Nmap 基本使用-阿里云开发者社区

Nmap 基本使用

2022-12-10 148

版权

本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。

简介： Nmap 基本使用

语法：

$ nmap [扫描类型] [选项] {扫描目标}点击复制复制失败已复制

这个工具非常之强大，具有非常多的功能和命名，本笔记仅展示常用功能。

常见扫描类型

-sS， TCP SYN 扫描(半开扫描)

只向目标发出 SYN 数据包，如果收到 SYN/ACK 响应包就认为目标端口正在监听，并立即断开连接；否则认为目标端口并未开放。

-sT，TCP 连接扫描

这是完整的 TCP 扫描方式，用来建立一个 TCP 连接，如果成功则认为目标端口正在监听服务，否则认为目标端口并未开放。

-sF，TCP FIN 扫描

开放的端口会忽略这种数据包，关闭的端口会响应 RST 数据包。许多防火墙只对 SYN 数据包进行简单过滤，而忽略其他形式的 TCP 攻击包。这种类型的扫描可间接检测防火墙的健壮性。

-sU，UDP 扫描

探测目标主机提供哪些 UDP 服务，UDP 扫描的速度会比较慢。

-sP，ICMP 扫描

类似 ping 检测，快速判断目标主机是否存活的，不做其他扫描。

-P0，跳过 ping 检测

这种方式认为所有的目标主机是存活的，当对方不响应 ICMP 请求时，使用这种方式可以避免因无法 ping 通而放弃扫描。

常用示例

快速扫描某主机

$ nmap xxx.xxx.xxx.xxx
Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-03 18:23 CST
Nmap scan report for xxx.xxx.xxx.xxx
Host is up (0.038s latency).
Not shown: 950 filtered ports, 44 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
443/tcp  open  https
6000/tcp open  X11
6666/tcp open  irc
7000/tcp open  afs3-fileserver点击复制复制失败已复制

检测特定主机的某些端口

$ nmap xxx.xxx.xxx.xxx -p 80,443,1883
Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-03 18:21 CST
Nmap scan report for xxx.xxx.xxx.xxx
Host is up (0.040s latency).
PORT     STATE SERVICE
80/tcp   open  http
443/tcp  open  https
1883/tcp open  mqtt
Nmap done: 1 IP address (1 host up) scanned in 0.12 seconds点击复制复制失败已复制

指定端口范围

$ nmap xxx.xxx.xxx.xxx -p 1000-2000
Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-03 18:23 CST
Nmap scan report for xxx.xxx.xxx.xxx
Host is up (0.048s latency).
Not shown: 1000 filtered ports
PORT     STATE SERVICE
1883/tcp open  mqtt
Nmap done: 1 IP address (1 host up) scanned in 6.10 seconds点击复制复制失败已复制

检测 192.168.1.0/24 网段中哪些主机提供FTP服务

$ nmap -p 21 192.168.1.0/24
Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-03 18:26 CST
Nmap scan report for 192.168.1.1
Host is up (0.0078s latency).
PORT   STATE SERVICE
21/tcp open  ftp点击复制复制失败已复制

快速检测192.168.3.0/24网段中有哪些存活主机(能 ping 通)

$ nmap -n -sP 192.168.3.0/24
Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-03 18:27 CST
Nmap scan report for 192.168.3.1
Host is up (0.0076s latency).
Nmap scan report for 192.168.3.100
Host is up (0.044s latency).
Nmap scan report for 192.168.3.105
Host is up (0.013s latency).
Nmap scan report for 192.168.3.106
Host is up (0.012s latency).
Nmap scan report for 192.168.3.108
Host is up (0.038s latency).
Nmap scan report for 192.168.3.110
Host is up (0.013s latency).
Nmap scan report for 192.168.3.111
Host is up (0.0026s latency).
Nmap scan report for 192.168.3.114
Host is up (0.085s latency).
Nmap scan report for 192.168.3.116
Host is up (0.000084s latency).
Nmap scan report for 192.168.3.117
Host is up (0.12s latency).
Nmap scan report for 192.168.3.118
Host is up (0.0054s latency).
Nmap scan report for 192.168.3.119
Host is up (0.016s latency).
Nmap scan report for 192.168.3.120
Host is up (0.0091s latency).
Nmap scan report for 192.168.3.129
Host is up (0.0056s latency).
Nmap scan report for 192.168.3.145
Host is up (0.0044s latency).
Nmap done: 256 IP addresses (15 hosts up) scanned in 5.38 seconds点击复制复制失败已复制

检测IP地址位于192.168.0.1~200 的主机是否开启文件共享

$ nmap -p 139,445 192.168.0.1-200
Starting Nmap 7.80 ( https://nmap.org ) at 2020-12-03 19:04 CST
Nmap scan report for 192.168.0.1
Host is up (0.0060s latency).
PORT    STATE  SERVICE
139/tcp closed netbios-ssn
445/tcp closed microsoft-ds
Nmap scan report for 192.168.0.102
Host is up (0.0032s latency).
PORT    STATE SERVICE
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
Nmap scan report for 192.168.0.108
Host is up (0.0058s latency).
PORT    STATE SERVICE
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
Nmap done: 200 IP addresses (3 hosts up) sca

Nmap 基本使用

常见扫描类型

常用示例

热门文章

最新文章

相关电子书