  
  15. Nmap finished: 255 IP addresses (1 host up) scanned in 5.313 seconds
  16. You have new mail in /var/spool/mail/root

9. 扫描系统信息

（译注：原文这里提到了traceroute，实在并无此内容，删除之）

使用nmap，你可以检测到运行在远程主机上的操作系统和版本。要启用OS及其版本检测，我们可以使用带 “-A” 选项使用nmap。

  1. [root@server1 ~]# nmap -A 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:25 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE VERSION
  7. 22/tcp   open  ssh     OpenSSH 4.3 (protocol 2.0)
  8. 80/tcp   open  http    Apache httpd 2.2.3 ((CentOS))
  9. 111/tcp  open  rpcbind  2 (rpc #100000)
  10. 957/tcp  open  status   1 (rpc #100024)
  11. 3306/tcp open  mysql   MySQL (unauthorized)
  12. 8888/tcp open  http    lighttpd 1.4.32
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14. No exact OS matches for host (If you know what OS is running on it, see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
  15. TCP/IP fingerprint:
  16. SInfo(V=4.11%P=i686-redhat-linux-gnu%D=11/11%Tm=52814B66%O=22%C=1%M=080027)
  17. TSeq(Class=TR%IPID=Z%TS=1000HZ)
  18. T1(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  19. T2(Resp=N)
  20. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  21. T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  22. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  23. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  24. T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  25. PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  26.  
  27. Uptime 0.169 days (since Mon Nov 11 12:22:15 2013)
  28.  
  29. Nmap finished: 1 IP address (1 host up) scanned in 22.271 seconds
  30. You have new mail in /var/spool/mail/root

在上面的输出中，你可以看到运行在远程主机上操作系统的TCP/IP指纹和更详细的运行在远程主机上的特定端口和服务。

10. 使用nmap启用系统检测

使用选项“-O”或“-osscan-guess”同样可以发现OS信息。

  1. [root@server1 ~]# nmap -O server2.tecmint.com
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:40 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14. No exact OS matches for host (If you know what OS is running on it, see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
  15. TCP/IP fingerprint:
  16. SInfo(V=4.11%P=i686-redhat-linux-gnu%D=11/11%Tm=52815CF4%O=22%C=1%M=080027)
  17. TSeq(Class=TR%IPID=Z%TS=1000HZ)
  18. T1(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  19. T2(Resp=N)
  20. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  21. T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=Option -O and -osscan-guess also helps to discover OSR%Ops=)
  22. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  23. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  24. T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  25. PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  26.  
  27. Uptime 0.221 days (since Mon Nov 11 12:22:16 2013)
  28.  
  29. Nmap finished: 1 IP address (1 host up) scanned in 11.064 seconds
  30. You have new mail in /var/spool/mail/root

11. 扫描主机来检测防火墙

下面的命令会在远程主机上执行扫描来检测主机上是否使用了任何包过滤器或者防火墙。

  1. [root@server1 ~]# nmap -sA 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:27 EST
  4. All 1680 scanned ports on server2.tecmint.com (192.168.0.101) are UNfiltered
  5. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  6.  
  7. Nmap finished: 1 IP address (1 host up) scanned in 0.382 seconds
  8. You have new mail in /var/spool/mail/root

12. 扫描主机以检查其受到防火墙保护

扫描检测一个主机是否受到任何包过滤器软件或者防火墙保护。

  1. [root@server1 ~]# nmap -PN 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:30 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14.  
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.399 seconds

13. 找出网络中在线主机

在“-sP”选项的bang帮助下，我们可以简单地检测网络中的主机是否在线,带这个选项后nmap会跳过端口检测和其他检测。

  1. [root@server1 ~]# nmap -sP 192.168.0.*
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 11:01 EST
  4. Host server1.tecmint.com (192.168.0.100) appears to be up.
  5. Host server2.tecmint.com (192.168.0.101) appears to be up.
  6. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  7. Nmap finished: 256 IP addresses (2 hosts up) scanned in 5.109 seconds

14. 执行快速扫描

你可以带“-F”选项仅扫描所有列在nmap-services文件中的端口。

  1. [root@server1 ~]# nmap -F 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:47 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1234 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 3306/tcp open  mysql
  11. 8888/tcp open  sun-answerbook
  12. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  13.  
  14. Nmap finished: 1 IP address (1 host up) scanned in 0.322 seconds

15. 找出nmap版本

你可以使用“-V”选项找出运行在你机器上的nmap版本。

  1. [root@server1 ~]# nmap -V
  2.  
  3. Nmap version 4.11 ( http://www.insecure.org/nmap/ )
  4. You have new mail in /var/spool/mail/root

16. 连续扫描端口

使用“-r”选项而不随机排列端口的扫描顺序。

  1. [root@server1 ~]# nmap -r 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:52 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14.  
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.363 seconds

17. 显示主机接口及路由

你可以使用nmap的“–iflist”选项来列出本机的主机接口和路由信息。

  1. [root@server1 ~]# nmap --iflist
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:07 EST
  4. ************************INTERFACES************************
  5. DEV  (SHORT) IP/MASK          TYPE     UP MAC
  6. lo   (lo)    127.0.0.1/8      loopback up
  7. eth0 (eth0)  192.168.0.100/24 ethernet up 08:00:27:11:C7:89
  8.  
  9. **************************ROUTES**************************
  10. DST/MASK      DEV  GATEWAY
  11. 192.168.0.0/0 eth0
  12. 169.254.0.0/0 eth0

在上面的输出中，你可以看到上述清单列出了你系统中的已经启用的接口及它们相应的路由。（译注：这样你就知道可以通过这些接口扫描哪些网络了）

18. 扫描特定端口

nmap使用不同的选项来发现远程机器上的端口。你可以用“-p”选项指定你想扫描的TCP端口。默认上，nmap只会扫描TCP端口。

  1. [root@server1 ~]# nmap -p 80 server2.tecmint.com
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:12 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. PORT   STATE SERVICE
  6. 80/tcp open  http
  7. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  8.  
  9. Nmap finished: 1 IP address (1 host up) sca

19. 扫描TCP端口

当然，你可以指定nmap扫描的端口类型（TCP或UDP）和端口号。

  1. [root@server1 ~]# nmap -p T:8888,80 server2.tecmint.com
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:15 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. PORT     STATE SERVICE
  6. 80/tcp   open  http
  7. 8888/tcp open  sun-answerbook
  8. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  9.  
  10. Nmap finished: 1 IP address (1 host up) scanned in 0.157 seconds

20. 扫描UDP端口

  1. [root@server1 ~]# nmap -sU 53 server2.tecmint.com
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:15 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. PORT     STATE SERVICE
  6. 53/udp   open  http
  7. 8888/udp open  sun-answerbook
  8. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  9.  
  10. Nmap finished: 1 IP address (1 host up) scanned in 0.157 seconds

21. 扫描多个端口

你可以使用“-p”选项来指定多个要扫描的端口。

  1. [root@server1 ~]# nmap -p 80,443 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 10:56 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. PORT    STATE  SERVICE
  6. 80/tcp  open   http
  7. 443/tcp closed https
  8. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  9.  
  10. Nmap finished: 1 IP address (1 host up) scanned in 0.190 seconds

22. 扫描网络的端口范围

你也可以使用表达式指定扫描端口的范围。

  1. [root@server1 ~]#  nmap -p 80-160 192.168.0.101

23. 找出主机服务版本号

我们可以使用“-sV”选项找出远程主机上运行的服务及其版本号。

  1. [root@server1 ~]# nmap -sV 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:48 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE VERSION
  7. 22/tcp   open  ssh     OpenSSH 4.3 (protocol 2.0)
  8. 80/tcp   open  http    Apache httpd 2.2.3 ((CentOS))
  9. 111/tcp  open  rpcbind  2 (rpc #100000)
  10. 957/tcp  open  status   1 (rpc #100024)
  11. 3306/tcp open  mysql   MySQL (unauthorized)
  12. 8888/tcp open  http    lighttpd 1.4.32
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14.  
  15. Nmap finished: 1 IP address (1 host up) scanned in 12.624 seconds

24. 使用 TCP ACK (PA) 和 TCP Syn (PS) 扫描远程主机

有时包过滤防火墙阻止了标准ICMPping请求，在这个情况下，我们可以使用TCP ACK和TCP Syn方法来扫描远程主机。

  1. [root@server1 ~]# nmap -PS 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:51 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14.  
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.360 seconds
  16. You have new mail in /var/spool/mail/root

25. 用TCP ACK扫描远程主机的特定端口

  1. [root@server1 ~]# nmap -PA -p 22,80 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:02 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. PORT   STATE SERVICE
  6. 22/tcp open  ssh
  7. 80/tcp open  http
  8. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  9.  
  10. Nmap finished: 1 IP address (1 host up) scanned in 0.166 seconds
  11. You have new mail in /var/spool/mail/root

26. 用TCP SYN扫描远程主机的特定端口

  1. [root@server1 ~]# nmap -PS -p 22,80 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:08 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. PORT   STATE SERVICE
  6. 22/tcp open  ssh
  7. 80/tcp open  http
  8. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  9.  
  10. Nmap finished: 1 IP address (1 host up) scanned in 0.165 seconds
  11. You have new mail in /var/spool/mail/root

27. 执行隐秘扫描

  1. [root@server1 ~]# nmap -sS 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:10 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14.  
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.383 seconds
  16. You have new mail in /var/spool/mail/root

28. 用TCP SYN扫描最常用的端口

  1. [root@server1 ~]# nmap -sT 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:12 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14.  
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.406 seconds
  16. You have new mail in /var/spool/mail/root

29. 执行tcp空扫描来愚弄防火墙

  1. [root@server1 ~]# nmap -sN 192.168.0.101
  2.  
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 19:01 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE         SERVICE
  7. 22/tcp   open|filtered ssh
  8. 80/tcp   open|filtered http
  9. 111/tcp  open|filtered rpcbind
  10. 957/tcp  open|filtered unknown
  11. 3306/tcp open|filtered mysql
  12. 8888/tcp open|filtered sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14.  
  15. Nmap finished: 1 IP address (1 host up) scanned in 1.584 seconds
  16. You have new mail in /var/spool/mail/root

这些就是目前NMAP 的用法，我会写出更有创造性的NMAP的第二部分(译注:原文为 I’ll be coming up more creative options of NMAP in our second part of this serious,这里serious可能为笔误，应该为series)。接着，不要走开也别忘了分享你们有价值的评论。

via: http://www.tecmint.com/nmap-command-examples/

译者：geekpi 校对：wxy

给Linux系统/网络管理员的nmap的29个实用例子的更多相关文章

  1. 给Linux系统/网络管理员准备的Nmap命令的29个实用范例

    我将用两个不同的部分来涵盖大部分NMAP的使用方法,这是nmap关键的第一部分.在下面的设置中,我使用两台已关闭防火墙的服务器来测试Nmap命令的工作情况. 192.168.0.100 – serve ...

  2. Linux 系统 网络配置

    Linux 系统 网络配置 配置Linux系统网络的方法有几种,这里介绍本人常用的两种. 第一种:使用命令ifconfig配置,具体用法:Ipconfig  ethx   x.x.x.x    net ...

  3. Linux系统忘记管理员密码（CentOS、RHEL、Ubuntu）

    Linux系统忘记管理员密码(CentOS.RHEL.Ubuntu) 系统使用过程中,尤其是生产环境中.万一忘记管理员密码,该怎么办?是不是很绝望? 1.RHEL 7.0 重启主机进入引导界面键入e键 ...

  4. [Linux][VMWare] 学习笔记之安装Linux系统-网络配置

    最近开始折腾Linux,在本机装了个VMWare和Centos,装完之后虚拟机里面的OS可以上网,但是使用SecureCRT连接不上虚拟机,开始折腾这个网络. vmware安装好以后,会自动添加两张网 ...

  5. 嵌入式控制(0)----linux系统网络配置

    嵌入式系统本身具有操作系统的全部属性,但收到其硬件条件制约,故需要主机通过串口/网口等方式与其通信.今日下午的工作主要是linux系统的ssh传输配置,nfs服务器配置,tftp服务器配置. ip的概 ...

  6. linux系统——网络调试工具

    http://blog.csdn.net/chinalinuxzend/article/details/1799279 1.网络调试工具概说: 如 果我们把一台机器接入网络中,通过网络配置工具的配置这 ...

  7. 虚拟机linux系统网络连接配置问题总结

    1.虚拟机与CentOS的安装与配置参考本人博客:https://www.cnblogs.com/ClikeL/p/11743520.html 2.测试网络连接 ping www.baidu.com ...

  8. Linux系统网络性能实例分析

    由于TCP/IP是使用最普遍的Internet协议,下面只集中讨论TCP/IP 栈和以太网(Ethernet).术语 LinuxTCP/IP栈和 Linux网络栈可互换使用,因为 TCP/IP栈是 L ...

  9. Linux 系统网络问题处理集[包含VM处理]

    1.1. 新操作系统ping不同主机: 检查Linux服务器网段是否有etho的IP 查看/关闭防火墙 查看:service iptables status 关闭:service iptables s ...

随机推荐

  1. PHP pathinfo() 函数

    PHP pathinfo() 函数 完整的 PHP Filesystem 参考手册 定义和用法 pathinfo() 函数以数组或字符串的形式返回关于文件路径的信息. 返回的数组元素如下: [dirn ...

  2. 修真院java后端工程师学习课程--任务1(day one)

    这是我从学习资料-线下报名-北京报名截取的报名截图,从图中我们可以看出我们的报名对象应该有姓名,qq,修真类型,预计入学时间,毕业院校,线上学号,日报链接,立愿,辅导师兄等属性,其中线上学号是主码. ...

  3. IOS中UIScrollView的contentSize、contentOffset和contentInset属性

    IOS中,UIScrollView是可以滚动的视图,其中最常用的UITableView就是继承了UIScrollView. 跟所有的view一样,UIScrollView有一个frame属 性,同时, ...

  4. 【转】Maven pom.xml 配置详解

    原文链接:https://yq.aliyun.com/articles/38271 pom.xml文件配置详解 --声明规范 <project xmlns="http://maven. ...

  5. Django实现组合搜索

    一.实现方法 1.纯模板语言实现 2.自定义simpletag实现(本质是简化了纯模板语言的判断) 二.基本原理 原理都是通过django路由系统,匹配url筛选条件,将筛选条件作为数据库查询结果,返 ...

  6. underscore.js 源码阅读 一 整体结构

    // 整个underscore的实现包在一个立即执行函数中,避免污染全局对象 // 通过call(this)来入全局变量 (function() { // 缓存this var root = this ...

  7. python3 第十五章 - 数据类型之Sets（集合）

    python的官网里对集合的描述是: Python also includes a data type for sets. A set is an unordered collection with ...

  8. Servlet--HttpServletRequest接口，HttpServletResponse接口

    HttpServletRequest接口 定义 public interface HttpServletRequest extends ServletRequest; 用来处理一个对 Servlet ...

  9. selenium+python自动化测试系列(二)：AutoIt工具实现本地文件上传

    AutoIt使用简单说明 AutoIt的安装这里就不在啰嗦,可以参考AutoIt安装或者自行搜索解决. 第一步:定位上传文件路径的文本框 这里举例说明,如何定位?如图 这里我们看到上传文件的类型是bu ...

  10. 计算机改名引发的ORA

    近期上班时,由于开机时老是提示" 局域网出现计算机重名冲突",于是把计算机名字给改了,从PC2010081312zeo改为了CXBIKKKKKKK,结果第二天来的时候,用PL/SQ ...