{"id":607,"date":"2012-12-16T14:17:00","date_gmt":"2012-12-16T06:17:00","guid":{"rendered":"http:\/\/note.systw.net\/note\/?p=607"},"modified":"2025-07-27T18:26:57","modified_gmt":"2025-07-27T10:26:57","slug":"nmap","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/607","title":{"rendered":"Nmap"},"content":{"rendered":"\n

nmap(Network exploration tool and security scanner)
\u4e3b\u8981\u7528\u9014:\u6383\u63cf\u4e3b\u6a5f\u7684\u8cc7\u8a0a
ex:
\u67e5localhost\u7684\u8cc7\u8a0a
nmap localhost<\/code><\/p>\n\n\n\n

refer
http:\/\/insecure.org\/nmap\/
http:\/\/nmap.org\/man\/zh\/index.html<\/p>\n\n\n\n

\n\n\n\n

\u7528\u6cd5
nmap [Scan Types\u6383\u7784\u985e\u578b] [Options\u6383\u7784\u53c3\u6578] {target specification\u6307\u5b9a\u76ee\u6a19}<\/p>\n\n\n\n

\n\n\n\n

target specification(\u6307\u5b9a\u76ee\u6a19):<\/strong>
\u591a\u53f0\u55ae\u4e00\u6a5f\u5668\u7528\u7a7a\u683c\u5206\u958b ex192.168.0.155 192.168.0.177
-\u8868\u793a\u7bc4\u570dex 192.168.1-200.50-100
\u661f\u865f\u8868\u793a\u7bc4\u570dex 192.168.*.155(\u610f\u601d\u5c31\u662f 192.168.0.155,192.168.1.155\u22ef192.168.2.255\u22ef)
netmask\u8868\u793a\u7bc4\u570dex192.168.0.0\/24 203.71.166\/24
-iL :\u6383\u63cf\u6a94\u6848\u4e2d\u6307\u5b9a\u7684\u76ee\u6a19
-iR : \u96a8\u6a5f\u9078\u64c7\u88ab\u6383\u63cf\u7684\u4e3b\u6a5f\u6578\u91cf
–exclude : \u8981\u6392\u9664\u7684\u76ee\u6a19
–excludefile : \u6392\u9664\u6587\u4ef6\u4e2d\u76ee\u6a19
ps:\u6307\u5b9a\u7684\u6587\u4ef6\u683c\u5f0f\u5927\u81f4\u5982\u4e0b
192.168.0.*
203.71.166.20-80
www.xxx.com
www.yyy.com\/24
20.0-20.50-100.*<\/p>\n\n\n\n

\n\n\n\n

HOST DISCOVERY(\u5075\u6e2c\u76ee\u6a19\u65b9\u5f0f):<\/strong>
-sL: \u53ea\u5217\u51fa\u8981\u6383\u63cf\u7684\u4e3b\u6a5f\u5217\u8868,\u4e0d\u505a\u771f\u6b63\u7684\u6383\u63cf
-sP: \u4f7f\u7528ping\u548cack\u6383\u63cf,\u9810\u8a2d\u9078\u9805
-P0: \u4e0d\u5075\u6e2c\u76ee\u6a19\u4e3b\u6a5f\u72c0\u614b,\u76f4\u63a5\u9032\u884c\u6383\u63cf
-PS [portlist]: \u5229\u7528TCP SYN ping
-PA [portlist]: \u5229\u7528TCP ACK ping
-PU [portlist]: \u5229\u7528UDP ping
-PE\/PP\/PM: \u4f7f\u7528ICMP ping\u985e\u578b,\u5206\u5225\u70baecho, timestamp,netmask request
-PR : \u5229\u7528ARP ping
-n :\u4e0d\u5c0dip\u9032\u884cdns\u89e3\u6790
-R: \u5c0dip\u9032\u884cdns\u89e3\u6790
ps:\u9810\u8a2d\u662f\u6709\u6642\u6703\u57f7\u884c-R\u9078\u9805
ex:
\u4f7f\u7528ping\u6383\u7784\u5b50\u7db2\u8def\u5167\u7684\u6240\u6709IP\uff0c\u4e26\u5217\u51fa\u6709\u56de\u61c9\u7684IP\uff0c\u4f46\u4e0d\u4f5c\u9032\u4e00\u6b65\u6e2c\u8a66
nmap -sP 192.168.1.0\/24
\u5217\u51fa\u5b50\u7db2\u8def\u6240\u6709IP\u53ca\u5c0d\u61c9\u7684\u4e3b\u6a5f\u540d\u7a31\uff0c\u4f46\u4e0d\u4f5cping \u53ca\u901a\u8a0a\u57e0\u5075\u6e2c
nmap -sL 192.168.1.0\/24
\u5229\u7528tcp syn ping\u5075\u6e2c\u9060\u7aef\u4e3b\u6a5f\u662f\u5426\u5df2\u958b\u555f22,23,80,25\u901a\u8a0a\u57e0
nmap -PS22,23,80,25 192.168.1.1
\u4f7f\u7528UDP\u5354\u5b9aping \u9060\u7aef\u7684\u4e3b\u6a5f
nmap -PU 192.168.1.0\/24<\/p>\n\n\n\n

-sP\u756b\u9762\u5927\u81f4\u5982\u4e0b:
Host 10.1.2.7 appears to be up.
MAC Address: 00:01:3C:D0:A9:8A (TIW Systems)
Host 10.1.2.9 appears to be up.
MAC Address: 00:11:6B:97:18:22 (Accton Technology)
Nmap finished: 256 IP addresses (2 hosts up) scanned in 16.455 seconds\u00a0<\/p>\n\n\n\n

<\/p>\n\n\n\n

\n\n\n\n



SCAN TECHNIQUES(\u6383\u63cf\u65b9\u5f0f):<\/strong>
-sS \u4f7f\u7528tcp syn\u6383\u63cf,\u6b64\u70ba\u534a\u958b\u653e\u7684\u6383\u7784\u65b9\u5f0f,\u901f\u5ea6\u8f03\u5feb\u4e5f\u8f03\u5e38\u88ab\u7528,\u4e26\u53ef\u5217\u51fa\u6709\u56de\u61c9\u7684\u9060\u7aef\u4e3b\u6a5f\u5df2\u958b\u555f\u7684\u7db2\u8def\u670d\u52d9\u57e0
-sU \u4f7f\u7528udp\u6383\u63cf
-sT \u4f7f\u7528tcp Connect()\u6383\u63cf,\u82e5-sS\u6383\u7784\u7121\u6548\u6703\u81ea\u52d5\u6539\u7528\u6b64\u6383\u63cf\u65b9\u5f0f
-sA \u4f7f\u7528tcp ACK\u6383\u63cf
-sW \u4f7f\u7528tcp windows\u6383\u63cf
-sM \u4f7f\u7528tcp Maimon\u6383\u63cf
-sN \u4f7f\u7528TCP Null\u6383\u63cf
-sF \u4f7f\u7528TCP FIN\u6383\u63cf
-sX \u4f7f\u7528TCP Xmas\u6383\u63cf
–scanflags : \u81ea\u8a02TCP flags\u6383\u63cf,flags\u6709syn,ack,psh,urg,fin,rst
-sI : \u533f\u540d\u6383\u63cf
-sO: \u4f7f\u7528IP protocol\u6383\u63cf
-b : \u5229\u7528\u9060\u7aefftp\u4e3b\u6a5f\u6383\u63cf
ex:
\u4f7f\u7528TCP SYN\u6383\u7784\u9060\u7aef\u4e3b\u6a5f\u7fa4
nmap -sS 192.168.1.0\/24
\u7528UDP\u5354\u5b9a\u6383\u7784\u9060\u7aef\u4e3b\u6a5f\u7fa4
nmap -sU 192.168.1.0\/24
\u5075\u6e2c\u9060\u7aef\u4e3b\u6a5f\u5df2\u958b\u555f\u54ea\u4e9b\u901a\u8a0a\u5354\u5b9a TCP,UDP,ICMP,…
nmap -sO 192.168.1.19<\/p>\n\n\n\n

\u57f7\u884c-sO\u6642,\u76ee\u6a19\u4e3b\u6a5ftcpdump\u6703\u985e\u4f3c\u4ee5\u4e0b
20:18:01.016785 IP 10.1.2.26 > 10.1.2.25: ip-proto-245 0
20:18:02.018842 IP 10.1.2.26 > 10.1.2.25: pnni 0
20:18:03.020868 IP 10.1.2.26 > 10.1.2.25: stp 0
20:18:04.022906 IP 10.1.2.26 > 10.1.2.25: ip-proto-249 0
20:18:05.024947 IP 10.1.2.26 > 10.1.2.25: idpr-cmtp 0
20:18:06.026991 IP 10.1.2.26 > 10.1.2.25: ip-proto-239 0<\/p>\n\n\n\n

\n\n\n\n

PORT SPECIFICATION AND SCAN ORDER(\u6307\u5b9aport\u53ca\u6383\u63cf\u9806\u5e8f):<\/strong>
\u9810\u8a2d\u6703\u6383\u63cf1-1024\u9593\u7684\u6240\u6709port\uff0c\u548cnmap-services\u6587\u4ef6\u6307\u5b9a\u7684port
-p : \u6307\u5b9a\u8981\u6383\u63cf\u7684port
ex: -p 22; -p 1-65535; -p U:53,111,137,T:21-25,80,139,8080
ps: -p 1024- \u662f\u5927\u65bc1024\u7684\u610f\u601d
-F: \u6839\u64danmap-services\u6587\u4ef6\u6307\u5b9a\u7684port\u6383\u63cf
-r: \u6709\u9806\u5e8f\u7684\u6383\u63cfport,\u9810\u8a2d\u662f\u7121\u9806\u5e8f<\/p>\n\n\n\n

<\/p>\n\n\n\n

\n\n\n\n

SERVICE\/VERSION DETECTION(\u5075\u6e2c\u670d\u52d9\u7248\u672c):<\/strong>
-sV: \u555f\u7528\u4f3a\u670d\u5668\u670d\u52d9\u7248\u672c\u5075\u6e2c\u529f\u80fd
–version-light: \u50c5\u63d0\u4f9b\u5c11\u6578\u8a0a\u606f
–version-all: \u986f\u793a\u5168\u90e8\u8a0a\u606f
–version-trace: \u986f\u793a\u8a73\u7d30\u8a0a\u606f
OS DETECTION(\u5075\u6e2c\u4f5c\u696d\u7cfb\u7d71):
-O: \u555f\u52d5\u4f5c\u696d\u7cfb\u7d71\u5075\u6e2c
–osscan-limit: \u53ea\u5075\u6e2c\u6307\u5b9a\u76ee\u6a19
–osscan-guess: \u63a8\u6e2c\u4f5c\u696d\u7cfb\u7d71\u985e\u578b<\/p>\n\n\n\n

TIMING AND PERFORMANCE(\u6642\u9593\u548c\u6548\u80fd):<\/strong>
-T <0-6> \u8a2d\u5b9atiming template(\u901f\u5ea6\u8abf\u6574\u6a21\u677f),\u9810\u8a2d\u662f3,0\u662f\u6700\u6162\u4f46\u6700\u4e0d\u5bb9\u6613\u88ab\u767c\u73fe
–min-hostgroup\/max-hostgroup : Parallel host scan group sizes
–min-parallelism\/max-parallelism : Probe parallelization
–min_rtt_timeout\/max-rtt-timeout\/initial-rtt-timeout : Specifies
probe round trip time.
–host-timeout : Give up on target after this long
–scan-delay\/–max_scan-delay : Adjust delay between probes<\/p>\n\n\n\n

FIREWALL\/IDS EVASION AND SPOOFING:<\/strong>
-f; –mtu : fragment packets (optionally w\/given MTU)
-D : Cloak a scan with decoys
-S : Spoof source address
-e : Use specified interface
-g\/–source-port : Use given port number
–data-length : Append random data to sent packets
–ttl : Set IP time-to-live field
–spoof-mac : Spoof your MAC address<\/p>\n\n\n\n

OUTPUT(\u8f38\u51fa\u7d50\u679c):<\/strong>
-oN \u5c07\u8f38\u51fa\u76f4\u63a5\u5beb\u5728\u6307\u5b9a\u7684\u6587\u4ef6\u4e0a
-oX \u8f38\u51fa\u6210XML\u683c\u5f0f
-oS \u8f38\u51fa\u6210s|
-oG \u8f38\u51fa\u6210grep\u683c\u5f0f
-oA : \u8f38\u51fa\u6210\u4ee5\u4e0a\u56db\u7a2e\u683c\u5f0f
-v:\u63d0\u9ad8\u8f38\u51fa\u7d50\u679c\u7684\u8a73\u7d30\u5ea6
-d[level]: \u8a2d\u5b9adebug\u6642\u8f38\u51fa\u7684\u8a73\u7d30\u5ea6
–open :\u50c5\u986f\u793astate\u70baopen\u7684\u4e3b\u6a5f
–packet-trace: \u986f\u793a\u6240\u6709\u50b3\u9001\u548c\u63a5\u6536\u7684\u5c01\u5305
–iflist: \u986f\u793a\u4e3b\u6a5f\u4ecb\u9762\u6216\u8def\u7531
–append-output: \u5c07\u672c\u6b21\u6383\u63cf\u7d50\u679c\u5beb\u5165\u53e6\u4e00\u500b\u6383\u63cf\u7d50\u679c\u6587\u4ef6\u5f8c\u9762,\u4e0d\u652f\u63f4xml
–resume : \u7e7c\u7e8c\u4e0a\u6b21\u88ab\u4e2d\u65b7\u7684\u6383\u63cf,\u4e0d\u652f\u63f4xml
–stylesheet : \u6307\u5b9axsl\u6a23\u5f0f\u5c07xml\u8f49\u63db\u6210html
–no_stylesheet: \u4e0d\u8981\u5c07xml\u8f49\u63db\u6210html<\/p>\n\n\n\n

MISC:<\/strong>
-6: \u555f\u7528ipv6\u6383\u63cf
-A: \u57f7\u884c\u5168\u90e8\u9078\u9805,\u5305\u62ec\u4f5c\u696d\u7cfb\u7d71\u548c\u4f3a\u670d\u5668\u670d\u52d9\u5075\u6e2c
–datadir :\u6307\u5b9anmap\u53c3\u6578\u6a94\u4f4d\u7f6e
–send-eth \u8981\u6c42\u4f7f\u7528\u8a0a\u6846\u50b3\u9001
–send-ip: \u8981\u6c42\u4f7f\u7528\u5c01\u5305\u50b3\u9001
–privileged: Assume that the user is fully privileged
-V: \u986f\u793a\u7248\u672c
-h: \u986f\u793a\u7c21\u77ed\u64cd\u4f5c\u8aaa\u660e<\/p>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n

\n\n\n\n

\u7db2\u8def\u4e0a\u7684\u5176\u4ed6\u7bc4\u4f8b<\/strong><\/h3>\n\n\n\n

\u5075\u6e2c\u9060\u7aef\u4e3b\u6a5f\u7684\u4f5c\u696d\u7cfb\u7d71\u985e\u578b
nmap -O 192.168.1.19<\/code>
nmap -A 192.168.1.19<\/code><\/p>\n\n\n\n

\u6383\u7784\u9060\u7aef\u4e3b\u6a5f\uff0c\u4e26\u5217\u51fa\u76f8\u95dc\u8a73\u7d30\u7684\u8cc7\u8a0a\u3002
nmap -v scanme.nmap.org<\/code><\/p>\n\n\n\n

\u4ee5SYN\u79d8\u5bc6\u6383\u7784\u7db2\u57df\u70bascanme.nmap.org\u6240\u5c6c C \u5b50\u7db2\u6bb5\u7684\u6240\u6709\u5b58\u5728\u7684\u4e3b\u6a5f\u4f5c\u696d\u7cfb\u7d71\u985e\u578b\u3002
nmap -sS -O scanme.nmap.org\/24<\/code><\/p>\n\n\n\n

\u9032\u884c\u4e3b\u6a5f\u5217\u8868\u53caTCP\u6383\u7784\u7279\u5b9a\u7db2\u8def\u670d\u52d9\uff0c\u9060\u7aef\u4e3b\u6a5f\u7684\u7db2\u8def\u542b\u62ec 198.116.(0-255).(1-127) \u7db2\u6bb5\u4e0b\u3002
nmap -sV -p 22\uff0c53\uff0c110\uff0c143\uff0c4564 198.116.0-255.1-127<\/code><\/p>\n\n\n\n

\u96a8\u6a5f\u9078\u64c7100000\u53f0\u4e3b\u6a5f\uff0c\u5075\u6e2c\u662f\u5426\u958b\u555f Web \u670d\u52d9\uff0c\u7531\u65bc\u6b64\u6383\u7784\u8f03\u8017\u6642\uff0c\u6240\u4ee5\u52a0\u4e0a-P0 \u4e0d\u4f5c\u4e3b\u6a5f\u5217\u8868\u3002
nmap -v -iR 100000 -P0 -p 80<\/code><\/p>\n\n\n\n

\u5c0d www.target.com \u5e95\u4e0b\u6240\u5c6c\u7db2\u57df\u9032\u884c TCP Stealth Scan \uff0c\u6383\u63cf\u7684 port \u50c5\u9650\u65bc FTP,SSH,TELNET,SMTP,POP3
nmap -sS -p 21,22,23,25,110 www.target.com\/24<\/code><\/p>\n\n\n\n

\u6383\u63cf tcp \u8207 udp port \uff0c\u7bc4\u570d\u5f9e 1-65535\uff0c\u76ee\u6a19\u662fwww.example.com\uff0c\u6ce8\u610f\uff0c \u5982\u679c\u8a72\u6a5f\u5668\u6709\u9632\u706b\u7246\u4fdd\u8b77\u8457\u6216\u662f\u5fae\u8edf\u4e3b\u6a5f\uff0c\u9019\u9805\u6383\u63cf\u5c07\u6703\u5931\u6557
nmap -sF -sU -p 1-65535 www.example.com<\/code><\/p>\n\n\n\n

<\/p>\n\n\n\n

\n\n\n\n

–script vuln \u53ef\u5217\u51fa\u5f31\u9ede<\/p>\n\n\n\n

\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ sudo nmap -Pn -sS -sV --script vuln 192.168.75.159\nStarting Nmap 7.93 ( https:\/\/nmap.org ) at 2023-01-22 19:34 EST\nNmap scan report for 192.168.75.159\nHost is up (0.00016s latency).\nNot shown: 998 closed tcp ports (reset)\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)\n| vulners: \n|   cpe:\/a:openbsd:openssh:8.2p1: \n|       CVE-2020-15778  6.8     https:\/\/vulners.com\/cve\/CVE-2020-15778\n|       C94132FD-1FA5-5342-B6EE-0DAF45EEFFE3    6.8    https:\/\/vulners.com\/githubexploit\/C94132FD-1FA5-5342-B6EE-0DAF45EEFFE3   *EXPLOIT*\n|       10213DBE-F683-58BB-B6D3-353173626207    6.8    https:\/\/vulners.com\/githubexploit\/10213DBE-F683-58BB-B6D3-353173626207   *EXPLOIT*\n|       CVE-2020-12062  5.0     https:\/\/vulners.com\/cve\/CVE-2020-12062\n|       CVE-2021-28041  4.6     https:\/\/vulners.com\/cve\/CVE-2021-28041\n|       CVE-2021-41617  4.4     https:\/\/vulners.com\/cve\/CVE-2021-41617\n|       CVE-2020-14145  4.3     https:\/\/vulners.com\/cve\/CVE-2020-14145\n|       CVE-2016-20012  4.3     https:\/\/vulners.com\/cve\/CVE-2016-20012\n|_      CVE-2021-36368  2.6     https:\/\/vulners.com\/cve\/CVE-2021-36368\n...omit...<\/code><\/pre>\n\n\n\n
\n\n\n\n
–script=ssh-brute \u53ef\u4f7f\u7528ssh\u7206\u529b\u5bc6\u78bc\u7834\u89e3<\/p>\n\n\n\n
# nmap -p 22 --script=ssh-brute --script-args userdb=user.txt,passdb=pw.txt 192.168.1.100\n...omit...\nNSE: [ssh-brute] Trying username\/password pair: root:aaaaaa\n...omit...\nPORT   STATE SERVICE\n22\/tcp open  ssh\n| ssh-brute:\n|   Accounts:\n| \troot:123456 - Valid credentials\n\nNmap done: 1 IP address (1 host up) scanned in 902.61 seconds<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
nmap(Network exploration tool  …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[369],"tags":[],"class_list":["post-607","post","type-post","status-publish","format-standard","hentry","category-red-team"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=607"}],"version-history":[{"count":1,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/607\/revisions"}],"predecessor-version":[{"id":2426,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/607\/revisions\/2426"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}