上節課我們已經介紹了nmap的安裝使用方法,這節課我們來看下如何使用nmap
- ping 掃描 選項參數 -sP 可以顯示出在線主機,然後回顯做出相應的主機. 優點: 使用ping掃描,可以輕易的獲取目標信息而不會被輕易發現.也不會返回太多的信息造成對分析的干擾.
[root@xinsz08 ~]# nmap -sP 192.168.1.102/24 Starting Nmap 7.60 ( https://nmap.org ) at 2017-10-11 12:37 CST Nmap scan report for 192.168.1.1 Host is up (0.011s latency). MAC Address: 1C:60:DE:BE:D6:38 (Shenzhen Mercury Communication Technologies) Nmap scan report for 192.168.1.104 #發現存活主機104 Host is up (0.00010s latency). #確定當前主機是存活的 MAC Address: 7A:20:0B:97:C8:FC (Unknown) #主機的MAC地址 Nmap scan report for 192.168.1.105 Host is up (0.000082s latency). MAC Address: 00:0C:29:23:88:15 (VMware) Nmap scan report for 192.168.1.102 Host is up. Nmap done: 256 IP addresses (4 hosts up) scanned in 2.10 seconds
2.無ping掃描
如果對方開啓了防火牆,有時候我們需要在防火牆禁止ping的情況下,確定正在運行的主機
參數選項:
-P0 可以穿透防火牆,也儘可能的避免被防火牆發現
注意: 第二個不是字母,而是數字0
[root@xinsz08 ~]# nmap -P0 192.168.1.104 Starting Nmap 7.60 ( https://nmap.org ) at 2017-10-11 12:48 CST Nmap scan report for 192.168.1.104 Host is up (0.00021s latency). Not shown: 991 closed ports PORT STATE SERVICE 135/tcp open msrpc 139/tcp open netbios-ssn 443/tcp open https 445/tcp open microsoft-ds 902/tcp open iss-realsecure 912/tcp open apex-mesh 2869/tcp open icslap 3306/tcp open mysql 5357/tcp open wsdapi MAC Address: 7A:20:0B:97:C8:FC (Unknown) Nmap done: 1 IP address (1 host up) scanned in 1.45 seconds 一般情況下我們也會指定nmap協議, 如果不指定 nmap默認使用協議1,2,4
關於nmap的協議如下:
- TCP :對應協議編號爲6
- ICMP:對應協議編號爲1
- IGMP:對應協議編號爲2
- UDP:對應協議編號爲17
所以我們可以指定協議向目標主機發包確定目標主機是否在線
[root@xinsz08 ~]# nmap -P06,17,2 baidu.com Starting Nmap 7.60 ( https://nmap.org ) at 2017-10-11 12:56 CST Nmap scan report for baidu.com (111.13.101.208) Host is up (0.030s latency). Other addresses for baidu.com (not scanned): 220.181.57.217 123.125.114.144 Not shown: 998 filtered ports PORT STATE SERVICE 80/tcp open http 443/tcp open https Nmap done: 1 IP address (1 host up) scanned in 4.60 seconds
3.路由跟蹤
使用--traceroute 進行路由跟蹤,通過這個選項可以輕鬆的查出從本地計算機到目標主機之間所經過的網絡節點.
[root@xinsz08 ~]# nmap --traceroute -v www.baidu.com Starting Nmap 7.60 ( https://nmap.org ) at 2017-10-11 14:03 CST Initiating Ping Scan at 14:03 Scanning www.baidu.com (119.75.216.20) [4 ports]
#此處解析出百度服務器地址
Completed Ping Scan at 14:03, 0.05s elapsed (1 total hosts) (省略部分文字) Nmap scan report for www.baidu.com (119.75.216.20) Host is up (0.0092s latency). Other addresses for www.baidu.com (not scanned): 119.75.213.61 Not shown: 998 filtered ports PORT STATE SERVICE 80/tcp open http 443/tcp open https TRACEROUTE (using port 80/tcp)
#經過百度服務器80端口
HOP RTT ADDRESS 1 1.92 ms 192.168.1.1 2 3.42 ms 100.83.48.1 3 6.30 ms 10.128.130.36 4 6.12 ms 10.128.130.41 5 4.80 ms 10.11.68.1 6 8.60 ms 103.216.40.11 7 ... 9 10 5.29 ms 119.75.216.20 Nmap done: 1 IP address (1 host up) scanned in 7.29 seconds Raw packets sent: 2021 (88.900KB) | Rcvd: 13 (660B)
總結: nmap對於主機存活發現的方法還有很多,在這裏我們列舉了三個,在日常工作中使用任意一個即可.