Nmap安装和扫描（二：Nmap基本操作）

╰半橙微兮° 2022-01-28 04:25 497阅读 0赞

# 任务二、选择和排除扫描目标 #

### 2.1、使用-iR随机扫描3台主机 ###

注：为了减少扫描时间，仅限于在80端口上扫描

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70][]

### 2.2、扫描主机排除指定IP ###

注：扫描192.168.43.0/24网段的主机但排除192.168.43.11主机

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 1][]

### 2.3、扫描主机排除指定地址列表文件中的IP ###

2.3.1、创建地址列表文件；

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 2][]

2.3.2、在Nmap下输入nmap 192.168.43.0/24 –excludefile file1.txt

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 3][]

# 任务三、扫描发现存活的目标主机 #

### 3.1、Nmap扫描存活主机 ###

注：使用-sL在网络上扫描nesst.com域的主机，仅列出目标域中主机的IP地址并不能区分是否为存活主机。

![20190523104231675.jpeg][]

### 3.2、扫描指定IP范围内存活的主机 ###

注：使用-sn参数发现网络中192.168.43.140-253之间的主机

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 4][]

### 3.3、扫描主机端口开放情况 ###

注：-Pn参数跳过主机发现过程直接报告端口开放情况。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 5][]

### 3.4、组合参数探测 ###

注：用组合参数探测域中信息。

![20190523104231719.jpeg][]

# 任务四、识别目标的操作系统 #

### 4.1、探测目标主机操作系统类型 ###

4.1.1、列出范围内的存活主机

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 6][]

4.1.2、列出指定主机操作系统类型

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 7][]

4.2、猜测目标主机操作系统类型

注：使用-O –osscan-guess 参数猜测主机操作系统类型或者列出指纹

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 8][]

# 任务五、识别目标主机的服务及版本 #

### 5.1、使用-sV进行基本的版本扫描 ###

注：命令格式：nmap -sV IP地址（默认扫描强度为7）

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 9][]

### 5.2、详尽的列出探测过程 ###

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 10][]

### 5.3、轻量级探测 ###

注：如果需要在较短的时间内完成探测过程，则可选择轻量级探测

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 11][]

### 5.4、尝试使用所有probes探测 ###

5.4.1、对kali Linux进行探测

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 12][]

5.4.2、对本机电脑Windows10进行扫描

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 13][]

# 任务六、绕过防火墙扫描端口 #

### 6.1、使用诱饵隐蔽扫描 ###

注：使用命令：nmap -v -F -D 192.168.43.12,192.168.43.11,ME -g 3355 IP

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 14][]

进行报文分析

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 15][]

# 6.2、进行源地址欺骗扫描 #

注：-S结合-e进行源地址欺骗扫描

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 16][]

进行报文分析（伪装的地址为192.168.43.22）

![2019052310423245.jpeg][]

### 6.3、进行源MAC地址补齐欺骗扫描 ###

6.3.1、源主机的MAC地址

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 17][]

6.3.2、进行MAC地址伪装诱骗

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 18][]

6.3.3、报文分析（查看伪装MAC地址有变）

![20190523104241993.png][]

# 常见问题与解决方案 #

### **排错一：进行源MAC地址的伪装欺骗扫描失败。** ###

**排错思路：**

1.  各虚拟机之间的网络连接是否合适；
2.  测试命令及格式是否正确；
3.  软件版本及环境是否正确；

**原因：**目标主机的安全性较高。

![20190523104333627.jpeg][]

无法将伪装的MAC地址写入表中；

**解决方案：**

使用命令“nmap -sT -PN –spoof-mac 0 目标IP”

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 19][]

检查报文是否伪装成功

![20190523104333752.jpeg][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70]: /images/20220128/78f98dc8641a4a86af40f7ab305961bf.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 1]: /images/20220128/d2e529749aff4cf7b4969d8ba6cd9605.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 2]: /images/20220128/b8dca040356245998fadb9bfb8f23962.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 3]: /images/20220128/bd89b6552d744f9db3035afa8d51f189.png
[20190523104231675.jpeg]: /images/20220128/afa29a0df49049d7ba767de696a29c09.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 4]: /images/20220128/5ebd12b3e8a24f92a1540dfc5d7bda45.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 5]: /images/20220128/e929b9be5b184bb9b076898f252cfe7a.png
[20190523104231719.jpeg]: /images/20220128/8176fc4c35a54547adb8b0ab936c1c33.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 6]: /images/20220128/1f2ea702050048b6907a711718af84d7.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 7]: /images/20220128/3dbd431db1de42bba87b5533ac553071.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 8]: /images/20220128/38d5272dc02f443c8174a72a2969b7e9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 9]: /images/20220128/868509e7bc384fd98ee37a910f3bee96.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 10]: /images/20220128/d1b8e3bddf7e4a8d84c7094a40d6e6cb.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 11]: /images/20220128/6fbc84fd43e74ad7a4a10fa532775236.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 12]: /images/20220128/65b31411527149c198cfad508d897008.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 13]: /images/20220128/3e3d63208671419084305cdb9e859da4.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 14]: /images/20220128/69e46310aeac48819375e886af5e47ad.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 15]: /images/20220128/440a3e8ade66461f905f3d3b9259a90c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 16]: /images/20220128/7d9949062f10470185c9f7c020bc0a7f.png
[2019052310423245.jpeg]: /images/20220128/b66cb8c69ea8430b8ab3ebe89c5faaf6.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 17]: /images/20220128/d00e94727e5d4d43a2d2a6bf6d214a4c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 18]: /images/20220128/44e8fdc7f9f5424495f7f47ef71c990b.png
[20190523104241993.png]: /images/20220128/48498a9e384f4486927ae7f84898ef63.png
[20190523104333627.jpeg]: /images/20220128/1301b32be7934908a1a07384342bab93.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM3ODIzNjA1_size_16_color_FFFFFF_t_70 19]: /images/20220128/7c49345253b246c9bed10ae13b9e5b46.png
[20190523104333752.jpeg]: /images/20220128/85f9402acf744e0b997e32d1a9575de1.png