网络相关的命令工具研究报告

　　在著名的黑客专用操作系统KaliLinux中有很多非常强大的工具，其中就包括nmap.根据名字我们大致可以猜测一下，n可能代表network，那么难道它可以画出“网络地图”或者说“网络拓扑图” ？让我们先来看一下它的参数说明：

通过下面的命令查看nmap的使用方法：

nmap --help

结果为：

Nmap 7.60 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL <inputfilename>: Input from list of hosts/networks
  -iR <num hosts>: Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile <exclude_file>: Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags <flags>: Customize TCP scan flags
  -sI <zombie host[:probeport]>: Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b <FTP relay host>: FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p <port ranges>: Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports <port ranges>: Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports consecutively - don't randomize
  --top-ports <number>: Scan <number> most common ports
  --port-ratio <ratio>: Scan ports more common than <ratio>
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity <level>: Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
  -sC: equivalent to --script=default
  --script=<Lua scripts>: <Lua scripts> is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=<Lua scripts>: Show help about scripts.
           <Lua scripts> is a comma-separated list of script-files or
           script-categories.
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take <time> are in seconds, or append 'ms' (milliseconds),
  's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
  -T<0-5>: Set timing template (higher is faster)
  --min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
  --min-parallelism/max-parallelism <numprobes>: Probe parallelization
  --min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
      probe round trip time.
  --max-retries <tries>: Caps number of port scan probe retransmissions.
  --host-timeout <time>: Give up on target after this long
  --scan-delay/--max-scan-delay <time>: Adjust delay between probes
  --min-rate <number>: Send packets no slower than <number> per second
  --max-rate <number>: Send packets no faster than <number> per second
FIREWALL/IDS EVASION AND SPOOFING:
  -f; --mtu <val>: fragment packets (optionally w/given MTU)
  -D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys
  -S <IP_Address>: Spoof source address
  -e <iface>: Use specified interface
  -g/--source-port <portnum>: Use given port number
  --proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies
  --data <hex string>: Append a custom payload to sent packets
  --data-string <string>: Append a custom ASCII string to sent packets
  --data-length <num>: Append random data to sent packets
  --ip-options <options>: Send packets with specified ip options
  --ttl <val>: Set IP time-to-live field
  --spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address
  --badsum: Send packets with a bogus TCP/UDP/SCTP checksum
OUTPUT:
  -oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,
     and Grepable format, respectively, to the given filename.
  -oA <basename>: Output in the three major formats at once
  -v: Increase verbosity level (use -vv or more for greater effect)
  -d: Increase debugging level (use -dd or more for greater effect)
  --reason: Display the reason a port is in a particular state
  --open: Only show open (or possibly open) ports
  --packet-trace: Show all packets sent and received
  --iflist: Print host interfaces and routes (for debugging)
  --append-output: Append to rather than clobber specified output files
  --resume <filename>: Resume an aborted scan
  --stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
  --webxml: Reference stylesheet from Nmap.Org for more portable XML
  --no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
  -6: Enable IPv6 scanning
  -A: Enable OS detection, version detection, script scanning, and traceroute
  --datadir <dirname>: Specify custom Nmap data file location
  --send-eth/--send-ip: Send using raw ethernet frames or IP packets
  --privileged: Assume that the user is fully privileged
  --unprivileged: Assume the user lacks raw socket privileges
  -V: Print version number
  -h: Print this help summary page.
EXAMPLES:
  nmap -v -A scanme.nmap.org
  nmap -v -sn 192.168.0.0/16 10.0.0.0/8
  nmap -v -iR 10000 -Pn -p 80
SEE THE MAN PAGE (https://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES

点开后先不要被密密麻麻的字母吓到，我们仔细观察一下后不难发现，nmap有多种不同的功能，并且每种功能都有详细的参数说明以及示例。简单总结一下：

Nmap包含四项基本功能：

1. 主机发现（Host Discovery）
2. 端口扫描（Port Scanning）
3. 版本侦测（Version Detection）
4. 操作系统侦测（Operating System Detection）

下面我将依次演示不同功能的使用方法。

1.主机发现

主机发现就是看看互联网上某个主机是不是在线。

原理：和ping命令类似，发送探测包到目标主机。如果收到了回复，那么目标主机是开启的。

 

使用示例：

nmap -sn www.ustc.edu.cn

查看结果：

Starting Nmap 7.60 ( https://nmap.org ) at 2019-11-28 22:26 CST
Nmap scan report for www.ustc.edu.cn (218.22.21.21)
Host is up (0.023s latency).
rDNS record for 218.22.21.21: 21.21.22.218.broad.static.hf.ah.cndata.com
Nmap done: 1 IP address (1 host up) scanned in 0.13 seconds

我们可以看到主机（www.ustc.edu.cn）是在线的。

2.端口扫描

端口扫描就是查看目标主机开放了哪些端口。找到开放的端口往往可以为入侵提供决策依据。

使用示例：

nmap –sS –sU –T4 –top-ports 10 www.ustc.edu.cn

在看结果之前先解释一下参数的含义。-sS表示使用TCP SYN方式扫描TCP端口；-sU表示扫描UDP端口；-T4表示时间级别配置4级；--top-ports 10表示扫描最有可能开放的10个端口

查看结果：

Nmap scan report for www.ustc.edu.cn (218.22.21.21)
Host is up (0.021s latency).
rDNS record for 218.22.21.21: 21.21.22.218.broad.static.hf.ah.cndata.com
Not shown: 995 filtered ports
PORT     STATE SERVICE
80/tcp   open  http
443/tcp  open  https
3000/tcp open  ppp
8000/tcp open  http-alt
8443/tcp open  https-alt

我们可以看到主机（www.ustc.edu.cn）开放的端口。根据经验，22端口很可能也是开放的，但是为了安全起见我们很难扫描出。

3.版本侦测

版本侦测可以探测出主机使用的软件版本。

使用示例：

nmap -sV www.ustc.edu.cn

查看结果：

Nmap scan report for www.ustc.edu.cn (218.22.21.21)
Host is up (0.018s latency).
rDNS record for 218.22.21.21: 21.21.22.218.broad.static.hf.ah.cndata.com
Not shown: 995 filtered ports
PORT     STATE SERVICE    VERSION
80/tcp   open  http       nginx
443/tcp  open  ssl/http   nginx
3000/tcp open  http       nginx
8000/tcp open  http       Apache httpd 2.2.15 ((CentOS))
8443/tcp open  tcpwrapped

可以看到主机（www.ustc.edu.cn）使用了nginx等软件服务。

4.操作系统探测

nmap可以检测出主机使用的是什么操作系统。当然目标主机自己不会告诉你它是什么系统的主机，得靠nmap来仔细分辨目标主机的”口音“。由于互联网中许多协议在不同操作系统中实现略有差异，因此可以根据这些差异来分辨操作系统。

使用示例：

nmap -O www.ustc.edu.cn

查看结果：

TCP/IP fingerprinting (for OS scan) requires root privileges.
QUITTING!

显然，我们需要root权限来执行此命令。

sudo nmap -O www.ustc.edu.cn

结果为：

Starting Nmap 7.60 ( https://nmap.org ) at 2019-11-28 22:47 CST
Nmap scan report for www.ustc.edu.cn (218.22.21.21)
Host is up (0.020s latency).
rDNS record for 218.22.21.21: 21.21.22.218.broad.static.hf.ah.cndata.com
Not shown: 995 filtered ports
PORT     STATE SERVICE
80/tcp   open  http
443/tcp  open  https
3000/tcp open  ppp
8000/tcp open  http-alt
8443/tcp open  https-alt
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3.10
OS details: Linux 3.10

可以看出主机（www.ustc.edu.cn）运行的是linux系统，但内核版本只有3.X，而现在的最新版本基本都5.X。这也不足为奇，因为目标主机是一台服务器，更看重稳定性。

 

关于nmap的基本用法就简单介绍这些，如果需要了解更多，请访问https://nmap.org/