Linux命令之nmap端口扫描工具

最新推荐文章于 2024-07-12 11:04:53 发布

zhaixing_0307

最新推荐文章于 2024-07-12 11:04:53 发布

阅读量6.7k

点赞数 3

分类专栏： Linux相关

本文链接：https://blog.csdn.net/weixin_43931358/article/details/103597356

版权

Linux相关专栏收录该内容

7 篇文章 1 订阅

订阅专栏

Linux命令之nmap端口扫描工具

介绍

https://nmap.org/man/zh/
Nmap (“Network Mapper(网络映射器)”) 是一款开放源代码的网络探测和安全审核的工具。
它的设计目标是快速地扫描大型网络，当然用它扫描单个主机也没有问题。
Nmap以新颖的方式使用原始IP报文：

来发现网络上有哪些主机
那些主机提供什么服务(应用程序名和版本)
那些服务运行在什么操作系统(包括版本信息)
它们使用什么类型的报文过滤器/防火墙
以及一堆其它功能

虽然Nmap通常用于安全审核，许多系统管理员和网络管理员也用它来做一些日常的工作，比如查看整个网络的信息，管理服务升级计划，以及监视主机和服务的运行。
Nmap输出的是扫描目标的列表，以及每个目标的补充信息，至于是哪些信息则依赖于所使用的选项。 “所感兴趣的端口表格”是其中的关键。那张表列出端口号，协议，服务名称和状态。
nmap的状态有4种
可能是 open(开放的)，filtered(被过滤的)， closed(关闭的)，或者unfiltered(未被过滤的)。

Open(开放的)意味着目标机器上的应用程序正在该端口监听连接/报文。
filtered(被过滤的) 意味着防火墙，过滤器或者其它网络障碍阻止了该端口被访问，Nmap无法得知它是 open(开放的) 还是 closed(关闭的)。
closed(关闭的) 端口没有应用程序在它上面监听，但是他们随时可能开放。
unfiltered(未被过滤的)端口对Nmap的探测做出响应，但是Nmap无法确定它们是关闭还是开放。

如果Nmap报告状态组合 open|filtered 和 closed|filtered时，那说明Nmap无法确定该端口处于两个状态中的哪一个状态。

当要求进行版本探测时，端口表也可以包含软件的版本信息。
当要求进行IP协议扫描时 (-sO)，Nmap提供关于所支持的IP协议而不是正在监听的端口的信息。
除了所感兴趣的端口表，Nmap还能提供关于目标机的进一步信息，包括反向域名，操作系统猜测，设备类型，和MAC地址。

安装nmap

yum install -y nmap

nmap帮助

[root@localhost ~]# nmap -h

== TARGET SPECIFICATION 目标说明
可用: 主机名, Ipv4, IPv6, CIDR, 八位字节范围, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iL <inputfilename>: Input from list of hosts/networks //从<文件>列表中读取目标
-iR <num hosts>: Choose random targets //随机选择目标
--exclude <host1[,host2][,host3],...>: Exclude hosts/networks //排除主机/网络
--excludefile <exclude_file>: Exclude list from file //排除<文件>中的列表
== HOST DISCOVERY 主机发现
-sL: List Scan - simply list targets to scan //列表扫描，仅列出网络上的主机，不发送任何报文。
-sn: Ping Scan - disable port scan //ping，不扫描端口。
-Pn: Treat all hosts as online -- skip host discovery
-PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO[protocol list]: IP Protocol Ping
-n/-R: Never do DNS resolution/Always resolve [default: sometimes] //不用域名解析
--dns-servers <serv1[,serv2],...>: Specify custom DNS servers
--system-dns: Use OS's DNS resolver //使用系统域名解析器
--traceroute: Trace hop path to each host
== SCAN TECHNIQUES[https://nmap.org/man/zh/man-port-scanning-techniques.html](https://nmap.org/man/zh/man-port-scanning-techniques.html)
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sU: UDP Scan
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags <flags>: Customize TCP scan flags //定制的TCP扫描
-sI <zombie host[:probeport]>: Idle scan //[https://nmap.org/book/idlescan.html](https://nmap.org/book/idlescan.html)
-sY/sZ: SCTP INIT/COOKIE-ECHO scans
-sO: IP protocol scan //IP协议扫描
-b <FTP relay host>: FTP bounce scan //FTP弹跳扫描
== PORT SPECIFICATION AND SCAN ORDER //端口说明和扫描顺序
-p <port ranges>: Only scan specified ports //只扫描指定端口
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
--exclude-ports <port ranges>: Exclude the specified ports from scanning
-F: Fast mode - Scan fewer ports than the default scan //快速扫描:nmap-services约1200个
-r: Scan ports consecutively - don't randomize //不要按随机顺序扫描端口
--top-ports <number>: Scan <number> most common ports
--port-ratio <ratio>: Scan ports more common than <ratio>
== SERVICE/VERSION DETECTION 服务和版本探测
nmap-service-probes 数据库包含查询不同服务的探测报文 和解析识别响应的匹配表达式。
-sV: Probe open ports to determine service/version info //版本探测(-A的一部分)
--version-intensity <level>: Set from 0 (light) to 9 (try all probes) //设置版本扫描强度，默认7
--version-light: Limit to most likely probes (intensity 2) //轻量级模式
--version-all: Try every single probe (intensity 9) //尝试每个探测
--version-trace: Show detailed version scan activity (for debugging) //跟踪版本扫描活动,--packet-trace的子集
== SCRIPT SCAN
-sC: equivalent to --script=default
--script=<Lua scripts>: <Lua scripts> is a comma separated list of directories, script-files or script-categories
--script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
--script-args-file=filename: provide NSE script args in a file
--script-trace: Show all data sent and received
--script-updatedb: Update the script database.
--script-help=<Lua scripts>: Show help about scripts.
<Lua scripts> is a comma-separated list of script-files or script-categories.
== OS DETECTION 操作系统探测
-O: Enable OS detection //启用操作系统检测（-A的一部分）
--osscan-limit: Limit OS detection to promising targets //针对指定的目标进行操作系统检测
--osscan-guess: Guess OS more aggressively //推测操作系统检测结果
== TIMING AND PERFORMANCE 时间和性能
改善扫描时间的技术有：忽略非关键的检测。优化时间参数也会带来实质性的变化，这些参数如下。
Options which take <time> are in seconds, or append 'ms' (milliseconds),
's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
-T<0-5>: Set timing template (higher is faster) //设置时间模板，T4 可以加快执行速度
　　paranoid (0)、sneaky (1)、polite (2)、normal(3)、 aggressive (4)和insane (5)。

- -T0: paranoid (0)模式用于IDS躲避，在一个时间只能扫描一个端口， 每个探测报文的发送间隔为5分钟。
- -T1: sneaky (1) 模式用于IDS躲避，T1和T2选项比较类似， 探测报文间隔分别为15秒和0.4秒。
- -T2: Polite (2) 模式降低了扫描 速度以使用更少的带宽和目标主机资源。
- -T3: Normal (3) (默认模式)，因此-T3 实际上是未做任何优化。包含了并行扫描。
- -T4: Aggressive (4) 模式假设用户具有合适及可靠的网络从而加速 扫描。最大TCP扫描延迟为10ms。
- -T5: Insane (5) 模式假设用户具有特别快的网络或者愿意为获得速度而牺牲准确性。最大延迟为5ms。

　　T4选项与 --max-rtt-timeout 1250 --initial-rtt-timeout 500 等价，
　　T5等价于 --max-rtt-timeout 300 --min-rtt-timeout 50 --initial-rtt-timeout 250 --host-timeout 900000，
--min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes //调整并行扫描组大小
--min-parallelism/max-parallelism <numprobes>: Probe parallelization //调整探测报文的并行度
--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies probe round trip time.
--max-retries <tries>: Caps number of port scan probe retransmissions.
--host-timeout <time>: Give up on target after this long //放弃低速目标主机
--scan-delay/--max-scan-delay <time>: Adjust delay between probes //调整探测报文的时间间隔
--min-rate <number>: Send packets no slower than <number> per second
--max-rate <number>: Send packets no faster than <number> per second
== FIREWALL/IDS EVASION AND SPOOFING 防火墙/IDS躲避和哄骗
-f; --mtu <val>: fragment packets (optionally w/given MTU) //报文分段，--mtu,使用指定MTU
-D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys //使用诱饵隐蔽扫描
-S <IP_Address>: Spoof source address //源地址哄骗
-e <iface>: Use specified interface //使用指定的接口
-g/--source-port <portnum>: Use given port number
--proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
--data <hex string>: Append a custom payload to sent packets
--data-string <string>: Append a custom ASCII string to sent packets
--data-length <num>: Append random data to sent packets //发送报文时，附加随机数据
--ip-options <options>: Send packets with specified ip options
--ttl <val>: Set IP time-to-live field //设置IP time-to-live域
--spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address //MAC地址哄骗
--badsum: Send packets with a bogus TCP/UDP/SCTP checksum
== OUTPUT 输出
-oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, and Grepable format, respectively, to the given filename. //oN,标准输出; oX,XML输出; oS,脚本输出; oG,Grep输出
-oA <basename>: Output in the three major formats at once //标准.nmap, .xml, .gnamp文件中
-v: Increase verbosity level (use -vv or more for greater effect) //更详细信息，
-d: Increase debugging level (use -dd or more for greater effect) //提高或设置调试级别
--reason: Display the reason a port is in a particular state
--open: Only show open (or possibly open) ports
--packet-trace: Show all packets sent and received //跟踪发送和接收的报文
--iflist: Print host interfaces and routes (for debugging) //列举接口和路由
--append-output: Append to rather than clobber specified output files //在输出文件中添加
--resume <filename>: Resume an aborted scan //继续中断的扫描
--stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML //设置XSL样式
--webxml: Reference stylesheet from Nmap.Org for more portable XML
--no-stylesheet: Prevent associating of XSL stylesheet w/XML output //忽略XML声明的XSL样式
== MISC 杂项
-6: Enable IPv6 scanning //启用IPv6扫描
-A: Enable OS detection, version detection, script scanning, and traceroute //激烈扫描模式选项
--datadir <dirname>: Specify custom Nmap data file location //说明用户Nmap数据文件位置
--send-eth/--send-ip: Send using raw ethernet frames or IP packets //使用原以太网帧发送或IP包
--privileged: Assume that the user is fully privileged //假定用户具有全部权限
--unprivileged: Assume the user lacks raw socket privileges
-V: Print version number
-h: Print this help summary page.
== EXAMPLES 示例
nmap -v -A scanme.nmap.org:
这个选项扫描主机scanme.nmap.org中 所有的保留TCP端口。选项-v启用细节模式。
[root@localhost ~]# nmap -v -A scanme.nmap.org
Starting Nmap 6.40 ( http://nmap.org ) at 2019-12-17 16:29 CST
NSE: Loaded 110 scripts for scanning.
NSE: Script Pre-scanning.
Initiating Ping Scan at 16:29
Scanning scanme.nmap.org (45.33.32.156) [4 ports]
Completed Ping Scan at 16:29, 0.16s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 16:29
Completed Parallel DNS resolution of 1 host. at 16:29, 0.19s elapsed
Initiating SYN Stealth Scan at 16:29
Scanning scanme.nmap.org (45.33.32.156) [1000 ports]
Discovered open port 80/tcp on 45.33.32.156
Discovered open port 22/tcp on 45.33.32.156
Discovered open port 9929/tcp on 45.33.32.156

nmap -v -sn 192.168.0.0/16 10.0.0.0/8:
nmap -v -iR 10000 -Pn -p 80:
SEE THE MAN PAGE: [nmap.org/book/man.html](https://www.cnblogs.com/sztom/p/nmap.org/book/man.html)

npam实例

1.nmap localhost #查看主机当前开放的端口

[root@localhost ~]# nmap localhost
Starting Nmap 6.40 ( http://nmap.org ) at 2019-12-17 16:41 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000050s latency).
Other addresses for localhost (not scanned): 127.0.0.1
rDNS record for 127.0.0.1: VM_0_3_centos
Not shown: 999 closed ports
PORT   STATE SERVICE
81/tcp open  hosts2-ns
Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds

2.-vv详细输出

[root@localhost ~]# nmap -vv 192.168.59.128
Starting Nmap 6.40 ( http://nmap.org ) at 2019-12-17 04:13 EST
Initiating ARP Ping Scan at 04:13
Scanning 192.168.59.128 [1 port]
Completed ARP Ping Scan at 04:13, 0.00s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 04:13
Completed Parallel DNS resolution of 1 host. at 04:13, 0.00s elapsed
Initiating SYN Stealth Scan at 04:13
Scanning 192.168.59.128 [1000 ports]
Discovered open port 22/tcp on 192.168.59.128
Discovered open port 111/tcp on 192.168.59.128
Discovered open port 9002/tcp on 192.168.59.128
Discovered open port 6000/tcp on 192.168.59.128
Discovered open port 5432/tcp on 192.168.59.128
Completed SYN Stealth Scan at 04:13, 0.03s elapsed (1000 total ports)
Nmap scan report for 192.168.59.128
Host is up (0.00011s latency).
Scanned at 2019-12-17 04:13:46 EST for 0s
Not shown: 995 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
111/tcp  open  rpcbind
5432/tcp open  postgresql
6000/tcp open  X11
9002/tcp open  dynamid
MAC Address: 00:0C:29:F1:DD:9C (VMware)
Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.06 seconds
          Raw packets sent: 1001 (44.028KB) | Rcvd: 1001 (40.048KB)

3.nmap -p 1024-65535 localhost #查看主机端口（1024-65535）中开放的端口

[root@localhost ~]# nmap -p 1024-65535 localhost
Starting Nmap 6.40 ( http://nmap.org ) at 2019-12-17 16:42 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000060s latency).
Other addresses for localhost (not scanned): 127.0.0.1
rDNS record for 127.0.0.1: VM_0_3_centos
Not shown: 64511 closed ports
PORT     STATE SERVICE
7011/tcp open  unknown
Nmap done: 1 IP address (1 host up) scanned in 0.86 seconds

4.nmap -PS 192.168.59.130 #探测目标主机开放的端口

[root@localhost ~]# nmap -PS 192.168.59.130
Starting Nmap 6.40 ( http://nmap.org ) at 2019-12-17 03:56 EST
Nmap scan report for localhost (192.168.59.130)
Host is up (0.0000020s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
9090/tcp open  zeus-admin
Nmap done: 1 IP address (1 host up) scanned in 0.03 seconds

5.nmap -p22,80,3306 192.168.59.128 #探测所列出的目标主机端口

[root@localhost ~]# nmap -p22,80,3306  192.168.59.128
Starting Nmap 6.40 ( http://nmap.org ) at 2019-12-17 04:11 EST
Nmap scan report for 192.168.59.128
Host is up (0.00036s latency).
PORT     STATE  SERVICE
22/tcp   open   ssh
80/tcp   closed http
3306/tcp closed mysql
MAC Address: 00:0C:29:F1:DD:9C (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.03 seconds

6.nmap -O 192.168.59.130 #探测目标主机操作系统类型（-O 是-A的一部分）

[root@localhost ~]# nmap -O 192.168.59.130
Starting Nmap 6.40 ( http://nmap.org ) at 2019-12-17 04:14 EST
Nmap scan report for localhost (192.168.59.130)
Host is up (0.000023s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
9090/tcp open  zeus-admin
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.7 - 3.9
Network Distance: 0 hops
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.49 seconds

7.nmap -sP 192.168.59.130 #探测目标主机在线状况（ping检测）

[root@localhost ~]# nmap -sP 192.168.59.130
Starting Nmap 6.40 ( http://nmap.org ) at 2019-12-17 04:19 EST
Nmap scan report for localhost (192.168.59.130)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds

8.nmap -sV -O localhost #探测目标主机操作系统类型、端口服务名称、版本信息

[root@localhost ~]# nmap -sV -O localhost
Starting Nmap 6.40 ( http://nmap.org ) at 2019-12-17 17:21 CST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000048s latency).
Other addresses for localhost (not scanned): 127.0.0.1
rDNS record for 127.0.0.1: VM_0_3_centos
Not shown: 999 closed ports
PORT   STATE SERVICE VERSION
81/tcp open  http    nginx 1.16.1
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.7 - 3.9
Network Distance: 0 hops
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.72 seconds

9.路由跟踪

nmap -traceroute <target ip>
[root@localhost ~]# nmap -traceroute 192.168.59.128
Starting Nmap 6.40 ( http://nmap.org ) at 2019-12-17 04:24 EST
Nmap scan report for 192.168.59.128
Host is up (0.000074s latency).
Not shown: 995 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
111/tcp  open  rpcbind
5432/tcp open  postgresql
6000/tcp open  X11
9002/tcp open  dynamid
MAC Address: 00:0C:29:F1:DD:9C (VMware)
TRACEROUTE
HOP RTT     ADDRESS
1   0.07 ms 192.168.59.128
Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds

常见服务端口

服务	端口号
HTTP	80
HTTPS	443
Telnet	23
FTP	21
SSH（安全登录）、SCP（文件传输）、端口重定向	22
SMTP	25
POP3	110
WebLogic	7001
TOMCAT	8080
WIN2003远程登录	3389
Oracle数据库	1521
MS SQL* SEVER数据库sever	1433
MySQL 数据库sever	3306

nmap –T4 –A –v

其中-A选项用于使用进攻性（Aggressive）方式扫描；-T4指定扫描过程使用的时序（Timing），总有6个级别（0-5），级别越高，扫描速度越快，但也容易被防火墙或IDS检测并屏蔽掉，在网络通讯状况良好的情况推荐使用T4；-v表示显示冗余（verbosity）信息，在扫描过程中显示扫描的细节，从而让用户了解当前的扫描状态。

zhaixing_0307

关注

3
点赞
踩
28

收藏

觉得还不错? 一键收藏
打赏
0
评论
Linux命令之nmap端口扫描工具

Linux命令之nmap端口扫描工具介绍https://nmap.org/man/zh/Nmap (“Network Mapper(网络映射器)”) 是一款开放源代码的网络探测和安全审核的工具。它的设计目标是快速地扫描大型网络，当然用它扫描单个主机也没有问题。Nmap以新颖的方式使用原始IP报文：来发现网络上有哪些主机那些主机提供什么服务(应用程序名和版本)那些服务运行在什么操...
复制链接

扫一扫