Nmap 参数分类详解

川长思鸟来 2022-05-16 07:45 163阅读 0赞

**资料出处：**[**http://blog.csdn.net/heimian/article/details/7080739**][http_blog.csdn.net_heimian_article_details_7080739]

Requisites: [Nmap][]

Step 1: Open up the console and type:  
nmap  
It will give you the whole commands of nmap.  
But we are here to understanding the commands so we should go ahead.

Here is the cheatsheet of NMAP.

## **BASIC SCANNING TECHNIQUES** ##

<table> 
 <tbody> 
  <tr> 
   <td><strong>Goal</strong></td> 
   <td><strong>command</strong></td> 
   <td><strong>example</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Scan a Single Target</strong></td> 
   <td><strong>nmap [target]</strong></td> 
   <td><strong>nmap 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Scan Multiple Targets</strong></td> 
   <td><strong>nmap [target1, target2, etc]</strong></td> 
   <td><strong>nmap 192.168.0.1 192.168.0.2</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Scan a List of Targets</strong></td> 
   <td><strong>nmap -iL [list.txt]</strong></td> 
   <td><strong>nmap -iL targets.txt</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Scan a Range of Hosts</strong></td> 
   <td><strong>nmap [range of ip addresses]</strong></td> 
   <td><strong>nmap 192.168.0.1-10</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Scan an Entire Subnet</strong></td> 
   <td><strong>nmap [ip address/cdir]</strong></td> 
   <td><strong>nmap 192.168.0.1/24</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Scan Random Hosts</strong></td> 
   <td><strong>nmap -iR [number]</strong></td> 
   <td><strong>nmap -iR 0</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Excluding Targets from a Scan</strong></td> 
   <td><strong>nmap [targets] –exclude [targets]</strong></td> 
   <td><strong>nmap 192.168.0.1/24 –exclude 192.168.0.100, 192.168.0.200</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Excluding Targets Using a List</strong></td> 
   <td><strong>nmap [targets] –excludefile [list.txt]</strong></td> 
   <td><strong>nmap 192.168.0.1/24 –excludefile notargets.txt</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Perform an Aggressive Scan</strong></td> 
   <td><strong>nmap -A [target]</strong></td> 
   <td><strong>nmap -A 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Scan an IPv6 Target</strong></td> 
   <td><strong>nmap -6 [target]</strong></td> 
   <td><strong>nmap -6 1aff:3c21:47b1:0000:0000:0000:0000:2afe</strong></td> 
  </tr> 
 </tbody> 
</table>

## DISCOVERY OPTIONS ##

<table> 
 <tbody> 
  <tr> 
   <td><strong>Goal</strong></td> 
   <td><strong>command</strong></td> 
   <td><strong>example</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Perform a Ping Only Scan</strong></td> 
   <td><strong>nmap -sP [target]</strong></td> 
   <td><strong>nmap -sP 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Don’t Ping</strong></td> 
   <td><strong>nmap -PN [target]</strong></td> 
   <td><strong>nmap -PN 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>TCP SYN Ping</strong></td> 
   <td><strong>nmap -PS [target]</strong></td> 
   <td><strong>nmap -PS 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>TCP ACK Ping</strong></td> 
   <td><strong>nmap -PA [target]</strong></td> 
   <td><strong>nmap -PA 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>UDP Ping</strong></td> 
   <td><strong>nmap -PU [target]</strong></td> 
   <td><strong>nmap -PU 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>SCTP INIT Ping</strong></td> 
   <td><strong>nmap -PY [target]</strong></td> 
   <td><strong>nmap -PY 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>ICMP Echo Ping</strong></td> 
   <td><strong>nmap -PE [target]</strong></td> 
   <td><strong>nmap -PE 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>ICMP Timestamp Ping</strong></td> 
   <td><strong>nmap -PP [target]</strong></td> 
   <td><strong>nmap -PP 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>ICMP Address Mask Ping</strong></td> 
   <td><strong>nmap -PM [target]</strong></td> 
   <td><strong>nmap -PM 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>IP Protocol Ping</strong></td> 
   <td><strong>nmap -PO [target]</strong></td> 
   <td><strong>nmap -PO 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>ARP Ping</strong></td> 
   <td><strong>nmap -PR [target]</strong></td> 
   <td><strong>nmap -PR 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Traceroute</strong></td> 
   <td><strong>nmap –traceroute [target]</strong></td> 
   <td><strong>nmap –traceroute 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Force Reverse DNS Resolution</strong></td> 
   <td><strong>nmap -R [target]</strong></td> 
   <td><strong>nmap -R 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Disable Reverse DNS Resolution</strong></td> 
   <td><strong>nmap -n [target]</strong></td> 
   <td><strong>nmap -n 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Alternative DNS Lookup</strong></td> 
   <td><strong>nmap –system-dns [target]</strong></td> 
   <td><strong>nmap –system-dns 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Manually Specify DNS Server(s)</strong></td> 
   <td><strong>nmap –dns-servers [servers] [target]</strong></td> 
   <td><strong>nmap –dns-servers 201.56.212.54 192.168.0.1</strong></td> 
  </tr> 
  <tr> 
   <td><strong>Create a Host List</strong></td> 
   <td><strong>nmap -sL [targets]</strong></td> 
   <td><strong>nmap -sL 192.168.0.1/24</strong></td> 
  </tr> 
 </tbody> 
</table>

## ADVANCED SCANNING OPTIONS ##

<table> 
 <tbody> 
  <tr> 
   <td>Goal</td> 
   <td>command</td> 
   <td>example</td> 
  </tr> 
  <tr> 
   <td>TCP SYN Scan</td> 
   <td>nmap -sS [target]</td> 
   <td>nmap -sS 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>TCP Connect Scan</td> 
   <td>nmap -sT [target]</td> 
   <td>nmap -sT 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>UDP Scan</td> 
   <td>nmap -sU [target]</td> 
   <td>nmap -sU 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>TCP NULL Scan</td> 
   <td>nmap -sN [target]</td> 
   <td>nmap -sN 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>TCP FIN Scan</td> 
   <td>nmap -sF [target]</td> 
   <td>nmap -sF 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Xmas Scan</td> 
   <td>nmap -sX [target]</td> 
   <td>nmap -sX 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>TCP ACK Scan</td> 
   <td>nmap -sA [target]</td> 
   <td>nmap -sA 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Custom TCP Scan</td> 
   <td>nmap –scanflags [flags] [target]</td> 
   <td>nmap –scanflags SYNFIN 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>IP Protocol Scan</td> 
   <td>nmap -sO [target]</td> 
   <td>nmap -sO 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Send Raw Ethernet Packets</td> 
   <td>nmap –send-eth [target]</td> 
   <td>nmap –send-eth 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Send IP Packets</td> 
   <td>nmap –send-ip [target]</td> 
   <td>nmap –send-ip 192.168.0.1</td> 
  </tr> 
 </tbody> 
</table>

## PORT SCANNING OPTIONS ##

<table> 
 <tbody> 
  <tr> 
   <td>Goal</td> 
   <td>command</td> 
   <td>example</td> 
  </tr> 
  <tr> 
   <td>Perform a Fast Scan</td> 
   <td>nmap -F [target]</td> 
   <td>nmap -F 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Scan Specific Ports</td> 
   <td>nmap -p [port(s)] [target]</td> 
   <td>nmap -p 21-25,80,139,8080 192.168.1.1</td> 
  </tr> 
  <tr> 
   <td>Scan Ports by Name</td> 
   <td>nmap -p [port name(s)] [target]</td> 
   <td>nmap -p ftp,http* 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Scan Ports by Protocol</td> 
   <td>nmap -sU -sT -p U:[ports],T:[ports] [target]</td> 
   <td>nmap -sU -sT -p U:53,111,137,T:21-25,80,139,8080 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Scan All Ports</td> 
   <td>nmap -p ‘*’ [target]</td> 
   <td>nmap -p ‘*’ 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Scan Top Ports</td> 
   <td>nmap –top-ports [number] [target]</td> 
   <td>nmap –top-ports 10 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Perform a Sequential Port Scan</td> 
   <td>nmap -r [target]</td> 
   <td>nmap -r 192.168.0.1</td> 
  </tr> 
 </tbody> 
</table>

## VERSION DETECTION ##

<table> 
 <tbody> 
  <tr> 
   <td>Goal</td> 
   <td>command</td> 
   <td>example</td> 
  </tr> 
  <tr> 
   <td>Operating System Detection</td> 
   <td>nmap -O [target]</td> 
   <td>nmap -O 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Submit TCP/IP Fingerprints</td> 
   <td>www.nmap.org/submit/</td> 
   <td>&nbsp;</td> 
  </tr> 
  <tr> 
   <td>Attempt to Guess an Unknown OS</td> 
   <td>nmap -O –osscan-guess [target]</td> 
   <td>nmap -O –osscan-guess 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Service Version Detection</td> 
   <td>nmap -sV [target]</td> 
   <td>nmap -sV 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Troubleshooting Version Scans</td> 
   <td>nmap -sV –version-trace [target]</td> 
   <td>nmap -sV –version-trace 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Perform a RPC Scan</td> 
   <td>nmap -sR [target]</td> 
   <td>nmap -sR 192.168.0.1</td> 
  </tr> 
 </tbody> 
</table>

## TIMING OPTIONS ##

<table> 
 <tbody> 
  <tr> 
   <td>Goal</td> 
   <td>command</td> 
   <td>example</td> 
  </tr> 
  <tr> 
   <td>Timing Templates</td> 
   <td>nmap -T[0-5] [target]</td> 
   <td>nmap -T3 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Set the Packet TTL</td> 
   <td>nmap –ttl [time] [target]</td> 
   <td>nmap –ttl 64 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Minimum # of Parallel Operations</td> 
   <td>nmap –min-parallelism [number] [target]</td> 
   <td>nmap –min-parallelism 10 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Maximum # of Parallel Operations</td> 
   <td>nmap –max-parallelism [number] [target]</td> 
   <td>nmap –max-parallelism 1 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Minimum Host Group Size</td> 
   <td>nmap –min-hostgroup [number] [targets]</td> 
   <td>nmap –min-hostgroup 50 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Maximum Host Group Size</td> 
   <td>nmap –max-hostgroup [number] [targets]</td> 
   <td>nmap –max-hostgroup 1 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Maximum RTT Timeout</td> 
   <td>nmap –initial-rtt-timeout [time] [target]</td> 
   <td>nmap –initial-rtt-timeout 100ms 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Initial RTT Timeout</td> 
   <td>nmap –max-rtt-timeout [TTL] [target]</td> 
   <td>nmap –max-rtt-timeout 100ms 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Maximum Retries</td> 
   <td>nmap –max-retries [number] [target]</td> 
   <td>nmap –max-retries 10 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Host Timeout</td> 
   <td>nmap –host-timeout [time] [target]</td> 
   <td>nmap –host-timeout 30m 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Minimum Scan Delay</td> 
   <td>nmap –scan-delay [time] [target]</td> 
   <td>nmap –scan-delay 1s 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Maximum Scan Delay</td> 
   <td>nmap –max-scan-delay [time] [target]</td> 
   <td>nmap –max-scan-delay 10s 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Minimum Packet Rate</td> 
   <td>nmap –min-rate [number] [target]</td> 
   <td>nmap –min-rate 50 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Maximum Packet Rate</td> 
   <td>nmap –max-rate [number] [target]</td> 
   <td>nmap –max-rate 100 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Defeat Reset Rate Limits</td> 
   <td>nmap –defeat-rst-ratelimit [target]</td> 
   <td>nmap –defeat-rst-ratelimit 192.168.0.1</td> 
  </tr> 
 </tbody> 
</table>

## FIREWALL EVASION TECHNIQUES ##

<table> 
 <tbody> 
  <tr> 
   <td>Goal</td> 
   <td>command</td> 
   <td>example</td> 
  </tr> 
  <tr> 
   <td>Fragment Packets</td> 
   <td>nmap -f [target]</td> 
   <td>nmap -f 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Specify a Specific MTU</td> 
   <td>nmap –mtu [MTU] [target]</td> 
   <td>nmap –mtu 32 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Use a Decoy</td> 
   <td>nmap -D RND:[number] [target]</td> 
   <td>nmap -D RND:10 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Idle Zombie Scan</td> 
   <td>nmap -sI [zombie] [target]</td> 
   <td>nmap -sI 192.168.0.38 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Manually Specify a Source Port</td> 
   <td>nmap –source-port [port] [target]</td> 
   <td>nmap –source-port 1025 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Append Random Data</td> 
   <td>nmap –data-length [size] [target]</td> 
   <td>nmap –data-length 20 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Randomize Target Scan Order</td> 
   <td>nmap –randomize-hosts [target]</td> 
   <td>nmap –randomize-hosts 192.168.0.1-20</td> 
  </tr> 
  <tr> 
   <td>Spoof MAC Address</td> 
   <td>nmap –spoof-mac [MAC|0|vendor] [target]</td> 
   <td>nmap –spoof-mac Cisco 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Send Bad Checksums</td> 
   <td>nmap –badsum [target]</td> 
   <td>nmap –badsum 192.168.0.1</td> 
  </tr> 
 </tbody> 
</table>

## OUTPUT OPTIONS ##

<table> 
 <tbody> 
  <tr> 
   <td>Goal</td> 
   <td>command</td> 
   <td>example</td> 
  </tr> 
  <tr> 
   <td>Save Output to a Text File</td> 
   <td>nmap -oN [scan.txt] [target]</td> 
   <td>nmap -oN scan.txt 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Save Output to a XML File</td> 
   <td>nmap -oX [scan.xml] [target]</td> 
   <td>nmap -oX scan.xml 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Grepable Output</td> 
   <td>nmap -oG [scan.txt] [targets]</td> 
   <td>nmap -oG scan.txt 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Output All Supported File Types</td> 
   <td>nmap -oA [path/filename] [target]</td> 
   <td>nmap -oA ./scan 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Periodically Display Statistics</td> 
   <td>nmap –stats-every [time] [target]</td> 
   <td>nmap –stats-every 10s 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>133t Output</td> 
   <td>nmap -oS [scan.txt] [target]</td> 
   <td>nmap -oS scan.txt 192.168.0.1</td> 
  </tr> 
 </tbody> 
</table>

## TROUBLESHOOTING AND DEBUGGING ##

<table> 
 <tbody> 
  <tr> 
   <td>Goal</td> 
   <td>command</td> 
   <td>example</td> 
  </tr> 
  <tr> 
   <td>Getting Help</td> 
   <td>nmap -h</td> 
   <td>nmap -h</td> 
  </tr> 
  <tr> 
   <td>Display Nmap Version</td> 
   <td>nmap -V</td> 
   <td>nmap -V</td> 
  </tr> 
  <tr> 
   <td>Verbose Output</td> 
   <td>nmap -v [target]</td> 
   <td>nmap -v 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Debugging</td> 
   <td>nmap -d [target]</td> 
   <td>nmap -d 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Display Port State Reason</td> 
   <td>nmap –reason [target]</td> 
   <td>nmap –reason 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Only Display Open Ports</td> 
   <td>nmap –open [target]</td> 
   <td>nmap –open 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Trace Packets</td> 
   <td>nmap –packet-trace [target]</td> 
   <td>nmap –packet-trace 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Display Host Networking</td> 
   <td>nmap –iflist</td> 
   <td>nmap –iflist</td> 
  </tr> 
  <tr> 
   <td>Specify a Network Interface</td> 
   <td>nmap -e [interface] [target]</td> 
   <td>nmap -e eth0 192.168.0.1</td> 
  </tr> 
 </tbody> 
</table>

## NMAP SCRIPTING ENGINE ##

<table> 
 <tbody> 
  <tr> 
   <td>Goal</td> 
   <td>command</td> 
   <td>example</td> 
  </tr> 
  <tr> 
   <td>Execute Individual Scripts</td> 
   <td>nmap –script [script.nse] [target]</td> 
   <td>nmap –script banner.nse 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Execute Multiple Scripts</td> 
   <td>nmap –script [expression] [target]</td> 
   <td>nmap –script ‘http-*’ 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Script Categories</td> 
   <td>all, auth, default, discovery, external, intrusive, malware, safe, vuln</td> 
   <td>&nbsp;</td> 
  </tr> 
  <tr> 
   <td>Execute Scripts by Category</td> 
   <td>nmap –script [category] [target]</td> 
   <td>nmap –script ‘not intrusive’ 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Execute Multiple Script Categories</td> 
   <td>nmap –script [category1,category2,etc]</td> 
   <td>nmap –script ‘default or safe’ 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Troubleshoot Scripts</td> 
   <td>nmap –script [script] –script-trace [target]</td> 
   <td>nmap –script banner.nse –script-trace 192.168.0.1</td> 
  </tr> 
  <tr> 
   <td>Update the Script Database</td> 
   <td>nmap –script-updatedb</td> 
   <td>nmap –script-updatedb</td> 
  </tr> 
 </tbody> 
</table>

**Thank you all for reading the post. Thanks Adi bhaiya.**

[http_blog.csdn.net_heimian_article_details_7080739]: http://blog.csdn.net/heimian/article/details/7080739
[Nmap]: http://nmap.org/download.html