Network Mapper,(最早是Linux下的网络扫描和嗅探工具包)是一个网络连接端扫描软件,用来扫描网上电脑开放的网络连接端。确定哪些服务运行在哪些连接端,并且推断计算机运行哪个操作系统。
基本功能:
- 主机发现,检测目标主机是否在线
- 端口扫描,检测端口状态和提供的服务
- 版本检测,检测端口提供服务的包或软件的版本信息
- 操作系统侦测,检测主机使用的操作系统
对特定ip进行扫描
如下,PORT 下的列表 ,表示扫描主机端口 , STATE 表示扫描主机的端口是否开放,SERVICE 表示扫描主机的服务名
[root@kevin ~]# nmap 192.168.1.105
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-21 15:37 CST
Nmap scan report for 192.168.1.105
Host is up (0.028s latency).
Not shown: 991 filtered ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
88/tcp closed kerberos-sec
443/tcp closed https
1199/tcp open dmidi
8080/tcp closed http-proxy
9001/tcp open tor-orport
9003/tcp closed unknown
9200/tcp closed wap-wsp
Nmap done: 1 IP address (1 host up) scanned in 4.43 seconds
[root@kevin ~]#
对多个连续的主机进行扫描
如下,扫描 ip为 192.168.0100 ~ 192.168.0.200 的主机,其中,有三台主机是 up,分别为
192.168.0.100,192.168.0.101,192.168.0.102
。 在最后的一行 Nmap done: 101 IP address ,表示,共扫码了101个ip, (3 hosts up) 表示 有3台host是up状态, scanned in 67.62 seconds 表示扫码耗时。
[root@kevin ~]# nmap 192.168.0.100-200
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-21 15:39 CST
Nmap scan report for 192.168.0.100
Host is up (0.0054s latency).
All 1000 scanned ports on 192.168.0.100 are closed
MAC Address: D8:96:95:F3:B0:6B (Apple)
Nmap scan report for 192.168.0.101
Host is up (0.11s latency).
All 1000 scanned ports on 192.168.0.101 are filtered
MAC Address: B0:46:92:2B:24:A1 (Unknown)
Nmap scan report for 192.168.0.102
Host is up (0.0000040s latency).
Not shown: 991 closed ports
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
80/tcp open http
111/tcp open rpcbind
2049/tcp open nfs
3306/tcp open mysql
8081/tcp open blackice-icecap
8873/tcp open dxspider
9200/tcp open wap-wsp
Nmap done: 101 IP addresses (3 hosts up) scanned in 67.62 seconds
[root@kevin ~]#
扫描对应端口运行的服务版本
加 -sV 参数
[root@kevin ~]# nmap -sV 192.168.0.102
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-21 15:44 CST
WARNING: Service 192.168.0.102:9200 had already soft-matched rtsp, but now soft-matched sip; ignoring second value
Nmap scan report for 192.168.0.102
Host is up (0.000016s latency).
Not shown: 991 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.7 (protocol 2.0)
53/tcp open domain (unknown banner: 9.16.23-RH)
80/tcp open http nginx 1.20.1
111/tcp open rpcbind 2-4 (RPC #100000)
2049/tcp open nfs_acl 3 (RPC #100227)
3306/tcp open mysql MySQL 8.0.28
8081/tcp open http Jetty 9.4.43.v20210629
8873/tcp open http Jetty 9.4.43.v20210629
Nmap done: 1 IP address (1 host up) scanned in 21.78 seconds
扫描操作系统的版本
加参数 -O ,如下 OS details
[root@kevin ~]# nmap -O 192.168.0.102
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-21 15:47 CST
Nmap scan report for 192.168.0.102
Host is up (0.00016s latency).
Not shown: 991 closed ports
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
80/tcp open http
111/tcp open rpcbind
2049/tcp open nfs
3306/tcp open mysql
8081/tcp open blackice-icecap
8873/tcp open dxspider
9200/tcp open wap-wsp
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
Network Distance: 0 hops
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.91 seconds
[root@kevin ~]#
扫描主机特定端口
加 -p 参数,可以指定一个端口,如(nmap -p 80 192.168.0.102),也可以指定区间端口,如(nmap -p 80-8080 192.168.0.102)
[root@kevin ~]# nmap -p 80 192.168.0.102
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-21 15:48 CST
Nmap scan report for 192.168.0.102
Host is up (0.000044s latency).
PORT STATE SERVICE
80/tcp open http
Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds
[root@kevin ~]#