读书笔记 ~ Nmap渗透测试指南
记录Nmap选项及脚本使用,仅供参考...
除了端口扫描,好像其它脚本都比较鸡肋,用途感觉应该没有专用的小工具好用,不过还是可以看看,选项和脚本还是相当的丰富的。
Nmap 使用帮助
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
starnight:~ starnight$ nmap Nmap 7.40 ( https://nmap.org ) Usage: nmap [Scan Type(s)] [Options] {target specification} TARGET SPECIFICATION: Can pass hostnames, IP addresses, networks, etc. Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254 -iL <inputfilename>: Input from list of hosts/networks -iR <num hosts>: Choose random targets --exclude <host1[,host2][,host3],...>: Exclude hosts/networks --excludefile <exclude_file>: Exclude list from file HOST DISCOVERY: -sL: List Scan - simply list targets to scan -sn: Ping Scan - disable port scan -Pn: Treat all hosts as online -- skip host discovery -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes -PO[protocol list]: IP Protocol Ping -n/-R: Never do DNS resolution/Always resolve [default: sometimes] --dns-servers <serv1[,serv2],...>: Specify custom DNS servers --system-dns: Use OS's DNS resolver --traceroute: Trace hop path to each host SCAN TECHNIQUES: -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans -sU: UDP Scan -sN/sF/sX: TCP Null, FIN, and Xmas scans --scanflags <flags>: Customize TCP scan flags -sI <zombie host[:probeport]>: Idle scan -sY/sZ: SCTP INIT/COOKIE-ECHO scans -sO: IP protocol scan -b <FTP relay host>: FTP bounce scan PORT SPECIFICATION AND SCAN ORDER: -p <port ranges>: Only scan specified ports Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9 --exclude-ports <port ranges>: Exclude the specified ports from scanning -F: Fast mode - Scan fewer ports than the default scan -r: Scan ports consecutively - don't randomize --top-ports <number>: Scan <number> most common ports --port-ratio <ratio>: Scan ports more common than <ratio> SERVICE/VERSION DETECTION: -sV: Probe open ports to determine service/version info --version-intensity <level>: Set from 0 (light) to 9 (try all probes) --version-light: Limit to most likely probes (intensity 2) --version-all: Try every single probe (intensity 9) --version-trace: Show detailed version scan activity (for debugging) SCRIPT SCAN: -sC: equivalent to --script=default --script=<Lua scripts>: <Lua scripts> is a comma separated list of directories, script-files or script-categories --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts --script-args-file=filename: provide NSE script args in a file --script-trace: Show all data sent and received --script-updatedb: Update the script database. --script-help=<Lua scripts>: Show help about scripts. <Lua scripts> is a comma-separated list of script-files or script-categories. OS DETECTION: -O: Enable OS detection --osscan-limit: Limit OS detection to promising targets --osscan-guess: Guess OS more aggressively TIMING AND PERFORMANCE: Options which take <time> are in seconds, or append 'ms' (milliseconds), 's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m). -T<0-5>: Set timing template (higher is faster) --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes --min-parallelism/max-parallelism <numprobes>: Probe parallelization --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies probe round trip time. --max-retries <tries>: Caps number of port scan probe retransmissions. --host-timeout <time>: Give up on target after this long --scan-delay/--max-scan-delay <time>: Adjust delay between probes --min-rate <number>: Send packets no slower than <number> per second --max-rate <number>: Send packets no faster than <number> per second FIREWALL/IDS EVASION AND SPOOFING: -f; --mtu <val>: fragment packets (optionally w/given MTU) -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys -S <IP_Address>: Spoof source address -e <iface>: Use specified interface -g/--source-port <portnum>: Use given port number --proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies --data <hex string>: Append a custom payload to sent packets --data-string <string>: Append a custom ASCII string to sent packets --data-length <num>: Append random data to sent packets --ip-options <options>: Send packets with specified ip options --ttl <val>: Set IP time-to-live field --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address --badsum: Send packets with a bogus TCP/UDP/SCTP checksum OUTPUT: -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3, and Grepable format, respectively, to the given filename. -oA <basename>: Output in the three major formats at once -v: Increase verbosity level (use -vv or more for greater effect) -d: Increase debugging level (use -dd or more for greater effect) --reason: Display the reason a port is in a particular state --open: Only show open (or possibly open) ports --packet-trace: Show all packets sent and received --iflist: Print host interfaces and routes (for debugging) --append-output: Append to rather than clobber specified output files --resume <filename>: Resume an aborted scan --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML --webxml: Reference stylesheet from Nmap.Org for more portable XML --no-stylesheet: Prevent associating of XSL stylesheet w/XML output MISC: -6: Enable IPv6 scanning -A: Enable OS detection, version detection, script scanning, and traceroute --datadir <dirname>: Specify custom Nmap data file location --send-eth/--send-ip: Send using raw ethernet frames or IP packets --privileged: Assume that the user is fully privileged --unprivileged: Assume the user lacks raw socket privileges -V: Print version number -h: Print this help summary page. EXAMPLES: nmap -v -A scanme.nmap.org nmap -v -sn 192.168.0.0/16 10.0.0.0/8 nmap -v -iR 10000 -Pn -p 80 SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES
具体使用如下:
1、 -A : 全面扫描/综合扫描 [-A: Enable OS detection, version detection, script scanning, and traceroute]
2、 Nmap TCP/IP协议栈指纹
测试 | 描述 |
T1 | 发送TCP数据包(Flag = SYN)到开放TCP端口 |
T2 | 发送一个空的TCP数据包到开放TCP端口 |
T3 | 发送TCP数据包(Flag=SYN,URG,PSH,FIN)到开放端口 |
T4 | 发送TCP数据包(Flag=ACK)到开放TCP端口 |
T5 | 发送TCP数据包(Flag=SYN)到关闭的TCP端口 |
T6 | 发送TCP数据包(Flag=ACK)到关闭TCP端口 |
T7 | 发送TCP数据包(Flag=URG,PSH,PSH,FIN)到关闭的TCP端口 |
3、--packet-trace : 查看交互的数据包
选项 | 解释 |
-sP | ping 扫描 [探测主机存活,不容易被发现] |
-P0 | 无ping扫描[用于防火墙禁止ping的情况下,可以穿透防火墙,避免被防火墙发现] |
-PS | TCP SYN Ping扫描[通过SYN/ACK和RST相应来对目标主机是否存活进行判断] |
-PA | TCP ACK Ping扫描 |
-PU | UDP Ping扫描[发送一个空的UDP报文到指定端口,默认40125, 如果目标主机响应则返回一个ICMP端口不可达错误,如果目标主机不是存活状态则会返回各种ICMP错误信息] |
-PE;-PP;-PM | ICMP Ping Type扫描 |
-PR | ARP Ping扫描[内网使用] |
-sL | 列表扫描 |
-n | 禁止DNS反向解析[较少使用] |
-R | 反向解析域名[] |
--system-dns | 使用系统域名解析器 |
-6 | 扫描IPv6地址 |
--traceroute | 路由跟踪 |
-PY | SCTP INIT Ping 扫描 |
4、时序选项 -T (0-5)
-T0(偏执的):非常慢的扫描,用于IDS逃避。
-T1(鬼祟的):缓慢的扫描,用于IDS逃避。
-T2(文雅的):降低速度以降低对带宽的消耗,此选项一般不常用。
-T3(普通的):默认,根据目标的反应自动调整时间。
-T4(野蛮的):快速扫描,常用扫描方式,需要在很好的网络环境下进行扫描,请求可能会淹没目标。【在带宽允许的情况下,一般可以使用-T4进行扫描】
-T5(疯狂的):急速扫描,这种扫描方式以牺牲准确度来提升扫描速度。
5、
-sI: 空闲扫描, 允许进行端口完全欺骗扫描 nmap -sI www.0day.co:80 192.168.1.205 [并未成功]
-sO:IP协议扫描
选项 | 解释 |
-p | -F | 常用的扫描方式[-p指定端口 | -F 执行快速扫描] |
-sS | TCP SYN扫描[半开放扫描,扫描速度高且隐蔽性好] |
-sT | TCP 连接扫描[最基础、最稳定的扫描方式] |
-sU | UDP端口扫描 |
-sN;-sF;-sX | 隐蔽扫描 -sN:Null扫描 ,-sF:FIN扫描,穿透效果好,-sX:Xmas扫描 |
-sA | TCP ACK扫描 |
-sW | TCP 窗口扫描 |
-sM | TCP Maimon扫描 |
--scanflags | 自定义TCP扫描[只要是URG、ACK、PSH、RST、SYN、FIN的任何组合都可以] |
6、指纹识别与探测
选项 | 解释 |
-sV | 版本探测 |
--allports | 全端口版本探测,扫描全部端口,除了TCP 9100 |
--version-intensity | 设置扫描强度 (0~9,默认7) |
--version-light | 轻量级扫描 |
--version-all | 重量级扫描 |
--version-trace | 获取详细版本信息 |
-sR | RPC扫描[用于确认是否是RPC端口] |
-O | 启用操作系统探测 |
--osscan-limit | 对指定的目标系统进行操作系统探测 |
--osscan-guess; --fuzzy | 推荐系统识别 |
7、定时选项
选项 | 解释 |
--min-hostgroup | 调整并行扫描组的大小 |
--min-parallelism --max-parallelism |
调整探测报文的并行度 |
--min-rtt-timeout --max-rtt-timeout --initial-rtt-timeout |
调整探测报文超时 |
--host-timeout | 放弃低俗目标机器 |
--scan-delay --max-scan-delay |
调整探测报文的时间间隔 |
8、防火墙/IDS逃逸
选项 | 解释 |
-f | 报文分段[一些主机会禁止ICMP请求,可以使用报文分段的方法来逃避目标防火墙的规则] |
--mtu | 指定偏移大小[偏移量为8的整数倍,用来逃逸防火墙/IDS] |
-D nmap -D [decoy1, decoy2...|RND:number][destination] |
IP欺骗 nmap -D RND:11 192.168.1.111 [随机构造11个IP对目标进行扫描] |
-sI | 源地址欺骗 |
--source-port | 源端口欺骗 |
--data-length | 指定发包长度[通常TCP包是40字节,ICMP Echo 28字节,可以指定附加随机数据来达到规避防火墙的目的] |
--randomize-hosts | 目标主机随机排序[ 配合时间选项使用更好 ] |
--spoof-mac |
MAC地址欺骗 [0:随机生成一个MAC地址、MAC Address:指定一个MAC地址、Vendor Name:从指定厂商生成一个MAC地址] |
9、信息收集: 脚本在 kali : /usr/share/nmap/scripts
脚本 | 解释 |
--script ip-geolocation-* |
IP信息收集 |
whois-domain / whois-ip | WHOIS查询 |
http-email-harvest [not found] | 收集E-mail信息 |
hostmap-ip2hosts | IP反查 |
dns-brute |
DNS信息收集 [默认五个线程] nmap --script dns-brute dns-brute.threads=10 www.xxx.com |
membase-http-info | 检索系统信息 |
smb-security-mode | 后台打印机服务漏洞 |
http-stored-xss | 扫描web漏洞 |
snmp-win32-services | 通过snmp列举Windows服务/账户 |
dns-brute |
枚举DNS服务器的主机名 nmap --script dns-brute --script-args dns-brute.domain=baidu.com |
http-headers/http-sitemap-generator | HTTP信息收集 |
ssl-enum-ciphers | 枚举SSL密钥 |
ssh-hostkey | SSH服务密钥信息探测 |
10、 数据库渗透测试
脚本 | 解释 |
mysql-databases |
MySQL列举数据库 nmap -p3306 --script mysql-databases --script-args mysqluser=root,mysqlpass= 192.168.1.110 |
mysql-variables | 列举MySQL变量[好像并未成功] |
mysql-empty-password | 检查MySQL空密码 |
mysql-brute |
审计MySQL密码 mysql -p3306 --script=mysql-brute 192.168.1.110 nmap -p3306 --script=mysql-brute userdb=/root/user.txt passdb=/root/pass.txt 192.168.1.110 |
mysql-audit | 设计MySQL安全配置[未成功] |
oracle-brute | 审计Oracle密码[未测试] |
ms-sql-brute | 设计MSSQL密码[未测试] |
ms-sql-empty-password | 检查MSSQL密码[未测试] |
ms-sql-tables | 读取MSSQL数据[未测试] |
ms-sql-xp-cmdshell | MSSQL执行系统命令[未测试] |
pgsql-brute | 设计postgresql密码[未测试] |
11、渗透测试
脚本 | 解释 |
http-brute | 审计HTTP身份验证 |
ftp-brute | 审计FTP服务器 |
http-wordpress-brute | 审计WordPress程序 |
http-joomla-brute | 审计Joomla程序 |
pop3-brute | 设计邮件服务器 |
smb-brute | 审计SMB口令 |
vns-brute | 审计VNC服务器 |
smtp-brute smtp-enum-users |
审计SMTP服务器 |
stuxnet-detect | 检测Stuxnet蠕虫 |
snmp-netstat snmp-process snmp-win32-services snmp-brute |
SNMP服务安全审计 |
12、--iflist : 列举接口和路由
13、-oG : 继续终端扫描
nmap -oG 1.txt -v 192.168.1.110
nmap --resume 1.txt
14、firewalk : 探测防火墙
nmap --script=firewalk --traceroute 192.168.1.110
15、-oN 标准格式保存扫描结果
nmap -oN 1.txt 192.168.1.110
-------------------------------------------
个性签名:如果世上的事都按你说的道理走 世界就不是现在这样了!
如果觉得这篇文章对你有小小的帮助的话,记得在右下角点个“推荐”哦,博主在此感谢!