nmap 使用

Network Mapper，(最早是Linux下的网络扫描和嗅探工具包)是一个网络连接端扫描软件，用来扫描网上电脑开放的网络连接端。确定哪些服务运行在哪些连接端，并且推断计算机运行哪个操作系统。

基本功能：

• 主机发现，检测目标主机是否在线
• 端口扫描，检测端口状态和提供的服务
• 版本检测，检测端口提供服务的包或软件的版本信息
• 操作系统侦测，检测主机使用的操作系统

对特定ip进行扫描

如下，PORT 下的列表 ，表示扫描主机端口 ， STATE 表示扫描主机的端口是否开放，SERVICE 表示扫描主机的服务名

[root@kevin ~]# nmap 192.168.1.105
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-21 15:37 CST
Nmap scan report for 192.168.1.105
Host is up (0.028s latency).
Not shown: 991 filtered ports
PORT     STATE  SERVICE
22/tcp   open   ssh
80/tcp   open   http
88/tcp   closed kerberos-sec
443/tcp  closed https
1199/tcp open   dmidi
8080/tcp closed http-proxy
9001/tcp open   tor-orport
9003/tcp closed unknown
9200/tcp closed wap-wsp

Nmap done: 1 IP address (1 host up) scanned in 4.43 seconds
[root@kevin ~]# 

对多个连续的主机进行扫描

如下，扫描 ip为 192.168.0100 ~ 192.168.0.200 的主机，其中，有三台主机是 up,分别为 192.168.0.100，192.168.0.101，192.168.0.102。 在最后的一行 Nmap done： 101 IP address ,表示，共扫码了101个ip， (3 hosts up) 表示 有3台host是up状态， scanned in 67.62 seconds 表示扫码耗时。

[root@kevin ~]# nmap 192.168.0.100-200
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-21 15:39 CST
Nmap scan report for 192.168.0.100
Host is up (0.0054s latency).
All 1000 scanned ports on 192.168.0.100 are closed
MAC Address: D8:96:95:F3:B0:6B (Apple)

Nmap scan report for 192.168.0.101
Host is up (0.11s latency).
All 1000 scanned ports on 192.168.0.101 are filtered
MAC Address: B0:46:92:2B:24:A1 (Unknown)

Nmap scan report for 192.168.0.102
Host is up (0.0000040s latency).
Not shown: 991 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
53/tcp   open  domain
80/tcp   open  http
111/tcp  open  rpcbind
2049/tcp open  nfs
3306/tcp open  mysql
8081/tcp open  blackice-icecap
8873/tcp open  dxspider
9200/tcp open  wap-wsp

Nmap done: 101 IP addresses (3 hosts up) scanned in 67.62 seconds
[root@kevin ~]#

扫描对应端口运行的服务版本

加 -sV 参数

[root@kevin ~]# nmap -sV 192.168.0.102
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-21 15:44 CST
WARNING: Service 192.168.0.102:9200 had already soft-matched rtsp, but now soft-matched sip; ignoring second value
Nmap scan report for 192.168.0.102
Host is up (0.000016s latency).
Not shown: 991 closed ports
PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 8.7 (protocol 2.0)
53/tcp   open  domain   (unknown banner: 9.16.23-RH)
80/tcp   open  http     nginx 1.20.1
111/tcp  open  rpcbind  2-4 (RPC #100000)
2049/tcp open  nfs_acl  3 (RPC #100227)
3306/tcp open  mysql    MySQL 8.0.28
8081/tcp open  http     Jetty 9.4.43.v20210629
8873/tcp open  http     Jetty 9.4.43.v20210629
Nmap done: 1 IP address (1 host up) scanned in 21.78 seconds

扫描操作系统的版本

加参数 -O ，如下 OS details

[root@kevin ~]# nmap -O 192.168.0.102
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-21 15:47 CST
Nmap scan report for 192.168.0.102
Host is up (0.00016s latency).
Not shown: 991 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
53/tcp   open  domain
80/tcp   open  http
111/tcp  open  rpcbind
2049/tcp open  nfs
3306/tcp open  mysql
8081/tcp open  blackice-icecap
8873/tcp open  dxspider
9200/tcp open  wap-wsp
Device type: general purpose
Running: Linux 2.6.X
OS CPE: cpe:/o:linux:linux_kernel:2.6.32
OS details: Linux 2.6.32
Network Distance: 0 hops

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.91 seconds
[root@kevin ~]#

扫描主机特定端口

加 -p 参数，可以指定一个端口，如(nmap -p 80 192.168.0.102)，也可以指定区间端口，如(nmap -p 80-8080 192.168.0.102)

[root@kevin ~]# nmap -p 80 192.168.0.102
Starting Nmap 7.91 ( https://nmap.org ) at 2022-05-21 15:48 CST
Nmap scan report for 192.168.0.102
Host is up (0.000044s latency).

PORT   STATE SERVICE
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds
[root@kevin ~]#