Information collection port scanning tool nmap instructions

Catalog

  0x01 install
  0x02 Scan command

0x01 install

Mac os:

brew install nmap

Centos:

yum install nmap

Ubuntu:

apt-get install nmap

0x02 Scan command

grammar

nmap [scan type] [option] [target]

command

command	describe
-sT	TCP, Basic TCP Scanning mode . This kind of scanning is very Easy to detect To , A large number of connection requests and error messages will be recorded in the log of the target host
-sS	SYN, Synchronous scanning , Send only SYN package , So this technology is called semi open scanning , The advantage is , Not easy to detect , Few systems can record this into the log system , But I need root Permission customization SYN package
-sU	UDP, What scanning has opened UDP port
-sP	ICMP,ping scanning , Detect which hosts are online
-P0	Before scanning , No ping host
-PT	Before scanning , Use TCP ping Determine which hosts are running
-PI	Set this option , Give Way namp Use the real ping(ICMP echo request ) To scan whether the target host is running
-p T:n1,n2…	What scanning has opened TCP port
-PS	TCP ACK scanning
-PA	TCP SYN scanning
-sR	RPC scanning , Combined with other different port scanning methods
-sn	Disable Port Scan
-sA	ACK scanning , Detect firewalls , This advanced scanning method usually It can be used to pass through the firewall
-PB	This is the default ping Scanning options , It USES ACK(-PT) and ICMP(-PI) The two scan types are scanned in parallel . If the firewall can filter one of the packets , Using this method , You can go through the firewall
-sW	Swipe window scan , Very similar to ACK scanning
-sN	TCP Empty scan spoofing firewall
-PN	Detect firewalls
-b	FTP Rebound attack , Connect to one behind the firewall FTP The server acts as an agent , Then we do a port scan
-A	Scan the operating system and route tracking
-O	Detect the operating system
-iflist	Display interface and routing information
-sV	Check the version of the service
-p	Specified port scan
-v	Enhanced scanning , give Details of the scanning process
-F	Quick scan
-r	Scan... In order
-I	open nmap The reverse flag scanning function of
-f	Use debris IP Data packets send out SYN、FIN、XMAS、NULL. Packet filter is added to the packet filter 、 The difficulty of intrusion detection system , Make it impossible to know what you're trying to do .
-S	Set source IP
-g port	Set source port , If the attacker modifies the source port to 20 perhaps 53, You can destroy the firewall protection
-M count	TCP When the scan , How many sockets can be used for parallel scanning at most
-T4	Specify the timing used in the scanning process , There is always 6 A level （0-5）, The higher the level , The faster the scan , But it's also easy to be firewall or IDS Detect and screen out , When the network communication is in good condition Recommended T4
-iR number	Yes Random generation number Scan addresses

Set the time

Parameters	describe
-‌-host_timeout	Time to scan a host , millisecond In units of , Usually selected value ：18000
-‌-scan-delay	Message interval , millisecond In units of , Usually selected value ：1000
-‌-max_rtt_timeout	Set each probe Waiting time , millisecond In units of , If it exceeds, it will be retransmitted
-‌-min_rtt_timeout	Every time we probe At least the waiting time , With millisecond In units of

File export

Parameters	describe
-oN	Will result in Export to A readable file logfilename
-oX test.xml	The scan results Generate test.xml file , If interrupted , The result is not to open
-oA test.xml	The scan results Generate test.xml file , After interruption , The results can also be saved
-oG test.txt	The scan results Generate test.txt file

Multiple scans

command	describe
namp IP1 IP2…	Scan multiple IP
namp 192.168.0.1,3,5,7…	Scan multiple IP
namp 192.168.0.*	Scan the entire subnet
namp 192.168.1-10.*	Scan multiple subnets
nmap -iL xxx.txt	Scan multiple according to the file IP
namp 192.168.0.10-100	Scanning range IP