Web信息收集-目标扫描-Nmap

Nmap相关优质博文：

NOSEC（安全讯息平台）：iso60001：Nmap中一些常用的NSE脚本

博客园：lyshark：Nmap基础命令

博客园：曾是土木人：Nmap命令的29个实用范例

一、Nmap简介

Nmap是安全渗透领域最强大的开源端口扫描器，能跨平台支持运行。

官网：Https://nmap.org/

官网：http://sectools.org/

二、扫描示例

使用主机名扫描：

  1. [root@server1 ~]# nmap server2.tecmint.com
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:42 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.415 seconds
  16. You have new mail in /var/spool/mail/root

使用IP地址扫描：

  1. [root@server1 ~]# nmap 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 11:04 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 958/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.465 seconds
  16. You have new mail in /var/spool/mail/root

扫描多台主机：

在Nmap命令后加上多个IP地址或主机名来扫描多台主机。

  1. [root@server1 ~]# nmap 192.168.0.101 192.168.0.102 192.168.0.103
  2. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:06 EST
  3. Interesting ports on server2.tecmint.com (192.168.0.101):
  4. Not shown: 1674 closed ports
  5. PORT     STATE SERVICE
  6. 22/tcp   open  ssh
  7. 80/tcp   open  http
  8. 111/tcp  open  rpcbind
  9. 957/tcp  open  unknown
  10. 3306/tcp open  mysql
  11. 8888/tcp open  sun-answerbook
  12. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  13. Nmap finished: 3 IP addresses (1 host up) scanned in 0.580 seconds

扫描整个子网

可以使用*通配符来扫描整个子网或某个范围的IP地址。

  1. [root@server1 ~]# nmap 192.168.0.*
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:11 EST
  4. Interesting ports on server1.tecmint.com (192.168.0.100):
  5. Not shown: 1677 closed ports
  6. PORT    STATE SERVICE
  7. 22/tcp  open  ssh
  8. 111/tcp open  rpcbind
  9. 851/tcp open  unknown
  11. Interesting ports on server2.tecmint.com (192.168.0.101):
  12. Not shown: 1674 closed ports
  13. PORT     STATE SERVICE
  14. 22/tcp   open  ssh
  15. 80/tcp   open  http
  16. 111/tcp  open  rpcbind
  17. 957/tcp  open  unknown
  18. 3306/tcp open  mysql
  19. 8888/tcp open  sun-answerbook
  20. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  22. Nmap finished: 256 IP addresses (2 hosts up) scanned in 5.550 seconds
  23. You have new mail in /var/spool/mail/root

使用IP地址的最后一个字节扫描多台服务器

可以简单的指定IP地址的最后一个字节来对多个IP地址进行扫描。例如，我在下面执行中扫描了IP地址192.168.0.101，192.168.0.102和192.168.0.103。

  1. [root@server1 ~]# nmap 192.168.0.101,102,103
  2. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:09 EST
  3. Interesting ports on server2.tecmint.com (192.168.0.101):
  4. Not shown: 1674 closed ports
  5. PORT     STATE SERVICE
  6. 22/tcp   open  ssh
  7. 80/tcp   open  http
  8. 111/tcp  open  rpcbind
  9. 957/tcp  open  unknown
  10. 3306/tcp open  mysql
  11. 8888/tcp open  sun-answerbook
  12. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14. Nmap finished: 3 IP addresses (1 host up) scanned in 0.552 seconds
  15. You have new mail in /var/spool/mail/root

从一个文件中扫描主机列表

如果你有多台主机需要扫描且所有主机信息都写在一个文件中，那么你可以直接让nmap读取该文件来执行扫描，让我们来看看如何做到这一点。

创建一个名为“nmaptest.txt ”的文本文件，并定义所有你想要扫描的服务器IP地址或主机名。

  1. [root@server1 ~]# cat > nmaptest.txt
  2. localhost
  3. server2.tecmint.com
  4. 192.168.0.101

接下来运行带“iL” 选项的nmap命令来扫描文件中列出的所有IP地址：

  1. [root@server1 ~]# nmap -iL nmaptest.txt
  2. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 10:58 EST
  3. Interesting ports on localhost.localdomain (127.0.0.1):
  4. Not shown: 1675 closed ports
  5. PORT    STATE SERVICE
  6. 22/tcp  open  ssh
  7. 25/tcp  open  smtp
  8. 111/tcp open  rpcbind
  9. 631/tcp open  ipp
  10. 857/tcp open  unknown
  12. Interesting ports on server2.tecmint.com (192.168.0.101):
  13. Not shown: 1674 closed ports
  14. PORT     STATE SERVICE
  15. 22/tcp   open  ssh
  16. 80/tcp   open  http
  17. 111/tcp  open  rpcbind
  18. 958/tcp  open  unknown
  19. 3306/tcp open  mysql
  20. 8888/tcp open  sun-answerbook
  21. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  22. Interesting ports on server2.tecmint.com (192.168.0.101):
  23. Not shown: 1674 closed ports
  24. PORT     STATE SERVICE
  25. 22/tcp   open  ssh
  26. 80/tcp   open  http
  27. 111/tcp  open  rpcbind
  28. 958/tcp  open  unknown
  29. 3306/tcp open  mysql
  30. 8888/tcp open  sun-answerbook
  31. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  32. Nmap finished: 3 IP addresses (3 hosts up) scanned in 2.047 seconds

扫描一个IP地址范围

以在nmap执行扫描时指定IP范围。

  1. [root@server1 ~]# nmap 192.168.0.101-110
  2. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:09 EST
  3. Interesting ports on server2.tecmint.com (192.168.0.101):
  4. Not shown: 1674 closed ports
  5. PORT     STATE SERVICE
  6. 22/tcp   open  ssh
  7. 80/tcp   open  http
  8. 111/tcp  open  rpcbind
  9. 957/tcp  open  unknown
  10. 3306/tcp open  mysql
  11. 8888/tcp open  sun-answerbook
  12. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  13. Nmap finished: 10 IP addresses (1 host up) scanned in 0.542 seconds

排除一些远程主机后再扫描

在执行全网扫描或用通配符扫描时你可以使用“-exclude”选项来排除某些你不想要扫描的主机。

  1. [root@server1 ~]# nmap 192.168.0.* --exclude 192.168.0.100
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:16 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  15. Nmap finished: 255 IP addresses (1 host up) scanned in 5.313 seconds
  16. You have new mail in /var/spool/mail/root

扫描操作系统信息和路由跟踪

使用Nmap，你可以检测远程主机上运行的操作系统和版本。为了启用操作系统和版本检测，脚本扫描和路由跟踪功能，我们可以使用NMAP的“-A“选项。

  1. [root@server1 ~]# nmap -A 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:25 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE VERSION
  7. 22/tcp   open  ssh     OpenSSH 4.3 (protocol 2.0)
  8. 80/tcp   open  http    Apache httpd 2.2.3 ((CentOS))
  9. 111/tcp  open  rpcbind  2 (rpc #100000)
  10. 957/tcp  open  status   1 (rpc #100024)
  11. 3306/tcp open  mysql   MySQL (unauthorized)
  12. 8888/tcp open  http    lighttpd 1.4.32
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14. No exact OS matches for host (If you know what OS is running on it, see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
  15. TCP/IP fingerprint:
  16. SInfo(V=4.11%P=i686-redhat-linux-gnu%D=11/11%Tm=52814B66%O=22%C=1%M=080027)
  17. TSeq(Class=TR%IPID=Z%TS=1000HZ)
  18. T1(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  19. T2(Resp=N)
  20. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  21. T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  22. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  23. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  24. T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  25. PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  27. Uptime 0.169 days (since Mon Nov 11 12:22:15 2013)
  29. Nmap finished: 1 IP address (1 host up) scanned in 22.271 seconds

从上面的输出你可以看到，Nmap显示出了远程主机操作系统的TCP / IP协议指纹，并且更加具体的显示出远程主机上的端口和服务。

启用Nmap的操作系统探测功能

使用选项“-O”和“-osscan-guess”也帮助探测操作系统信息。

  1. [root@server1 ~]# nmap -O server2.tecmint.com
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:40 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14. No exact OS matches for host (If you know what OS is running on it, see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
  15. TCP/IP fingerprint:
  16. SInfo(V=4.11%P=i686-redhat-linux-gnu%D=11/11%Tm=52815CF4%O=22%C=1%M=080027)
  17. TSeq(Class=TR%IPID=Z%TS=1000HZ)
  18. T1(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  19. T2(Resp=N)
  20. T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
  21. T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=Option -O and -osscan-guess also helps to discover OS
  22. R%Ops=)
  23. T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  24. T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
  25. T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
  26. PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)
  28. Uptime 0.221 days (since Mon Nov 11 12:22:16 2013)
  30. Nmap finished: 1 IP address (1 host up) scanned in 11.064 seconds
  31. You have new mail in /var/spool/mail/root

扫描主机侦测防火墙

扫描远程主机以探测该主机是否使用了包过滤器或防火墙。

  1. [root@server1 ~]# nmap -sA 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:27 EST
  4. All 1680 scanned ports on server2.tecmint.com (192.168.0.101) are UNfiltered
  5. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  7. Nmap finished: 1 IP address (1 host up) scanned in 0.382 seconds
  8. You have new mail in /var/spool/mail/root

扫描主机检测是否有防火墙保护

  1. [root@server1 ~]# nmap -PN 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:30 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.399 seconds

找出网络中的在线主机

使用“-sP”选项，我们可以简单的检测网络中有哪些在线主机，该选项会跳过端口扫描和其他一些检测。

  1. [root@server1 ~]# nmap -sP 192.168.0.*
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 11:01 EST
  4. Host server1.tecmint.com (192.168.0.100) appears to be up.
  5. Host server2.tecmint.com (192.168.0.101) appears to be up.
  6. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  7. Nmap finished: 256 IP addresses (2 hosts up) scanned in 5.109 seconds

执行快速扫描

使用“-F”选项执行一次快速扫描，仅扫描列在nmap-services文件中的端口而避开所有其它的端口。

  1. [root@server1 ~]# nmap -F 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:47 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1234 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 3306/tcp open  mysql
  11. 8888/tcp open  sun-answerbook
  12. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  14. Nmap finished: 1 IP address (1 host up) scanned in 0.322 seconds

顺序扫描端口：

  1. [root@server1 ~]# nmap -r 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:52 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.363 seconds

扫描特定的端口：

使用Nmap扫描远程机器的端口有各种选项，你可以使用“-P”选项指定你想要扫描的端口，默认情况下nmap只扫描TCP端口。

  1. [root@server1 ~]# nmap -p 80 server2.tecmint.com
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:12 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. PORT   STATE SERVICE
  6. 80/tcp open  http
  7. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  9. Nmap finished: 1 IP address (1 host up) sca

扫描TCP端口：

  1. [root@server1 ~]# nmap -p T:8888,80 server2.tecmint.com
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:15 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. PORT     STATE SERVICE
  6. 80/tcp   open  http
  7. 8888/tcp open  sun-answerbook
  8. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  10. Nmap finished: 1 IP address (1 host up) scanned in 0.157 seconds

扫描UDP端口：

  1. [root@server1 ~]# nmap -sU 53 server2.tecmint.com
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:15 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. PORT     STATE SERVICE
  6. 53/udp   open  http
  7. 8888/udp open  sun-answerbook
  8. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  10. Nmap finished: 1 IP address (1 host up) scanned in 0.157 seconds

扫描多个端口：

可以使用选项“-P”来扫描多个端口。

  1. [root@server1 ~]# nmap -p 80,443 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 10:56 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. PORT    STATE  SERVICE
  6. 80/tcp  open   http
  7. 443/tcp closed https
  8. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  10. Nmap finished: 1 IP address (1 host up) scanned in 0.190 seconds

扫描指定范围内的端口：

可以使用表达式来扫描某个范围内的端口。

  1. [root@server1 ~]#  nmap -p 80-160 192.168.0.101

使用TCP Syn扫描最常用的端口：

  1. [root@server1 ~]# nmap -sT 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:12 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.406 seconds
  16. You have new mail in /var/spool/mail/root

打印主机接口和路由

使用nmap的“–iflist”选项检测主机接口和路由信息。

  1. [root@server1 ~]# nmap --iflist
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:07 EST
  4. ************************INTERFACES************************
  5. DEV  (SHORT) IP/MASK          TYPE     UP MAC
  6. lo   (lo)    127.0.0.1/8      loopback up
  7. eth0 (eth0)  192.168.0.100/24 ethernet up 08:00:27:11:C7:89
  9. **************************ROUTES**************************
  10. DST/MASK      DEV  GATEWAY
  11. 192.168.0.0/0 eth0
  12. 169.254.0.0/0 eth0

版本扫描

查找主机服务版本号：

  1. [root@server1 ~]# nmap -sV 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:48 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE VERSION
  7. 22/tcp   open  ssh     OpenSSH 4.3 (protocol 2.0)
  8. 80/tcp   open  http    Apache httpd 2.2.3 ((CentOS))
  9. 111/tcp  open  rpcbind  2 (rpc #100000)
  10. 957/tcp  open  status   1 (rpc #100024)
  11. 3306/tcp open  mysql   MySQL (unauthorized)
  12. 8888/tcp open  http    lighttpd 1.4.32
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  15. Nmap finished: 1 IP address (1 host up) scanned in 12.624 seconds

使用TCP ACK (PA)和TCP Syn (PS)扫描远程主机

有时候包过滤防火墙会阻断标准的ICMP ping请求，在这种情况下，我们可以使用TCP ACK和TCP Syn方法来扫描远程主机。

  1. [root@server1 ~]# nmap -PS 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:51 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.360 seconds
  16. You have new mail in /var/spool/mail/root

使用TCP ACK扫描远程主机上特定的端口

  1. [root@server1 ~]# nmap -PA -p 22,80 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:02 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. PORT   STATE SERVICE
  6. 22/tcp open  ssh
  7. 80/tcp open  http
  8. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  10. Nmap finished: 1 IP address (1 host up) scanned in 0.166 seconds
  11. You have new mail in /var/spool/mail/root

使用TCP Syn扫描远程主机上特定的端口

  1. [root@server1 ~]# nmap -PS -p 22,80 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:08 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. PORT   STATE SERVICE
  6. 22/tcp open  ssh
  7. 80/tcp open  http
  8. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  10. Nmap finished: 1 IP address (1 host up) scanned in 0.165 seconds
  11. You have new mail in /var/spool/mail/root

执行一次隐蔽的扫描

  1. [root@server1 ~]# nmap -sS 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:10 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE SERVICE
  7. 22/tcp   open  ssh
  8. 80/tcp   open  http
  9. 111/tcp  open  rpcbind
  10. 957/tcp  open  unknown
  11. 3306/tcp open  mysql
  12. 8888/tcp open  sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  15. Nmap finished: 1 IP address (1 host up) scanned in 0.383 seconds
  16. You have new mail in /var/spool/mail/root

执行TCP空扫描以骗过防火墙

  1. [root@server1 ~]# nmap -sN 192.168.0.101
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 19:01 EST
  4. Interesting ports on server2.tecmint.com (192.168.0.101):
  5. Not shown: 1674 closed ports
  6. PORT     STATE         SERVICE
  7. 22/tcp   open|filtered ssh
  8. 80/tcp   open|filtered http
  9. 111/tcp  open|filtered rpcbind
  10. 957/tcp  open|filtered unknown
  11. 3306/tcp open|filtered mysql
  12. 8888/tcp open|filtered sun-answerbook
  13. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  15. Nmap finished: 1 IP address (1 host up) scanned in 1.584 seconds
  16. You have new mail in /var/spool/mail/root

扫描使用“-v”选项

  1. [root@server1 ~]# nmap -v server2.tecmint.com
  3. Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:43 EST
  4. Initiating ARP Ping Scan against 192.168.0.101 [1 port] at 15:43
  5. The ARP Ping Scan took 0.01s to scan 1 total hosts.
  6. Initiating SYN Stealth Scan against server2.tecmint.com (192.168.0.101) [1680 ports] at 15:43
  7. Discovered open port 22/tcp on 192.168.0.101
  8. Discovered open port 80/tcp on 192.168.0.101
  9. Discovered open port 8888/tcp on 192.168.0.101
  10. Discovered open port 111/tcp on 192.168.0.101
  11. Discovered open port 3306/tcp on 192.168.0.101
  12. Discovered open port 957/tcp on 192.168.0.101
  13. The SYN Stealth Scan took 0.30s to scan 1680 total ports.
  14. Host server2.tecmint.com (192.168.0.101) appears to be up ... good.
  15. Interesting ports on server2.tecmint.com (192.168.0.101):
  16. Not shown: 1674 closed ports
  17. PORT     STATE SERVICE
  18. 22/tcp   open  ssh
  19. 80/tcp   open  http
  20. 111/tcp  open  rpcbind
  21. 957/tcp  open  unknown
  22. 3306/tcp open  mysql
  23. 8888/tcp open  sun-answerbook
  24. MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
  26. Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds
  27.                Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)

脚本扫描

  1. /usr/shar/nmap/scripts#
  2. nmap --script=default 192.168.106.1
  3. nmap --script=auth 192.168.106.1
  4. nmap --script=brute 192.168.106.1
  5. nmap --script=vuln 192.168.106.1
  6. nmap --script=broadcast 192.168.106.1
  7. nmap --script=smb-brute.nse 192.168.106.1
  8. nmap --script=smb-check-vulns.nse --script-args=unsafe=1 192.168.106.1
  9. nmap --script=smb-vuln-conficker.nse --script-args=unsafe=1 192.168.106.1
  10. nmap -p3306 --script=mysql-empty-password.nse 192.168.106.1

三、Nmap图形化界面-Zenmap

3.1 Intense scan

Nmap -T4 -A -v 192.168.106.1

  • -T 设置速度登记，1到5级，数字越大，速度越快
  • -A 综合扫描
  • -v 输出扫描过程

3.2 Intense scan plus UDP

Nmap -sS -sU -T4 -A -v 192.168.106.1

  • -sS TCP全连接扫描
  • -sU UDP扫描

3.3 Intense scan,all TCP ports

Nmap -p 65535 -T4 -A -v 192.168.106.1

  • -p 指定端口范围，默认扫描1000个端口

3.4 Intense scan no ping

Nmap -T4 -A -v -Pn 192.168.106.1/24

  • -Pn 不做ping扫描，例如针对防火墙等安全产品

3.5 ping scan

Nmap -sn 192.168.106.1/24

Nmap -sn -T4 -v 192.168.106.1/24

  • -sn 只做ping扫描，不做端口扫描

3.6 quick scan

Nmap -T4 -F 192.168.106.1

  • -F fast模式，只扫描常见服务端口，比默认端口（1000个）还少

3.7 quick scan plus

Nmap -sV -T4 -O -F --version-light 192.168.106.1

  • -sV 扫描系统和服务版本
  • -O 扫描操作系统版本

3.8 Quick traceroute

Nmap -sn --traceroute www.baidu.com

3.9 Regular scan

Nmap www.baidu.com

3.10 slow comprehensive scan

Nmap -sS -sU -T4 -A -v -PE -PP -PS80,443 -PA3389 -PU40125 -PY -g 53 --script “default or (discovery and safe)” www.baidu.com

Web信息收集-目标扫描-Nmap的更多相关文章

  1. Web信息收集-目标扫描-OpenVAS

    Web信息收集-目标扫描-OpenVAS 一.OpenVAS简述 二.部署OpenVAS 2.1 升级Kali Linux 2.2 安装OpenVAS 2.3 修改admin账户密码 2.4 修改默认 ...

  2. Web信息收集之搜索引擎-GoogleHacking

    Web信息收集之搜索引擎-GoogleHacking 一.信息收集概述 二.Google Hacking 2.1 site 2.2 filetype 2.3 inurl 2.4 intitle 2.5 ...

  3. Web信息收集之搜索引擎-Shodan Hacking

    Web信息收集之搜索引擎-Shodan Hacking 一.Shodan Hacking简介 1.1 ip 1.2 Service/protocol 1.3 Keyword 1.4 Cuuntry 1 ...

  4. Web信息收集之搜索引擎-Zoomeye Hacking

    Web信息收集之搜索引擎-Zoomeye Hacking https://www.zoomeye.org ZoomEye(钟馗之眼)是一个面向网络空间的搜索引擎,"国产的Shodan&quo ...

  5. ssh远程端口转发&&windows系统提权之信息收集&&网安工具分享(部分)

    一.ssh远程端口转发 背景:当我们在渗透过程中,获取到内网的一台仅有内网IP的服务器后,我们可以通过ssh隧道,将内网某个主机的端口进行远程转发 1.网络拓扑图 假设获取的服务器为web服务器,we ...

  6. APT 信息收集——shodan.io ,fofa.so、 MX 及 邮件。mx记录查询。censys.io查询子域名。

    信息收集 目标是某特殊机构,外网结构简单,防护严密.经探测发现其多个子机构由一家网站建设公司建设. 对子域名进行挖掘,确定目标ip分布范围及主要出口ip. 很多网站主站的访问量会比较大.往往主站都是挂 ...

  7. ★Kali信息收集★8.Nmap ：端口扫描

    ★Kali信息收集~ 0.Httrack 网站复制机 http://www.cnblogs.com/dunitian/p/5061954.html ★Kali信息收集~ 1.Google Hackin ...

  8. nmap 扫描信息收集

    1.端口镜像 port Mirroring 功能通过在交换机上或者路由器上,将一个或者多个源端口的数据流量妆发大奥某一个指定的端口来实现对网络的监听,指定端口成为镜像端口或目的端口. 2.ARP攻击捕 ...

  9. nmap扫描、信息收集（网安全实训第一天）

    本期内容:网站信息收集.nmap扫描 1. 信息收集 2. nmap扫描1.信息收集 (1)确定目标 首先,我们确定攻击目标,在这里,我们随便找一个网站做测试,我以码云为例. (2)nslookup查 ...

随机推荐

  1. 常用的linux指令

    a.cd /home 进入 '/ home' 目录' b.cd .. 返回上一级目录 c.cd ../.. 返回上两级目录 d.mkdir dir1 创建一个叫做 'dir1' 的目录' e.mkdi ...

  2. 原生小程序中实现将scss文件实时编译为wxss文件

    参考链接 全局安装gulp,方便以后直接执行gulp命令 npm install gulp -g 用原生小程序新建一个项目 在小程序根目录(app.js同级目录)中新建package.json文件 n ...

  3. 一个关于JVM类初始化问题

    刚在看虚拟机相关知识点 看到一段代码,大家猜测一下这段代码会触发子类初始化吗 public class SuperClass{ static{ system.out.println("Sup ...

  4. git merge了错误分支，如何优雅的回退到merge前的状态？

    git merge了错误分支,如何优雅的回退到merge前的状态? 没push的话 git reset --hard (a分支5点那个时候commit之后的sha1) 然后重新 git merge

  5. istio kiali 亲和性调度

    一.节点调度 在开始 kiali 亲和性调度之前,先演示一个简单的例子介绍 pod 选择调度到指定 node: 节点打标 使用命令查看当前所有 k8s 节点: [root@k8s-master ~]# ...

  6. Spring Boot 2.x基础教程：实现文件上传

    文件上传的功能实现是我们做Web应用时候最为常见的应用场景,比如:实现头像的上传,Excel文件数据的导入等功能,都需要我们先实现文件的上传,然后再做图片的裁剪,excel数据的解析入库等后续操作. ...

  7. 使用Spring中@Async注解实现异步调用

    异步调用? 在解释异步调用之前,我们先来看同步调用的定义:同步就是整个处理过程顺序执行,当各个过程都执行完毕,并返回结果. 异步调用则是只是发送了调用的指令,调用者无需等待被调用的方法完全执行完毕,继 ...

  8. Python基础语法2-数据类型

    一,数字. 2. 字符串类型 3.列表 4.元组 5.集合 6.字典 7.数据类型转换: 8.序列操作

  9. FlatBuffers使用小结

    最近做一个Android APP,由于离线业务需求,需要在启动APP时候同步大量数据到APP上,遇到了JSON性能瓶颈.从下方的图片中可以看出,当使用 json 传输数据,在解析json的时候会产生大 ...

  10. QPinter 常用绘制图像的方法

    阅读本文大概需要 3 分钟 我们在开发软件的过程中,绘制图像功能必不可少,使用 Qt 绘制图像时非常简单,只需要传递几个参数就可以实现功能,在 Qt 中绘制图像的 api有好几个 void drawI ...