Network exploration tool and security / port scanner
# nmap -h
Usage: nmap [Scan Type(s)] [Options] {target specification}
HOST DISCOVERY:
-Pn: Treat all hosts as online -- skip host discovery
SCAN TECHNIQUES:
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sU: UDP Scan
PORT SPECIFICATION AND SCAN ORDER:
-p <port ranges>: Only scan specified ports
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
EXAMPLES:
nmap -v -A scanme.nmap.org
nmap -v -sn 192.168.0.0/16 10.0.0.0/8
nmap -v -iR 10000 -Pn -p 80
# man nmap
-Pn (No ping) .
-sT (TCP connect scan) .
-sU (UDP scans) .
nmap -Pn -sT -p 22 xx.xx.xx.xx nmap -Pn -sT -p 443 x.x.x.x -max-rtt-timeout 0.1
open or closed : Firewall is pass.
filterd : Firewall is blocked.
# nmap -Pn -sT -p 3306 192.168.0.100 Starting Nmap 6.40 ( http://nmap.org ) at 20xx-09-21 16:36 JST Nmap scan report for test-db-01.example.local (192.168.0.100) Host is up. PORT STATE SERVICE 3306/tcp filtered mysql Nmap done: 1 IP address (1 host up) scanned in 2.09 seconds
#nmap google.com Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2015-01-28 21:07 JST Warning: Hostname google.com resolves to 11 IPs. Using 74.125.235.102. Interesting ports on nrt19s02-in-f6.1e100.net (74.125.235.102): Not shown: 1678 filtered ports PORT STATE SERVICE 80/tcp open http 443/tcp open https Nmap finished: 1 IP address (1 host up) scanned in 31.587 seconds
nmap -sU google.com
# nmap -sU -p 161 127.0.0.1 Starting Nmap 6.40 ( http://nmap.org ) at 2019-09-18 00:47 JST Nmap scan report for localhost (127.0.0.1) Host is up (0.00024s latency). PORT STATE SERVICE 161/udp open snmp Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds
# time nmap -sT -sU -Pn x.x.x.x # time nmap -sT -sU -Pn --scan-delay 10ms x.x.x.x # 100 counts/sec # time nmap -sT -sU -Pn --scan-delay 50ms x.x.x.x/24 # 20 counts/sec # time nmap -sT -sU -Pn --scan-delay 50ms -oX `date +"%Y%m%d_%H%M"`.txt x.x.x.x/24 # 20 counts/sec
# nmap -sT -sU -Pn localhost Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2015-01-28 21:26 JST Interesting ports on localhost.localdomain (127.0.0.1): Not shown: 3155 closed ports PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 80/tcp open http 139/tcp open netbios-ssn 199/tcp open smux 445/tcp open microsoft-ds 3306/tcp open mysql 9999/tcp open abyss 123/udp open|filtered ntp 137/udp open|filtered netbios-ns 138/udp open|filtered netbios-dgm 161/udp open|filtered snmp Nmap finished: 1 IP address (1 host up) scanned in 1.301 seconds #
# nmap -sU -sT -p 1-500 localhost Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2015-01-28 21:28 JST Interesting ports on localhost.localdomain (127.0.0.1): Not shown: 990 closed ports PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 80/tcp open http 139/tcp open netbios-ssn 199/tcp open smux 445/tcp open microsoft-ds 123/udp open|filtered ntp 137/udp open|filtered netbios-ns 138/udp open|filtered netbios-dgm 161/udp open|filtered snmp Nmap finished: 1 IP address (1 host up) scanned in 1.236 seconds
# nmap --script=ssl-enum-ciphers -p 443 www.google.com
nmap -sP -oG nmap.grep.txt 192.168.10.0/24 <- Output test nmap -sP -oX nmap.xml 192.168.10.0/24 <- Output XML
-O: Enable OS detection
# nmap -O localhost Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2015-01-28 21:17 JST Interesting ports on localhost.localdomain (127.0.0.1): Not shown: 1672 closed ports PORT STATE SERVICE 22/tcp open ssh 25/tcp open smtp 80/tcp open http 139/tcp open netbios-ssn 199/tcp open smux 445/tcp open microsoft-ds 3306/tcp open mysql 9999/tcp open abyss (abbr)
-sV: Probe open ports to determine service/version info
# nmap -O -sV localhost Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2015-01-28 21:18 JST Interesting ports on localhost.localdomain (127.0.0.1): Not shown: 1672 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 4.3 (protocol 2.0) 25/tcp open smtp Postfix smtpd 80/tcp open http Apache httpd 2.2.11 ((Unix) mod_ssl/2.2.11 OpenSSL/0.9.8b PHP/5.1.6) 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: HELP-PAL) 199/tcp open smux Linux SNMP multiplexer 445/tcp open netbios-ssn Samba smbd 3.X (workgroup: HELP-PAL) 3306/tcp open mysql MySQL 5.0.45-log 9999/tcp open http-proxy DeleGate proxy 9.2.3 (abbr)
-A: Enables OS detection and Version detection
# nmap -A localhost Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2015-01-28 21:15 JST Interesting ports on localhost.localdomain (127.0.0.1): Not shown: 1672 closed ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 4.3 (protocol 2.0) 25/tcp open smtp Postfix smtpd 80/tcp open http Apache httpd 2.2.11 ((Unix) mod_ssl/2.2.11 OpenSSL/0.9.8b PHP/5.1.6) 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: HELP-PAL) 199/tcp open smux Linux SNMP multiplexer 445/tcp open netbios-ssn Samba smbd 3.X (workgroup: HELP-PAL) 3306/tcp open mysql MySQL 5.0.45-log 9999/tcp open http-proxy DeleGate proxy 9.2.3 (abbr)
nmap -sV --reason -PN -n --top-ports 100 www.example.com