29 NMAP komandu praktiski piemēri Linux sistēmas/tīkla administratoriem

Nmap aka Network Mapper ir atvērtā koda un ļoti daudzpusīgs rīks Linux sistēmas/tīkla administratoriem. Nmap tiek izmantots tīklu izpētei, drošības skenēšanai, tīkla auditam un atvērtu portu atrašanai uz attālās mašīnas. Tas skenē tiešraides resursdatorus, operētājsistēmas, pakešu filtrus un atvērtos portus, kas darbojas attālajos resursdatoros.

Es apskatīšu lielāko daļu NMAP lietošanas divās dažādās daļās, un šī ir pirmā nopietnā nmap daļa. Šajā iestatījumā esmu izmantojis divus serverus bez ugunsmūra, lai pārbaudītu Nmap komandas darbību.

192.168.0.100 - server1.linux-console.net
192.168.0.101 - server2.linux-console.net

# nmap [Scan Type(s)] [Options] {target specification}

Kā instalēt NMAP Linux

Lielākā daļa mūsdienu Linux izplatīšanas veidu, piemēram, Red Hat, CentOS, Fedoro, Debian un Ubuntu, ir iekļāvuši Nmap noklusējuma pakotņu pārvaldības krātuvēs ar nosaukumu APT. Abi rīki tiek izmantoti programmatūras pakotņu un atjauninājumu instalēšanai un pārvaldībai. Lai instalētu Nmap izplatīšanā, izmantojiet šo komandu.

# yum install nmap		[on Red Hat based systems]

$ sudo apt-get install nmap	[on Debian based systems]

Kad esat instalējis jaunāko nmap lietojumprogrammu, varat izpildīt šajā rakstā sniegtos norādījumus.

1. Skenējiet sistēmu ar resursdatora nosaukumu un IP adresi

Rīks Nmap piedāvā dažādas metodes sistēmas skenēšanai. Šajā piemērā es veicu skenēšanu, izmantojot resursdatora nosaukumu kā server2.linux-console.net, lai uzzinātu visas sistēmā atvērtās ostas, pakalpojumus un MAC adresi.

 nmap server2.linux-console.net

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:42 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.415 seconds
You have new mail in /var/spool/mail/root

 nmap 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 11:04 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
958/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.465 seconds
You have new mail in /var/spool/mail/root

2. Skenējiet, izmantojot opciju “-v”

Jūs varat redzēt, ka zemāk esošā komanda ar opciju “-v” sniedz detalizētāku informāciju par attālo mašīnu.

 nmap -v server2.linux-console.net

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 15:43 EST
Initiating ARP Ping Scan against 192.168.0.101 [1 port] at 15:43
The ARP Ping Scan took 0.01s to scan 1 total hosts.
Initiating SYN Stealth Scan against server2.linux-console.net (192.168.0.101) [1680 ports] at 15:43
Discovered open port 22/tcp on 192.168.0.101
Discovered open port 80/tcp on 192.168.0.101
Discovered open port 8888/tcp on 192.168.0.101
Discovered open port 111/tcp on 192.168.0.101
Discovered open port 3306/tcp on 192.168.0.101
Discovered open port 957/tcp on 192.168.0.101
The SYN Stealth Scan took 0.30s to scan 1680 total ports.
Host server2.linux-console.net (192.168.0.101) appears to be up ... good.
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.485 seconds
               Raw packets sent: 1681 (73.962KB) | Rcvd: 1681 (77.322KB)

Skenēt vairākus uzņēmējus

Varat skenēt vairākus resursdatorus, vienkārši ierakstot to IP adreses vai resursdatora nosaukumus, izmantojot Nmap.

 nmap 192.168.0.101 192.168.0.102 192.168.0.103

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:06 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
Nmap finished: 3 IP addresses (1 host up) scanned in 0.580 seconds

4. Skenējiet visu apakštīklu

Izmantojot Nmap, varat skenēt visu apakštīklu vai IP diapazonu, nodrošinot ar to * aizstājējzīmi.

 nmap 192.168.0.*

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:11 EST
Interesting ports on server1.linux-console.net (192.168.0.100):
Not shown: 1677 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
111/tcp open  rpcbind
851/tcp open  unknown

Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 256 IP addresses (2 hosts up) scanned in 5.550 seconds
You have new mail in /var/spool/mail/root

Virs iepriekšējās izejas jūs varat redzēt, ka nmap skenēja visu apakštīklu un sniedza informāciju par tiem tīklā esošajiem saimniekiem.

5. Skenējiet vairākus serverus, izmantojot pēdējo IP adreses oktetu

Varat veikt skenēšanu uz vairākām IP adresēm, vienkārši norādot pēdējo IP adreses oktetu. Piemēram, šeit es skenēju IP adreses 192.168.0.101, 192.168.0.102 un 192.168.0.103.

 nmap 192.168.0.101,102,103

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:09 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 3 IP addresses (1 host up) scanned in 0.552 seconds
You have new mail in /var/spool/mail/root

6. Skenējiet saimnieku sarakstu no faila

Ja jums ir vairāk saimniekdatoru, kurus skenēt, un visa resursdatora informācija ir ierakstīta failā, varat tieši lūgt nmap lasīt šo failu un veikt skenēšanu. Apskatīsim, kā to izdarīt.

Izveidojiet teksta failu ar nosaukumu “nmaptest.txt” un definējiet visas servera IP adreses vai resursdatora nosaukumu, kuru vēlaties skenēt.

 cat > nmaptest.txt

localhost
server2.linux-console.net
192.168.0.101

Pēc tam palaidiet šādu komandu ar opciju “iL” ar komandu nmap, lai skenētu visu failā norādīto IP adresi.

 nmap -iL nmaptest.txt

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 10:58 EST
Interesting ports on localhost.localdomain (127.0.0.1):
Not shown: 1675 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
25/tcp  open  smtp
111/tcp open  rpcbind
631/tcp open  ipp
857/tcp open  unknown

Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
958/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
958/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 3 IP addresses (3 hosts up) scanned in 2.047 seconds

7. Skenējiet IP adrešu diapazonu

Veicot skenēšanu ar Nmap, varat norādīt IP diapazonu.

 nmap 192.168.0.101-110

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:09 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 10 IP addresses (1 host up) scanned in 0.542 seconds

8. Skenējiet tīklu, izņemot attālos resursdatorus

Varat izslēgt dažus resursdatorus, veicot pilnu tīkla skenēšanu vai skenējot ar aizstājējzīmēm ar opciju “- izslēgt”.

 nmap 192.168.0.* --exclude 192.168.0.100

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:16 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 255 IP addresses (1 host up) scanned in 5.313 seconds
You have new mail in /var/spool/mail/root

9. Skenējiet OS informāciju un Traceroute

Izmantojot Nmap, varat noteikt, kura OS un versija darbojas attālajā resursdatorā. Lai iespējotu OS un versiju noteikšanu, skriptu skenēšanu un izsekošanu, mēs varam izmantot opciju “-A” ar NMAP.

 nmap -A 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:25 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 4.3 (protocol 2.0)
80/tcp   open  http    Apache httpd 2.2.3 ((CentOS))
111/tcp  open  rpcbind  2 (rpc #100000)
957/tcp  open  status   1 (rpc #100024)
3306/tcp open  mysql   MySQL (unauthorized)
8888/tcp open  http    lighttpd 1.4.32
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
No exact OS matches for host (If you know what OS is running on it, see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
TCP/IP fingerprint:
SInfo(V=4.11%P=i686-redhat-linux-gnu%D=11/11%Tm=52814B66%O=22%C=1%M=080027)
TSeq(Class=TR%IPID=Z%TS=1000HZ)
T1(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Uptime 0.169 days (since Mon Nov 11 12:22:15 2013)

Nmap finished: 1 IP address (1 host up) scanned in 22.271 seconds
You have new mail in /var/spool/mail/root

Iepriekš redzamajā sadaļā Output varat redzēt, ka nmap ir nācis klajā ar OS TCP/IP pirkstu nospiedumu, kas darbojas attālajos resursdatoros un ir precīzāk aprakstīts ostā un pakalpojumos, kas darbojas attālajos resursdatoros.

10. Iespējojiet OS noteikšanu ar Nmap

Izmantojiet opciju “-O” un “-osscan-guess” arī palīdz atklāt OS informāciju.

 nmap -O server2.linux-console.net

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:40 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
No exact OS matches for host (If you know what OS is running on it, see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
TCP/IP fingerprint:
SInfo(V=4.11%P=i686-redhat-linux-gnu%D=11/11%Tm=52815CF4%O=22%C=1%M=080027)
TSeq(Class=TR%IPID=Z%TS=1000HZ)
T1(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=16A0%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=Option -O and -osscan-guess also helps to discover OS
R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E%UCK=E%ULEN=134%DAT=E)

Uptime 0.221 days (since Mon Nov 11 12:22:16 2013)

Nmap finished: 1 IP address (1 host up) scanned in 11.064 seconds
You have new mail in /var/spool/mail/root

11. Skenējiet resursdatoru, lai noteiktu ugunsmūri

Zemāk redzamā komanda veiks skenēšanu attālajā resursdatorā, lai noteiktu, vai resursdators izmanto kādu pakešu filtru vai ugunsmūri.

 nmap -sA 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:27 EST
All 1680 scanned ports on server2.linux-console.net (192.168.0.101) are UNfiltered
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.382 seconds
You have new mail in /var/spool/mail/root

12. Skenējiet resursdatoru, lai pārbaudītu, vai to aizsargā ugunsmūris

Lai skenētu resursdatoru, ja to aizsargā kāda pakešu filtrēšanas programmatūra vai ugunsmūri.

 nmap -PN 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:30 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.399 seconds

13. Uzziniet tiešraides resursdatorus tīklā

Ar opcijas “-sP” palīdzību mēs varam vienkārši pārbaudīt, kuri resursdatori tīklā dzīvo un darbojas, ar šo opciju nmap izlaiž portu noteikšanu un citas lietas.

 nmap -sP 192.168.0.*

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 11:01 EST
Host server1.linux-console.net (192.168.0.100) appears to be up.
Host server2.linux-console.net (192.168.0.101) appears to be up.
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)
Nmap finished: 256 IP addresses (2 hosts up) scanned in 5.109 seconds

14. Veiciet ātru skenēšanu

Varat veikt ātru skenēšanu ar opciju “-F”, lai meklētu nmap-services failos uzskaitītos portus un atstātu visas pārējās ostas.

 nmap -F 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:47 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1234 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.322 seconds

15. Atrodiet Nmap versiju

Jūs varat uzzināt Nmap versiju, kuru izmantojat savā datorā, izmantojot opciju “-V”.

 nmap -V

Nmap version 4.11 ( http://www.insecure.org/nmap/ )
You have new mail in /var/spool/mail/root

16. Secīgi skenējiet ostas

Izmantojiet karodziņu “-r”, lai nejaušinātu.

 nmap -r 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 16:52 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.363 seconds

17. Drukāt resursdatora saskarnes un maršrutus

Izmantojot nmap, varat uzzināt resursdatora saskarni un maršruta informāciju, izmantojot nmap.

 nmap --iflist

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:07 EST
************************INTERFACES************************
DEV  (SHORT) IP/MASK          TYPE     UP MAC
lo   (lo)    127.0.0.1/8      loopback up
eth0 (eth0)  192.168.0.100/24 ethernet up 08:00:27:11:C7:89

**************************ROUTES**************************
DST/MASK      DEV  GATEWAY
192.168.0.0/0 eth0
169.254.0.0/0 eth0

Iepriekšējā izvadē jūs varat redzēt, ka kartē ir uzskaitītas saskarnes, kas pievienotas jūsu sistēmai, un to attiecīgie maršruti.

18. Meklējiet noteiktu portu

Ir dažādas iespējas, lai atklātu ostas attālajā datorā, izmantojot Nmap. Jūs varat norādīt portu, kuru vēlaties skenēt nmap, izmantojot opciju “-p”, pēc noklusējuma nmap skenē tikai TCP portus.

 nmap -p 80 server2.linux-console.net

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:12 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
PORT   STATE SERVICE
80/tcp open  http
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) sca

19. Skenējiet TCP portu

Varat arī norādīt konkrētus portu tipus un numurus, izmantojot skenēšanu ar nmap.

 nmap -p T:8888,80 server2.linux-console.net

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:15 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
PORT     STATE SERVICE
80/tcp   open  http
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.157 seconds

20. Skenējiet UDP portu

 nmap -sU 53 server2.linux-console.net

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:15 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
PORT     STATE SERVICE
53/udp   open  http
8888/udp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.157 seconds

21. Skenēt vairākus ostus

Varat arī skenēt vairākas ostas, izmantojot opciju “-p“.

 nmap -p 80,443 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-18 10:56 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
PORT    STATE  SERVICE
80/tcp  open   http
443/tcp closed https
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.190 seconds

22. Skenējiet ostas pēc tīkla diapazona

Izmantojot izteiksmes, varat skenēt porti ar diapazoniem.

  nmap -p 80-160 192.168.0.101

23. Atrodiet resursdatora pakalpojumu versijas numurus

Mēs varam uzzināt servisa versijas, kas darbojas attālajos resursdatoros, izmantojot opciju “-sV”.

 nmap -sV 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:48 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 4.3 (protocol 2.0)
80/tcp   open  http    Apache httpd 2.2.3 ((CentOS))
111/tcp  open  rpcbind  2 (rpc #100000)
957/tcp  open  status   1 (rpc #100024)
3306/tcp open  mysql   MySQL (unauthorized)
8888/tcp open  http    lighttpd 1.4.32
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 12.624 seconds

24. Skenējiet attālos resursdatorus, izmantojot TCP ACK (PA) un TCP Syn (PS)

Dažreiz pakešu filtrēšanas ugunsmūri bloķē standarta ICMP ping pieprasījumus, tādā gadījumā mēs varam izmantot TCP ACK un TCP Syn metodes, lai skenētu attālinātos resursdatorus.

 nmap -PS 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 17:51 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.360 seconds
You have new mail in /var/spool/mail/root

25. Skenējiet attālo resursdatoru īpašām ostām, izmantojot TCP ACK

 nmap -PA -p 22,80 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:02 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.166 seconds
You have new mail in /var/spool/mail/root

26. Skenējiet attālo resursdatoru īpašām ostām, izmantojot TCP Syn

 nmap -PS -p 22,80 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:08 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.165 seconds
You have new mail in /var/spool/mail/root

27. Veiciet slepenu skenēšanu

 nmap -sS 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:10 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.383 seconds
You have new mail in /var/spool/mail/root

28. Pārbaudiet visbiežāk izmantotos portus ar TCP Syn

 nmap -sT 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 18:12 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
80/tcp   open  http
111/tcp  open  rpcbind
957/tcp  open  unknown
3306/tcp open  mysql
8888/tcp open  sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 0.406 seconds
You have new mail in /var/spool/mail/root

29. Veiciet TCP nulles skenēšanu, lai apmānītu ugunsmūri

 nmap -sN 192.168.0.101

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2013-11-11 19:01 EST
Interesting ports on server2.linux-console.net (192.168.0.101):
Not shown: 1674 closed ports
PORT     STATE         SERVICE
22/tcp   open|filtered ssh
80/tcp   open|filtered http
111/tcp  open|filtered rpcbind
957/tcp  open|filtered unknown
3306/tcp open|filtered mysql
8888/tcp open|filtered sun-answerbook
MAC Address: 08:00:27:D9:8E:D7 (Cadmus Computer Systems)

Nmap finished: 1 IP address (1 host up) scanned in 1.584 seconds
You have new mail in /var/spool/mail/root

Pagaidām tas ir ar NMAP, es šajā nopietnā otrajā daļā izdomāšu radošākas NMAP iespējas. Līdz tam sekojiet līdzi mums un neaizmirstiet dalīties ar saviem vērtīgajiem komentāriem.