Introduction to NMAP

nmap is your good friend

Transcript

1. NMAP 彭博涵 資工4A
2. What’s nmap? ¨  只是個軟體 ¨ a powerful scanner
3. Purpose  ¨  Available hosts ¨  Offering services ¨  Running operating systems
4. install ¨  Linux ¨  FreeBSD ¨  windows
5. 第一次親密接觸 ¨  nmap <target> ¤  #nmap 140.115.50.50
6. nmap 做了什麼? ¨  1. 把<target>轉成ip address ¨  2. 確定目標活著 (send ICMP echo request packet or TCP ACK packet to port 80) ¨  3. ip 轉回hostname (using reverse-DNS query) ¨  4. port scan (/usr/local/share/nmap/nmap-services) ¨  5. print the result
7. 多個目標一次滿足 ¨  CIDR-style ¤  #nmap 140.115.82.0/24 ¨  某一段 ¤  #nmap 140.115.172.3-100 ¨  某幾段 ¤  #nmap 140.115.82,50.7-250 ¨  mix it ¤  #nmap 140.115.20-100,123-169.50 ptt.cc 61.57.227.41/24 ¨  全世界 ¤  #nmap 0.0.0.0/0
8. 更多目標… ¨  從檔案... ¤  #nmap -iL target.txt ¨  except... ¤  #nmap 140.112.0.0/16 --exclude ptt.cc ¤  #nmap 0.0.0.0/0 --excludefile trouble.txt ¨  random ¤  #nmap -iR <number> ¨  IPv6 ¤  #nmap -6 ipv6.plurk.com
9. Scanning port
10. Port service list ¨  http://nmap.org/svn/nmap-services
11. Parameter for scanning port ¨  fast scan -F ¨  scan specific ports -p [port] ¨  scan port by name -p [name] ¨  scan port by portocal -p U:[UDP ports],T:[TCP ports]
12. Fast scan ¨  scan the 100 most commonly used ports ¤  #nmap -F www.ncu.edu.tw
13. Scan specific ports ¨  -p [port] ¤  #nmap -p 22 www.saveie6.com ¤  #nmap -p 23,80,886-9527 www.twitter.com
14. Scan ports by name ¨  -p <name> ¤  #nmap -p ssh www.saveie6.com ¤  #nmap -p smtp,http www.facebook.com
15. Scan ports by protocal ¨  specify the portocal to scan (default TCP) ¤  #nmap -p U:53,T:25 www.hakuna-matata.org
16. Ports status ¨  open ¨  close ¨  filtered ¨  unfiltered ¨  open|filtered ¨  close|filtered
17. OS & service
18. Parameter for OS & service ¨  -O (OS detection) ¨  --osscan-guess (guess OS version) ¨  -sV (service Version detection) ¨  -A (OS detection, version detection and traceroute)
19. others ¨  -v (verbose) ¨  -Pn (skip host discovery) ¨  --traceroute ¨  -sS
20. reference ¨  nmap -h ¨  nmap.org ¨  Nmap Network Scanning by Gordon Fyodor Lyon