nmap 端口扫描

常用命令

nmap -sS -p 1-65535 -v 192.168.1.102
nmap -sU -p 1-65535 -v 192.168.1.102
nmap -Pn -sT -p 50000 -oG - 192.168.1.*

单个端口扫描用-Pn比较准，因为对方防火墙可能会过滤探测

nmap -Pn -p22 192.168.1.102
#例如如下脚本
    check_ssh_port=$(nmap  -Pn -p22 ${i}|grep '22/tcp'|awk '{print $2}')
    if [[ "${check_ssh_port}" == "open" ]];then
        echo "22 is open"
    else
        echo "22 is not open"
    fi

参数：
-sS TCP SYN扫描 nmap -sS 192.168.1.102
-sU UDP 扫描 nmap -sU 192.168.1.102
-p 指定端口扫描 nmap -sS -p 1-65535 192.168.1.102
-v 详细信息 nmap -v -sS 192.168.1.102
-sP 扫描一个段的存活IP nmap -sP 192.168.1.1/24

扫描某个IP段输出到文件
1）
nmap -Pn -p80 -oG result.txt 104.16.0.0/24
-oG 参数的输出格式适用于shell脚本grep awk之类的
2）
nmap --scan-delay 100ms -Pn -p80 -iL rangelist -oG result.txt
-iL input from list的意思，从文件导入
--scan-delay 100ms 是指间隔100毫秒

sudo nmap -sS -p 1-65535 -v 192.168.1.102
Starting Nmap 7.80 ( https://nmap.org ) at 2019-09-29 20:13 +08
Initiating ARP Ping Scan at 20:13
Scanning 192.168.1.102 [1 port]
Completed ARP Ping Scan at 20:13, 0.01s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 20:13
Completed Parallel DNS resolution of 1 host. at 20:13, 0.00s elapsed
Initiating SYN Stealth Scan at 20:13
Scanning 192.168.1.102 [65535 ports]
Discovered open port 445/tcp on 192.168.1.102
Discovered open port 443/tcp on 192.168.1.102
Discovered open port 80/tcp on 192.168.1.102
Discovered open port 139/tcp on 192.168.1.102
Discovered open port 548/tcp on 192.168.1.102
Discovered open port 3261/tcp on 192.168.1.102
Discovered open port 3262/tcp on 192.168.1.102
Discovered open port 3264/tcp on 192.168.1.102
Discovered open port 49160/tcp on 192.168.1.102
Discovered open port 3263/tcp on 192.168.1.102
Discovered open port 5000/tcp on 192.168.1.102
Discovered open port 5001/tcp on 192.168.1.102
Completed SYN Stealth Scan at 20:13, 9.70s elapsed (65535 total ports)
Nmap scan report for 192.168.1.102
Host is up (0.0046s latency).
Not shown: 65523 closed ports
PORT      STATE SERVICE
80/tcp    open  http
139/tcp   open  netbios-ssn
443/tcp   open  https
445/tcp   open  microsoft-ds
548/tcp   open  afp
3261/tcp  open  winshadow
3262/tcp  open  necp
3263/tcp  open  ecolor-imager
3264/tcp  open  ccmail
5000/tcp  open  upnp
5001/tcp  open  commplex-link
49160/tcp open  unknown
MAC Address: 00:11:32:12:34:56 (Synology Incorporated)

Read data files from: /usr/local/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 9.83 seconds
           Raw packets sent: 65536 (2.884MB) | Rcvd: 65537 (2.622MB)