nmap教程（上）

一.nmap的主要功能

1.端口扫描

2.主机探测：查找目标网络的在线主机

3.服务/版本检测：发现开放端口后，进一步检测目标主机的检测服务协议、应用程序名称、版本号等信息

4.操作系统检测

5.网络路由追踪

二.nmap的6种端口状态

1.开放：开放端口的服务器程序可以受理TCP连接、接受UDP数据包或者响应SCTP（流控制传输协议）请求

2.关闭：可以访问相关的端口，但是没有应用程序在该端口

3.过滤：不能确定端口是否开放，包过滤设备屏蔽了我们向主机发送的探测包

4.未过滤：可以访问制定端口，但是不确定端口是否开放

5.打开|过滤： 不能确定是打开还是过滤，在遇到没有响应的开放端口时，Nmap或做出这样的判断。

6.关闭|过滤

基本用法：Usage: nmap [Scan Type(s)] [Options] {target specification}

三.指定扫描目标

TARGET SPECIFICATION: #目标格式说明
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/, 192.168.0.1; 10.0.-255.1-254  #可以接受单个域名，单个主机，多个主机，CIDR表示的网段，十进制的ip区间等形式的扫描目标
  -iL <inputfilename>: Input from list of hosts/networks  #指定文本文件读取扫描清单
  -iR <num hosts>: Choose random targets  #（随机挑选几个目标进行扫描）
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks  #除去列表中的地址
  --excludefile <exclude_file>: Exclude list from file  #除去清单中的地址

可以使用tcpdump来监测网卡的数据包流量，打开一个终端窗口，输入（Vboxnet0是我的虚拟网卡，根据实际情况更改）

 tcpdump -i vboxnet0

接下来扫描脆弱主机metasploitable2，扫描结果如下

# nmap 192.168.56.101

Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-18 21:13 CST
Nmap scan report for 192.168.56.101
Host is up (.00034s latency).
Not shown:  closed ports
PORT     STATE SERVICE
/tcp   open  ftp
/tcp   open  ssh
/tcp   open  telnet
/tcp   open  smtp
/tcp   open  domain
/tcp   open  http
/tcp  open  rpcbind
/tcp  open  netbios-ssn
/tcp  open  microsoft-ds
/tcp  open  exec
/tcp  open  login
/tcp  open  shell
/tcp open  rmiregistry
/tcp open  ingreslock
/tcp open  nfs
/tcp open  ccproxy-ftp
/tcp open  mysql
/tcp open  postgresql
/tcp open  vnc
/tcp open  X11
/tcp open  irc
/tcp open  ajp13
/tcp open  unknown
MAC Address: ::::: (Oracle VirtualBox virtual NIC)

Nmap done:  IP address ( host up) scanned in 0.28 seconds

四.扫描选项

SCAN TECHNIQUES:#扫描选项
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans #sT:完整三次握手 sS:设置SYN sM：设置FIN/ACK sA：设置ACK sW：检测返回的TCP窗口字段
  -sU: UDP Scan #UDP仅有的一种方式
  -sN/sF/sX: TCP Null, FIN, and Xmas scans #sN：不设置控制位 sF：设置FIN位 sX：设置FIN、PSH和URG
  --scanflags <flags>: Customize TCP scan flags #设置自定义的TCP扫描方式
  -sI <zombie host[:probeport]>: Idle scan #设置僵尸主机进行扫描
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b <FTP relay host>: FTP bounce scan

五.目标端口选项

nmap默认从常用端口中随机挑选1000个进行扫描，其nmap-services文件对端口的命中率进行了排行

PORT SPECIFICATION AND SCAN ORDER: #端口说明和扫描顺序
  -p <port ranges>: Only scan specified ports #设置端口范围，单个端口，多个端口，范围端口等
    Ex: -p22; -p1-; -p U:,,,T:-,,,,S:
  --exclude-ports <port ranges>: Exclude the specified ports from scanning #去除某些端口
  -F: Fast mode - Scan fewer ports than the default scan #快速扫描，仅扫描常用的100个端口
  -r: Scan ports consecutively - don't randomize #顺序扫描，从小到大
  --top-ports <number>: Scan <number> most common ports #扫描name-services中前number个端口
  --port-ratio <ratio>: Scan ports more common than <ratio>

六.输出选项

OUTPUT: #输出选项
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,#oN：正常输出，不显示runtime和警告信息 oX：生成xml文件 oG：保存为便于Grep使用的文件
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --reason: Display the reason a port is in a particular state
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Nmap.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output

七.时间排程控制选项

TIMING AND PERFORMANCE: #时间和执行
  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T<->: Set timing template (higher is faster) #6种时间排程模式，默认为模式3
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <numprobes>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second

八.常用选项

1.服务版本识别

SERVICE/VERSION DETECTION: #服务/版本检测
  -sV: Probe open ports to determine service/version info #检测服务器软件的版本信息
  --version-intensity <level>: Set from  (light) to  (try all probes)
  --version-light: Limit to most likely probes (intensity )
  --version-all: Try every single probe (intensity )
  --version-trace: Show detailed version scan activity (for debugging)

2.操作系统检测

OS DETECTION:#操作系统检测
  -O: Enable OS detection #开启系统检测功能
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively

3.主机检测

HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery #认为所有主机都在线，防止其他主机对本机进行了ping屏蔽
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host

4.强有力扫描和扫描ipv6主机

MISC:
  -: Enable IPv6 scanning #允许ipv6扫描模式
  -A: Enable OS detection, version detection, script scanning, and traceroute #扫描服务版本，操作系统，脚本扫描，traceroute
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  --unprivileged: Assume the user lacks raw socket privileges
  -V: Print version number
  -h: Print this help summary page.