Nmap参考指南(官方文档)

Nmap参考指南描述译注选项概要目标说明主机发现端口扫描基础端口扫描技术端口说明和扫描顺序服务和版本探测操作系统探测时间和性能防火墙/IDS躲避和哄骗输出其它选项运行时的交互实例Bugs作者法律事项(版权、许可证、担保(缺)、出口限制)Unofficial Translation Disclaimer/非官方翻译声明Namenmap —网络探测工具和安全/端口扫描器Synopsisnmap [ <扫描类型> ...] [ <选项> ] { <扫描目标说明> }描述Nmap(“Network Mapper(网络映射器)”)是一款开放源代码的网络探测和安全审核的工具。

它的设计目标是快速地扫描大型网络，当然用它扫描单个主机也没有问题。

Nmap以新颖的方式使用原始IP报文来发现网络上有哪些主机，那些主机提供什么服务(应用程序名和版本)，那些服务运行在什么操作系统(包括版本信息)，它们使用什么类型的报文过滤器/防火墙，以及一堆其它功能。

虽然Nmap通常用于安全审核，许多系统管理员和网络管理员也用它来做一些日常的工作，比如查看整个网络的信息，管理服务升级计划，以及监视主机和服务的运行。

Nmap输出的是扫描目标的列表，以及每个目标的补充信息，至于是哪些信息则依赖于所使用的选项。

“所感兴趣的端口表格”是其中的关键。

那张表列出端口号，协议，服务名称和状态。

状态可能是open(开放的)，filtered(被过滤的)，closed(关闭的)，或者unfiltered(未被过滤的)。

Open(开放的)意味着目标机器上的应用程序正在该端口监听连接/报文。

filtered(被过滤的) 意味着防火墙，过滤器或者其它网络障碍阻止了该端口被访问，Nmap无法得知它是open(开放的) 还是closed(关闭的)。

closed(关闭的) 端口没有应用程序在它上面监听，但是他们随时可能开放。

当端口对Nmap的探测做出响应，但是Nmap无法确定它们是关闭还是开放时，这些端口就被认为是unfiltered(未被过滤的)如果Nmap报告状态组合open|filtered和closed|filtered时，那说明Nmap无法确定该端口处于两个状态中的哪一个状态。

当要求进行版本探测时，端口表也可以包含软件的版本信息。

当要求进行IP协议扫描时(-sO)，Nmap提供关于所支持的IP协议而不是正在监听的端口的信息。

除了所感兴趣的端口表，Nmap还能提供关于目标机的进一步信息，包括反向域名，操作系统猜测，设备类型，和MAC地址。

一个典型的Nmap扫描如Example 1, “一个典型的Nmap扫描”所示。

在这个例子中，唯一的选项是-A，用来进行操作系统及其版本的探测，-T4可以加快执行速度，接着是两个目标主机名。

Example 1.一个典型的Nmap扫描# nmap -A -T4 playgroundStarting nmap ( /nmap/ )Interesting ports on (205.217.153.62):(The 1663 ports scanned but not shown below are in state: filtered)port STATE SERVICE VERSION22/tcp open ssh OpenSSH 3.9p1 (protocol 1.99)53/tcp open domain70/tcp closed gopher80/tcp open http Apache httpd 2.0.52 ((Fedora))113/tcp closed authDevice type: general purposeRunning: Linux 2.4.X|2.5.X|2.6.XOS details: Linux 2.4.7 - 2.6.11，Linux 2.6.0 - 2.6.11Uptime 33。

908 days (since Thu Jul 21 03:38:03 2005)Interesting ports on playground。

nmap。

或者g (192.168.0.40):(The 1659 ports scanned but not shown below are in state: closed)port STATE SERVICE VERSION135/tcp open msrpc Microsoft Windows RPC139/tcp open netbios-ssn389/tcp open ldap?445/tcp open microsoft-ds Microsoft Windows XP microsoft-ds1002/tcp open windows-icfw?1025/tcp open msrpc Microsoft Windows RPC1720/tcp open H.323/Q.931 CompTek AquaGateKeeper5800/tcp open vnc-http RealVNC 4.0 (Resolution 400x250; VNC TCP port: 5900)5900/tcp open vnc VNC (protocol 3.8)MAC Address: 00:A0:CC:63:85:4B (Lite-on Communications)Device type: general purposeRunning: Microsoft Windows NT/2K/XPOS details: Microsoft Windows XP Pro RC1+ through final releaseService Info: OSs: Windows，Windows XPNmap finished: 2 IP addresses (2 hosts up) scanned in 88.392 seconds译注该Nmap参考指南中文版由Fei Yang<fyang1024@>和Lei Li<lilei_721@>从英文版本翻译而来。

我们希望这将使全世界使用中文的人们更了解Nmap，但我们不能保证该译本和官方的英文版本一样完整，也不能保证同步更新。

它可以在Creative Commons Attribution License下被修改并重新发布。

选项概要当Nmap不带选项运行时，该选项概要会被输出，最新的版本在这里/nmap/data/age.txt。

它帮助人们记住最常用的选项，但不能替代本手册其余深入的文档，一些晦涩的选项甚至不在这里。

Nmap 6.47SVN ( )Usage: nmap [Scan Type(s)] [Options] {target specification}TARGET SPECIFICATION:Can pass hostnames, IP addresses, networks, etc.Ex: , /24, 192.168.0.1; 10.0.0-255.1-254-iL <inputfilename>: Input from list of hosts/networks-iR <num hosts>: Choose random targets--exclude <host1[,host2][,host3],...>: Exclude hosts/networks--excludefile <exclude_file>: Exclude list from fileHOST DISCOVERY:-sL: List Scan - simply list targets to scan-sn: Ping Scan - disable port scan-Pn: Treat all hosts as online -- skip host discovery-PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes-PO[protocol list]: IP Protocol Ping-n/-R: Never do DNS resolution/Always resolve [default: sometimes]--dns-servers <serv1[,serv2],...>: Specify custom DNS servers--system-dns: Use OS's DNS resolver--traceroute: Trace hop path to each hostSCAN TECHNIQUES:-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans-sU: UDP Scan-sN/sF/sX: TCP Null, FIN, and Xmas scans--scanflags <flags>: Customize TCP scan flags-sI <zombie host[:probeport]>: Idle scan-sY/sZ: SCTP INIT/COOKIE-ECHO scans-sO: IP protocol scan-b <FTP relay host>: FTP bounce scanPORT SPECIFICATION AND SCAN ORDER:-p <port ranges>: Only scan specified portsEx: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9--exclude-ports <port ranges>: Exclude the specified ports from scanning-F: Fast mode - Scan fewer ports than the default scan-r: Scan ports consecutively - don't randomize--top-ports <number>: Scan <number> most common ports--port-ratio <ratio>: Scan ports more common than <ratio>SERVICE/VERSION DETECTION:-sV: Probe open ports to determine service/version info--version-intensity <level>: Set from 0 (light) to 9 (try all probes)--version-light: Limit to most likely probes (intensity 2)--version-all: Try every single probe (intensity 9)--version-trace: Show detailed version scan activity (for debugging)SCRIPT SCAN:-sC: equivalent to --script=default--script=<Lua scripts>: <Lua scripts> is a comma separated list ofdirectories, script-files or script-categories--script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts--script-args-file=filename: provide NSE script args in a file--script-trace: Show all data sent and received--script-updatedb: Update the script database.--script-help=<Lua scripts>: Show help about scripts.<Lua scripts> is a comma-separated list of script-files orscript-categories.OS DETECTION:-O: Enable OS detection--osscan-limit: Limit OS detection to promising targets--osscan-guess: Guess OS more aggressivelyTIMING AND PERFORMANCE:Options which take <time> are in seconds, or append 'ms' (milliseconds), 's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).-T<0-5>: Set timing template (higher is faster)--min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes--min-parallelism/max-parallelism <numprobes>: Probe parallelization--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifiesprobe round trip time.--max-retries <tries>: Caps number of port scan probe retransmissions.--host-timeout <time>: Give up on target after this long--scan-delay/--max-scan-delay <time>: Adjust delay between probes--min-rate <number>: Send packets no slower than <number> per second--max-rate <number>: Send packets no faster than <number> per second FIREWALL/IDS EVASION AND SPOOFING:-f; --mtu <val>: fragment packets (optionally w/given MTU)-D <decoy1,decoy2[,ME],...>: Cloak a scan with decoys-S <IP_Address>: Spoof source address-e <iface>: Use specified interface-g/--source-port <portnum>: Use given port number--proxies <url1,[url2],...>: Relay connections through HTTP/SOCKS4 proxies --data <hex string>: Append a custom payload to sent packets--data-string <string>: Append a custom ASCII string to sent packets--data-length <num>: Append random data to sent packets--ip-options <options>: Send packets with specified ip options--ttl <val>: Set IP time-to-live field--spoof-mac <mac address/prefix/vendor name>: Spoof your MAC address--badsum: Send packets with a bogus TCP/UDP/SCTP checksumOUTPUT:-oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,and Grepable format, respectively, to the given filename.-oA <basename>: Output in the three major formats at once-v: Increase verbosity level (use -vv or more for greater effect)-d: Increase debugging level (use -dd or more for greater effect)--reason: Display the reason a port is in a particular state--open: Only show open (or possibly open) ports--packet-trace: Show all packets sent and received--iflist: Print host interfaces and routes (for debugging)--log-errors: Log errors/warnings to the normal-format output file--append-output: Append to rather than clobber specified output files--resume <filename>: Resume an aborted scan--stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML--webxml: Reference stylesheet from for more portable XML--no-stylesheet: Prevent associating of XSL stylesheet w/XML output MISC:-6: Enable IPv6 scanning-A: Enable OS detection, version detection, script scanning, and traceroute--datadir <dirname>: Specify custom Nmap data file location--send-eth/--send-ip: Send using raw ethernet frames or IP packets--privileged: Assume that the user is fully privileged--unprivileged: Assume the user lacks raw socket privileges-V: Print version number-h: Print this help summary page.EXAMPLES:nmap -v -A nmap -v -sn 192.168.0.0/16 10.0.0.0/8nmap -v -iR 10000 -Pn -p 80目标说明除了选项，所有出现在Nmap命令行上的都被视为对目标主机的说明。