nmap扫描开放端口

示例

先看来一个示例

➜  ~ nmap -v -r -p0-65535 192.168.1.23

-v 显示详情

-r端口从小到大扫描

-p端口范围

结果

Starting Nmap 6.40 ( http://nmap.org ) at 2023-12-22 15:47 CST
Initiating Ping Scan at 15:47
Scanning 192.168.1.23 [4 ports]
Completed Ping Scan at 15:47, 0.21s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 15:47
Completed Parallel DNS resolution of 1 host. at 15:47, 0.00s elapsed
Initiating SYN Stealth Scan at 15:47
Scanning 192.168.1.23 [65536 ports]
Discovered open port 22/tcp on 192.168.1.23
Discovered open port 3306/tcp on 192.168.1.23
Discovered open port 5001/tcp on 192.168.1.23
Discovered open port 5006/tcp on 192.168.1.23
SYN Stealth Scan Timing: About 6.10% done; ETC: 15:55 (0:07:57 remaining)
Discovered open port 8123/tcp on 192.168.1.23
Discovered open port 8200/tcp on 192.168.1.23
Discovered open port 8300/tcp on 192.168.1.23
Discovered open port 8443/tcp on 192.168.1.23
Discovered open port 8515/tcp on 192.168.1.23
Discovered open port 8818/tcp on 192.168.1.23
Discovered open port 8890/tcp on 192.168.1.23
Discovered open port 9000/tcp on 192.168.1.23
SYN Stealth Scan Timing: About 13.91% done; ETC: 15:57 (0:08:28 remaining)
Discovered open port 9093/tcp on 192.168.1.23
Discovered open port 9326/tcp on 192.168.1.23
SYN Stealth Scan Timing: About 16.40% done; ETC: 15:58 (0:09:31 remaining)
SYN Stealth Scan Timing: About 20.99% done; ETC: 15:58 (0:08:54 remaining)
SYN Stealth Scan Timing: About 27.07% done; ETC: 15:57 (0:07:43 remaining)
SYN Stealth Scan Timing: About 33.98% done; ETC: 15:57 (0:06:33 remaining)
SYN Stealth Scan Timing: About 41.67% done; ETC: 15:56 (0:05:25 remaining)
Discovered open port 30391/tcp on 192.168.1.23
SYN Stealth Scan Timing: About 49.92% done; ETC: 15:56 (0:04:23 remaining)
SYN Stealth Scan Timing: About 58.67% done; ETC: 15:55 (0:03:26 remaining)
SYN Stealth Scan Timing: About 67.83% done; ETC: 15:55 (0:02:33 remaining)
SYN Stealth Scan Timing: About 77.37% done; ETC: 15:54 (0:01:43 remaining)
SYN Stealth Scan Timing: About 84.45% done; ETC: 15:54 (0:01:10 remaining)
SYN Stealth Scan Timing: About 91.86% done; ETC: 15:54 (0:00:37 remaining)
Completed SYN Stealth Scan at 15:54, 444.78s elapsed (65536 total ports)
Nmap scan report for 192.168.1.23
Host is up (0.00084s latency).
Not shown: 65499 filtered ports
PORT      STATE  SERVICE
22/tcp    open   ssh
80/tcp    closed http
443/tcp   closed https
514/tcp   closed shell
3306/tcp  open   unknown
5001/tcp  open   commplex-link
5006/tcp  open   unknown
6124/tcp  closed unknown
7848/tcp  closed unknown
8123/tcp  open   polipo
8200/tcp  open   trivnet1
8300/tcp  open   tmi
8443/tcp  open   https-alt
8514/tcp  closed unknown
8515/tcp  open   unknown
8516/tcp  closed unknown
8818/tcp  open   unknown
8848/tcp  closed unknown
8888/tcp  closed sun-answerbook
8889/tcp  closed ddi-tcp-2
8890/tcp  open   unknown
9000/tcp  open   cslistener
9020/tcp  closed tambora
9093/tcp  open   unknown
9326/tcp  open   unknown
9514/tcp  closed unknown
9515/tcp  closed unknown
9848/tcp  closed unknown
9849/tcp  closed unknown
9999/tcp  closed abyss
30391/tcp open   unknown
41523/tcp closed unknown
50300/tcp closed unknown
50301/tcp closed unknown
50302/tcp closed unknown
50303/tcp closed unknown
50304/tcp closed unknown

Nmap，Network Mapper，是一款强大的主机发现和端口扫描的工具。

基本功能

（1）扫描主机端口，嗅探所提供的网络服务

（2）探测一组主机是否在线

（3）识别主机的操作系统

（4）到达主机经过的路由，系统开放的端口

二、端口的状态：识别的六种端口

常用主机存活探测参数

-sP 使用Ping扫描

-sL 列表扫描,仅将指定的目标IP列举出来,不进行主机发现。

-Pn 不检测主机存活,默认当前主机存活。

-PS 使用TCP SYN Ping扫描。

-PA 使用TCP ACK Ping扫描。

-PU 使用UDP Ping扫描

常用扫描方式参数

-sS TCP SYN扫描。

-sT TCP连接扫描。

-sU UDP扫描。

-sA TCP ACK扫描。

-sW TCP窗口扫描。

-sN/-sF/-sX 隐蔽扫描。

-sI 空闲扫描

常用端口扫描相关参数

-p 指定端口,指定的端口范围在1-65535之间。

-r 按照端口号大小,从小到大进行扫描。

-F 扫描最常用的100个端口。

--exclede-ports 指定排除的端口。

4、常用服务和操作系统识别参数 参数 说明

-O 检测目标操作系统。

-sV 检测服务。

-A 可以同时启用操作系统检测和版本检测。

常用扫描速度识别

扫描参数范围在T0-T5之间，扫描速度由T0到T5处于递增状态。

-T0,T1 慢速扫描,躲避防火墙等设备检测。

-T2 比T0,T1扫描速度快,比T3慢。

-T3 Nmap默认扫描速度。

-T4 快速扫描,比T3要快。

-T5 极速扫描,扫描结果极为不准。

6、其他参数 参数 说明

-v 提高输出信息的详细程度。

-oX 扫描结果输出为XML格式文件。