米斯特白帽培训讲义工具篇 Nmap

讲师：gh0stkey

整理：飞龙

协议：CC BY-NC-SA 4.0

介绍

Nmap（网络映射器）是由 Gordon Lyon 涉及，用来探测计算机网络上的主机和服务的一种安全扫描器。为了绘制网络拓补图，Nmap 发送特制的数据包到目标主机，然后对返回数据包进行分析。Nmap 是一款枚举和测试网络的强大工具。

Nmap 有两种界面：可视化界面和命令行界面。

下载

https://nmap.org/download.html

使用

典型用途：

通过对设备或者防火墙的探测来审计其安全性。
探测目标主机的开放端口。
网络存储、网络映射、维护和资产管理。（这个有待深入）
通过识别新的服务器审计网络的安全性。
探测网络上的主机。

简单扫描

Nmap 默认使用 ICMP ping 和 TCP 全连接（-PB）进行主机发现，以及使用 TCP 全连接（-sT）执行主机扫描。默认扫描端口是 1 ~ 1024，以及其列表中的常用端口。

语法：

nmap <目标 IP>

例子：

C:\Users\asus> nmap 192.168.1.1

Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 10:37 ?D1ú±ê×?ê±??
Nmap scan report for localhost (192.168.1.1)
Host is up (0.0062s latency).
Not shown: 993 closed ports
PORT      STATE    SERVICE
21/tcp    filtered ftp
22/tcp    filtered ssh
23/tcp    filtered telnet
53/tcp    open     domain
80/tcp    open     http
49152/tcp open     unknown
49153/tcp open     unknown
MAC Address: 68:89:C1:74:84:43 (Huawei Technologies)

Nmap done: 1 IP address (1 host up) scanned in 3.40 seconds

多个 IP 可以以逗号分隔：192.168.1.1,2,3,4,5，也可以使用短横线来表示范围：192.168.1.1-255，也可以使用 CIDR 记法：192.168.1.0/24。

显示详细结果

nmap -vv <目标 IP>

C:\Users\asus> nmap -vv 192.168.1.1

Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 10:47 ?D1ú±ê×?ê±??
Initiating ARP Ping Scan at 10:47
Scanning 192.168.1.1 [1 port]
Completed ARP Ping Scan at 10:47, 0.15s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 10:47
Completed Parallel DNS resolution of 1 host. at 10:47, 0.01s elapsed
Initiating SYN Stealth Scan at 10:47
Scanning localhost (192.168.1.1) [1000 ports]
Discovered open port 80/tcp on 192.168.1.1
Discovered open port 53/tcp on 192.168.1.1
Discovered open port 49153/tcp on 192.168.1.1
Discovered open port 49152/tcp on 192.168.1.1
Completed SYN Stealth Scan at 10:47, 2.27s elapsed (1000 total ports)
Nmap scan report for localhost (192.168.1.1)
Host is up, received arp-response (0.0052s latency).
Scanned at 2016-12-22 10:47:09 ?D1ú±ê×?ê±?? for 3s
Not shown: 993 closed ports
Reason: 993 resets
PORT      STATE    SERVICE REASON
21/tcp    filtered ftp     no-response
22/tcp    filtered ssh     no-response
23/tcp    filtered telnet  no-response
53/tcp    open     domain  syn-ack ttl 64
80/tcp    open     http    syn-ack ttl 64
49152/tcp open     unknown syn-ack ttl 64
49153/tcp open     unknown syn-ack ttl 64
MAC Address: 68:89:C1:74:84:43 (Huawei Technologies)

Read data files from: C:\Program Files (x86)\Nmap
Nmap done: 1 IP address (1 host up) scanned in 2.92 seconds
           Raw packets sent: 1004 (44.160KB) | Rcvd: 998 (39.924KB)

自定义端口

nmap <目标 IP> -p <端口>

C:\Users\asus> nmap 192.168.1.1 -p 1-500

Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 10:59 ?D1ú±ê×?ê±??
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 192.168.1.1
Host is up (0.0061s latency).
Not shown: 495 closed ports
PORT   STATE    SERVICE
21/tcp filtered ftp
22/tcp filtered ssh
23/tcp filtered telnet
53/tcp open     domain
80/tcp open     http
MAC Address: 68:89:C1:74:84:43 (Huawei Technologies)

Nmap done: 1 IP address (1 host up) scanned in 2.08 seconds

端口可以是单个，也可以是多个，多个端口可以以逗号分隔，比如21,22,23,53,80，也可以使用短横线指定范围，比如1-1024。

Ping 扫描

nmap -sP <目标 IP>

Ping 扫描其实就是只执行主机发现，不扫描具体端口。大家可以看到结果中没有端口的信息，只告诉你主机通不通，所以也很快。

C:\Users\asus> nmap 192.168.1.1 -sP

Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 10:52 ?D1ú±ê×?ê±??
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 192.168.1.1
Host is up (0.0030s latency).
MAC Address: 68:89:C1:74:84:43 (Huawei Technologies)
Nmap done: 1 IP address (1 host up) scanned in 0.59 seconds

与之相反，有一个选项是只执行端口扫描，不执行主机发现的，是-PN（或-P0）。

C:\Users\asus> nmap 192.168.1.1 -PN

Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 10:54 ?D1ú±ê×?ê±??
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 192.168.1.1
Host is up (0.0062s latency).
Not shown: 993 closed ports
PORT      STATE    SERVICE
21/tcp    filtered ftp
22/tcp    filtered ssh
23/tcp    filtered telnet
53/tcp    open     domain
80/tcp    open     http
49152/tcp open     unknown
49153/tcp open     unknown
MAC Address: 68:89:C1:74:84:43 (Huawei Technologies)

Nmap done: 1 IP address (1 host up) scanned in 2.47 seconds

操作系统类型检测

nmap -O <目标 IP>

C:\Users\asus> nmap www.baidu.com -O

Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 11:03 ?D1ú±ê×?ê±??
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for www.baidu.com (61.135.169.125)
Host is up (0.0038s latency).
Other addresses for www.baidu.com (not scanned): 61.135.169.121
Not shown: 998 filtered ports
PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  https
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: switch
Running (JUST GUESSING): HP embedded (86%)
OS CPE: cpe:/h:hp:procurve_switch_4000m
Aggressive OS guesses: HP 4000M ProCurve switch (J4121A) (86%)
No exact OS matches for host (test conditions non-ideal).

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.35 seconds

组合扫描

比如我们要扫描1 ~ 1024 端口，详细输出，并且探测操作系统。

C:\Users\asus> nmap 192.168.1.1 -p 1-1024 -vv -O

Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 11:06 ?D1ú±ê×?ê±??
Initiating ARP Ping Scan at 11:06
Scanning 192.168.1.1 [1 port]
Completed ARP Ping Scan at 11:06, 0.14s elapsed (1 total hosts)
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Initiating SYN Stealth Scan at 11:06
Scanning 192.168.1.1 [1024 ports]
Discovered open port 53/tcp on 192.168.1.1
Discovered open port 80/tcp on 192.168.1.1
Completed SYN Stealth Scan at 11:06, 2.03s elapsed (1024 total ports)
Initiating OS detection (try #1) against 192.168.1.1
Retrying OS detection (try #2) against 192.168.1.1
Retrying OS detection (try #3) against 192.168.1.1
Retrying OS detection (try #4) against 192.168.1.1
Retrying OS detection (try #5) against 192.168.1.1
Nmap scan report for 192.168.1.1
Host is up, received arp-response (0.0014s latency).
Scanned at 2016-12-22 11:06:44 ?D1ú±ê×?ê±?? for 15s
Not shown: 1019 closed ports
Reason: 1019 resets
PORT   STATE    SERVICE REASON
21/tcp filtered ftp     no-response
22/tcp filtered ssh     no-response
23/tcp filtered telnet  no-response
53/tcp open     domain  syn-ack ttl 64
80/tcp open     http    syn-ack ttl 64
MAC Address: 68:89:C1:74:84:43 (Huawei Technologies)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.01%E=4%D=12/22%OT=53%CT=1%CU=37502%PV=Y%DS=1%DC=D%G=Y%M=6889C1%
OS:TM=585B4353%P=i686-pc-windows-windows)SEQ(SP=106%GCD=1%ISR=104%TI=Z%CI=Z
OS:%II=I%TS=U)SEQ(CI=Z%II=I%TS=U)SEQ(CI=Z%II=I)OPS(O1=M5B4NNSNW2%O2=M5B4NNS
OS:NW2%O3=M5B4NW2%O4=M5B4NNSNW2%O5=M5B4NNSNW2%O6=M5B4NNS)WIN(W1=16D0%W2=16D
OS:0%W3=16D0%W4=16D0%W5=16D0%W6=16D0)ECN(R=Y%DF=Y%T=40%W=16D0%O=M5B4NNSNW2%
OS:CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y
OS:%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%R
OS:D=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=
OS:40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S
OS:)

Network Distance: 1 hop
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: All zeros

Read data files from: C:\Program Files (x86)\Nmap
OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.21 seconds
           Raw packets sent: 1152 (54.954KB) | Rcvd: 1110 (48.462KB)

可以看出来没探测到什么东西，因为是路由器，大家这种情况认为是 Linux 就好了。

脚本（补充）

Nmap 有个叫做 NSE 的脚本引擎，也自带了一些脚本，更多脚本可以去官网下载。

脚本的类型有：

auth: 负责处理鉴权证书（绕开鉴权）的脚本  
broadcast: 在局域网内探查更多服务开启状况，如dhcp/dns/sqlserver等服务  
brute: 提供暴力破解方式，针对常见的应用如http/snmp等  
default: 使用-sC或-A选项扫描时候默认的脚本，提供基本脚本扫描能力  
discovery: 对网络进行更多的信息，如SMB枚举、SNMP查询等  
dos: 用于进行拒绝服务攻击  
exploit: 利用已知的漏洞入侵系统  
external: 利用第三方的数据库或资源，例如进行whois解析  
fuzzer: 模糊测试的脚本，发送异常的包到目标机，探测出潜在漏洞 intrusive: 入侵性的脚本，此类脚本可能引发对方的IDS/IPS的记录或屏蔽  
malware: 探测目标机是否感染了病毒、开启了后门等信息  
safe: 此类与intrusive相反，属于安全性脚本  
version: 负责增强服务与版本扫描（Version Detection）功能的脚本  
vuln: 负责检查目标机是否有常见的漏洞（Vulnerability），如是否有MS08_067

向命令行添加--script=<类型>来使用脚本。

下面演示了使用default脚本来探测主机上的服务。

C:\Users\asus> nmap --script=default 192.168.1.1

Starting Nmap 7.01 ( https://nmap.org ) at 2016-12-22 11:10 ?D1ú±ê×?ê±??
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using --system-dns or specify valid servers with --dns-servers
Nmap scan report for 192.168.1.1
Host is up (0.0051s latency).
Not shown: 993 closed ports
PORT      STATE    SERVICE
21/tcp    filtered ftp
22/tcp    filtered ssh
23/tcp    filtered telnet
53/tcp    open     domain
| dns-nsid:
|_  bind.version: dnsmasq-2.49
80/tcp    open     http
|_http-title: Site doesn't have a title (text/html).
49152/tcp open     unknown
49153/tcp open     unknown
MAC Address: 68:89:C1:74:84:43 (Huawei Technologies)

Nmap done: 1 IP address (1 host up) scanned in 13.48 seconds

米斯特白帽培训讲义工具篇 Nmap

米斯特白帽培训讲义工具篇 Nmap

介绍

下载

使用

简单扫描

显示详细结果

自定义端口

Ping 扫描

操作系统类型检测

组合扫描

脚本（补充）

参考

热门文章

最新文章

相关课程

相关电子书

相关实验场景

米斯特白帽培训讲义 工具篇 Nmap

米斯特白帽培训讲义 工具篇 Nmap

介绍

下载

使用

简单扫描

显示详细结果

自定义端口

Ping 扫描

操作系统类型检测

组合扫描

脚本（补充）

参考

热门文章

最新文章

相关课程

相关电子书

相关实验场景

米斯特白帽培训讲义工具篇 Nmap

米斯特白帽培训讲义工具篇 Nmap