端口扫描之王-----------nmap

[root@ok data]# nmap -F -sT -v nmap.org

Starting Nmap 5.51 ( http://nmap.org ) at 2016-10-23 12:46 CST
Initiating Ping Scan at :
Scanning nmap.org (45.33.49.119) [ ports]
Completed Ping Scan at :, .17s elapsed ( total hosts)
Initiating Parallel DNS resolution of  host. at :
Completed Parallel DNS resolution of  host. at :, .24s elapsed#URL进行解析花了16.5秒
Initiating Connect Scan at :
Scanning nmap.org (45.33.49.119) [ ports]
Discovered open port /tcp on 45.33.49.119
Discovered open port /tcp on 45.33.49.119
Discovered open port /tcp on 45.33.49.119
Discovered open port /tcp on 45.33.49.119
Completed Connect Scan at :, .40s elapsed ( total ports)
Nmap scan report for nmap.org (45.33.49.119)
Host is up (.19s latency).
rDNS record for 45.33.49.119: ack.nmap.org
Not shown:  filtered ports＃有95个端口被屏屏蔽了，说明防火墙是开启的，如果不开启防火墙是不会对端口屏蔽的
PORT    STATE  SERVICE
/tcp  open   ssh
/tcp  open   smtp
/tcp  open   http
/tcp closed auth
/tcp open   https

Read data files from: /usr/share/nmap
Nmap done:  IP address ( host up) scanned in 4.87 seconds＃总共的运行时间
           Raw packets sent:  (152B) | Rcvd:  (28B)

探测目标主机的操做系统:

对自己的系统进行扫描：

[root@ok Desktop]# nmap -O 192.168.1.14

Starting Nmap 5.51 ( http://nmap.org ) at 2016-10-23 13:34 CST
Nmap scan report for 192.168.1.14
Host is up (.000091s latency).
Not shown:  closed ports
PORT     STATE SERVICE
/tcp   open  ssh
/tcp  open  rpcbind
/tcp open  X11:
/tcp open  X11:
No exact OS matches for host (If you know what OS is running on it, see http://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=5.51%D=/%OT=%CT=%CU=%PV=Y%DS=%DC=L%G=Y%TM=580C4BF3%P
OS:=x86_64-redhat-linux-gnu)SEQ(SP=%GCD=%ISR=%TI=Z%CI=Z%II=I%TS=A)OP
OS:S(O1=MFFD7ST11NW7%O2=MFFD7ST11NW7%O3=MFFD7NNT11NW7%O4=MFFD7ST11NW7%O5=MF
OS:FD7ST11NW7%O6=MFFD7ST11)WIN(W1=FFCB%W2=FFCB%W3=FFCB%W4=FFCB%W5=FFCB%W6=F
OS:FCB)ECN(R=Y%DF=Y%T=%W=FFD7%O=MFFD7NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=%S=O%
OS:A=S+%F=AS%RD=%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=%W=%S=A%A=Z%F=R%O=%RD=
OS:%Q=)T5(R=Y%DF=Y%T=%W=%S=Z%A=S+%F=AR%O=%RD=%Q=)T6(R=Y%DF=Y%T=%W=%S
OS:=A%A=Z%F=R%O=%RD=%Q=)T7(R=Y%DF=Y%T=%W=%S=Z%A=S+%F=AR%O=%RD=%Q=)U1(R
OS:=Y%DF=N%T=%IPL=%UN=%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N
OS:%T=%CD=S)

Network Distance:  hops

OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done:  IP address ( host up) scanned in 11.79 seconds

对系统中的vhosts进行扫描:

[root@ok Desktop]# virsh list
 Id    Name                           State
----------------------------------------------------
      c01                            running#192.168.105
      c02                            running#192.168.1.103
      1xp                            running#192.168.1.104

c01 c02为linux ,1xp为windows

[root@ok Desktop]# nmap -O 192.168.1.103

Starting Nmap 5.51 ( http://nmap.org ) at 2016-10-23 13:38 CST
Nmap scan report for 192.168.1.103
Host is up (.00045s latency).
Not shown:  filtered ports
PORT     STATE  SERVICE
/tcp   open   ssh
/tcp   closed http
/tcp closed http-proxy
MAC Address: :::B3:: (QEMU Virtual NIC)
Device type: general purpose
Running (JUST GUESSING): Linux 2.6.X (%)
Aggressive OS guesses: Linux 2.6. (Fedora Core ) (%)
No exact OS matches for host (test conditions non-ideal).
Network Distance:  hop

OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done:  IP address ( host up) scanned in 9.10 seconds

[root@ok Desktop]# nmap -O 192.168.1.105

Starting Nmap 5.51 ( http://nmap.org ) at 2016-10-23 13:42 CST
Nmap scan report for 192.168.1.105
Host is up (.00041s latency).
Not shown:  filtered ports
PORT   STATE SERVICE
/tcp open  ssh
MAC Address: :::ED:C2:DB (QEMU Virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least  open and  closed port
Device type: specialized|WAP|general purpose
Running (JUST GUESSING): Crestron -Series (%), Netgear embedded (%), Linux 2.6.X (%)
Aggressive OS guesses: Crestron XPanel control system (%), Netgear DG834G WAP (%), Linux 2.6. - 2.6. (%), Linux 2.6. - 2.6. (%), Linux 2.6. (%), Linux 2.6. - 2.6. (%), Linux 2.6. - 2.6. (%)
No exact OS matches for host (test conditions non-ideal).
Network Distance:  hop

OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done:  IP address ( host up) scanned in 9.22 seconds

[root@ok Desktop]# nmap -O 192.168.1.104

Starting Nmap 5.51 ( http://nmap.org ) at 2016-10-23 13:43 CST
Nmap scan report for 192.168.1.104
Host is up (.00099s latency).
Not shown:  filtered ports
PORT     STATE SERVICE
/tcp open  icslap
/tcp open  ms-term-serv
MAC Address: :::C5::BD (QEMU Virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least  open and  closed port
Device type: general purpose
Running: Microsoft Windows |XP
OS details: Microsoft Windows  SP4, Microsoft Windows XP SP2 or SP3
Network Distance:  hop

OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done:  IP address ( host up) scanned in 6.66 seconds

对局域网内的手机ipd进行扫描，系统识别失败！！！

扫描一个范围内的目标(扫描ip地址为192.168.1.1-192.168.1.100内的所有主机)

nmap 192.168.1.1-100

[root@ok Desktop]# nmap 192.168.1.1-

Starting Nmap 5.51 ( http://nmap.org ) at 2016-10-23 14:14 CST
Nmap scan report for 192.168.1.1
Host is up (.00022s latency).
Not shown:  filtered ports,  closed ports
PORT     STATE SERVICE
/tcp   open  http
/tcp open  upnp
MAC Address: EC::8F:::6C (Unknown)

Nmap scan report for 192.168.1.14
Host is up (.0000040s latency).
Not shown:  closed ports
PORT     STATE SERVICE
/tcp   open  ssh
/tcp  open  rpcbind
/tcp open  X11:
/tcp open  X11:

Nmap scan report for 192.168.1.100
Host is up (.0013s latency).
All  scanned ports on 192.168.1.100 are closed
MAC Address: ::AD:::E7 (Unknown)

Nmap scan report for 192.168.1.101
Host is up (.12s latency).
All  scanned ports on 192.168.1.101 are filtered
MAC Address: :2A::8F:D9:2D (Unknown)

Nmap scan report for 192.168.1.102
Host is up (.075s latency).
All  scanned ports on 192.168.1.102 are filtered
MAC Address: EC:F3:5B::: (Unknown)

Nmap scan report for 192.168.1.103
Host is up (.00037s latency).
Not shown:  filtered ports
PORT     STATE  SERVICE
/tcp   open   ssh
/tcp   closed http
/tcp closed http-proxy
MAC Address: :::B3:: (QEMU Virtual NIC)

Nmap scan report for 192.168.1.104
Host is up (.00064s latency).
Not shown:  filtered ports
PORT     STATE SERVICE
/tcp open  icslap
/tcp open  ms-term-serv
MAC Address: :::C5::BD (QEMU Virtual NIC)

Nmap scan report for 192.168.1.105
Host is up (.00039s latency).
Not shown:  filtered ports
PORT   STATE SERVICE
/tcp open  ssh
MAC Address: :::ED:C2:DB (QEMU Virtual NIC)

Nmap done:  IP addresses ( hosts up) scanned in 40.97 seconds