注册 登录  
 加关注
   显示下一条  |  关闭
温馨提示!由于新浪微博认证机制调整,您的新浪微博帐号绑定已过期,请重新绑定!立即重新绑定新浪微博》  |  关闭

星期五

明天不上班

 
 
 

日志

 
 
关于我

一个特立独行的Java程序员,比较宅,上上网,写博客,听音乐,看电影。

网易考拉推荐

Nmap初体验  

2011-09-15 21:17:55|  分类: Linux |  标签: |举报 |字号 订阅

  下载LOFTER 我的照片书  |
Nmap 是一个非常优秀的端口扫描工具。

简单的使用方法:
nmap -A -T4 myUbuntu
-A, 用来进行操作系统及其版本的探测,-T4 可以加快执行速度,目标主机名
nmap -A -T4 -PR 192.168.1.100
-PR  ARP ping(具体解释 参看 http://nmap.org/man/zh/man-host-discovery.html
nmap -p 22 -T4 -P0 192.168.1.100
-p 22 对端口22进行扫描
nmap -T4 -sR 192.168.1.100-108
快速扫描192.168.1.100-108的IP地址

我在出租房里做了一个小测试:
1.快速扫描192.168.1.0/24网段 
nmap -v -T4 -sP 192.168.1.0/24  > D:\result.txt 
-v 输出版本号 -sP  该选项告诉Nmap仅仅 进行ping扫描
Result.txt 内容:

Starting Nmap 5.51 ( http://nmap.org ) at 2011-09-15 20:51 中国标准时间
Initiating ARP Ping Scan at 20:51
Scanning 103 hosts [1 port/host]
Completed ARP Ping Scan at 20:51, 1.74s elapsed (103 total hosts)
Initiating Parallel DNS resolution of 103 hosts. at 20:51
Completed Parallel DNS resolution of 103 hosts. at 20:51, 0.14s elapsed
Nmap scan report for 192.168.1.0 [host down]
Nmap scan report for 192.168.1.1
Host is up (0.00013s latency).
MAC Address: 00:1D:0F:A2:D0:8A (Tp-link Technologies Co.)
Nmap scan report for 192.168.1.2 [host down]
Nmap scan report for 192.168.1.3 [host down]
Nmap scan report for 192.168.1.4 [host down]
... ... ... ...
Nmap scan report for 192.168.1.101 [host down]
Nmap scan report for 192.168.1.102
Host is up (0.023s latency).
MAC Address: 00:0A:E4:C0:32:EA (Wistron)
Initiating Parallel DNS resolution of 1 host. at 20:51
Completed Parallel DNS resolution of 1 host. at 20:51, 0.06s elapsed
Nmap scan report for 192.168.1.103
Host is up.
Initiating ARP Ping Scan at 20:51
Scanning 152 hosts [1 port/host]
Completed ARP Ping Scan at 20:51, 6.48s elapsed (152 total hosts)
Nmap scan report for 192.168.1.104 [host down]
Nmap scan report for 192.168.1.105 [host down]
Nmap scan report for 192.168.1.106 [host down]
Nmap scan report for 192.168.1.107 [host down]
... ... ... ...
Nmap scan report for 192.168.1.254 [host down]
Nmap scan report for 192.168.1.255 [host down]
Read data files from: D:\Program Files (x86)\nmap-5.51-win32\nmap-5.51
Nmap done: 256 IP addresses (3 hosts up) scanned in 8.46 seconds
           Raw packets sent: 509 (14.252KB) | Rcvd: 3 (84B)

扫描速度非常快,有3个IP是活的。

2.扫描具体某一个IP,查看他的操作系统等信息
nmap -A -T4 -PR 192.168.1.101

Starting Nmap 5.51 ( http://nmap.org ) at 2011-09-15 19:40 中国标准时间
Nmap scan report for 192.168.1.101
Host is up (0.00096s latency).
Not shown: 998 closed ports
PORT    STATE SERVICE     VERSION
135/tcp open  msrpc?
139/tcp open  netbios-ssn
MAC Address: 00:14:2A:0E:6E:65 (Elitegroup Computer System Co.)
Device type: general purpose
Running: Microsoft Windows XP
OS details: Microsoft Windows XP SP2 - SP3
Network Distance: 1 hop

Host script results:
|_nbstat: NetBIOS name: 20110301-0453, NetBIOS user: <unknown>, NetBIOS MAC: 00:14:2a:0e:6e:65 (Elitegroup Computer System Co.)
|_smbv2-enabled: Server doesn't support SMBv2 protocol
| smb-os-discovery: 
|   OS: Windows XP (Windows 2000 LAN Manager)
|   Name: WORKGROUP\20110301-0453
|_  System time: 2011-09-10 00:21:44 UTC+8

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 144.64 seconds

3.扫描端口(SSH)
nmap -p 22 -T4 -PR 192.168.1.101 

Starting Nmap 5.51 ( http://nmap.org ) at 2011-09-15 21:09 中国标准时间
Nmap scan report for 192.168.1.101
Host is up (0.0010s latency).
PORT   STATE  SERVICE
22/tcp closed ssh
MAC Address: 00:14:2A:0E:6E:65 (Elitegroup Computer System Co.)

Nmap done: 1 IP address (1 host up) scanned in 0.34 seconds


Nmap很强大,很多功能等着我们去使用。

Nmap的GUI Zenmap   http://nmap.org/zenmap/
截图:(使用Zenmap 扫描192.168.1.101)
Nmap初体验 - 星期五 - 星期五

补充资料:
Namp的用法

Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0-255.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sP: Ping Scan - go no further than determining if host is online
  -P0: Treat all hosts as online -- skip host discovery
  -PS/PA/PU [portlist]: TCP SYN/ACK or UDP discovery probes to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes resolve]
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idlescan
  -sO: IP protocol scan
  -b <ftp relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080
  -F: Fast - Scan only the ports listed in the nmap-services file)
  -r: Scan ports consecutively - don't randomize
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-light: Limit to most likely probes for faster identification
  --version-all: Try every single probe for version detection
  --version-trace: Show detailed version scan activity (for debugging)
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  -T[0-6]: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <msec>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <msec>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <msec>: Specifies
      probe round trip time.
  --host-timeout <msec>: Give up on target after this long
  --scan-delay/--max-scan-delay <msec>: Adjust delay between probes
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --data-length <num>: Append random data to sent packets
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address, prefix, or vendor name>: Spoof your MAC address
OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan results in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use twice for more effect)
  -d[level]: Set or increase debugging level (Up to 9 is meaningful)
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --no-stylesheet: Prevent Nmap from associating XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enables OS detection and Version detection
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send packets using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sP 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -P0 -p 80
  评论这张
 
阅读(768)| 评论(0)
推荐

历史上的今天

评论

<#--最新日志,群博日志--> <#--推荐日志--> <#--引用记录--> <#--博主推荐--> <#--随机阅读--> <#--首页推荐--> <#--历史上的今天--> <#--被推荐日志--> <#--上一篇,下一篇--> <#-- 热度 --> <#-- 网易新闻广告 --> <#--右边模块结构--> <#--评论模块结构--> <#--引用模块结构--> <#--博主发起的投票-->
 
 
 
 
 
 
 
 
 
 
 
 
 
 

页脚

网易公司版权所有 ©1997-2017