python-nmap使用及案例
nmap概念及功能
概念
NMap，也就是Network Mapper，最早是Linux下的网络扫描和嗅探工具包。
nmap是一个网络连接端扫描软件，用来扫描网上电脑开放的网络连接端。确定哪些服务运行在哪些连接端，并且推断计算机运行哪个操作系统（这是亦称 fingerprinting）。它是网络管理员必用的软件之一，以及用以评估网络系统安全。
正如大多数被用于网络安全的工具，nmap 也是不少黑客及骇客（又称脚本小子）爱用的工具 。系统管理员可以利用nmap来探测工作环境中未经批准使用的服务器，但是黑客会利用nmap来搜集目标电脑的网络设定，从而计划攻击的方法。
Nmap 常被跟评估系统漏洞软件Nessus 混为一谈。Nmap 以隐秘的手法，避开闯入检测系统的监视，并尽可能不影响目标系统的日常操作。
Nmap 在黑客帝国(The Matrix)中，连同SSH1的32位元循环冗余校验漏洞，被崔妮蒂用以入侵发电站的能源管理系统。
功能
基本功能有三个，一是探测一组主机是否在线；其次是扫描 主机端口，嗅探所提供的网络服务；还可以推断主机所用的操作系统 。Nmap可用于扫描仅有两个节点的LAN，直至500个节点以上的网络。Nmap 还允许用户定制扫描技巧。通常，一个简单的使用ICMP协议的ping操作可以满足一般需求；也可以深入探测UDP或者TCP端口，直至主机所 使用的操作系统；还可以将所有探测结果记录到各种格式的日志中， 供进一步分析操作。
进行ping扫描，打印出对扫描做出响应的主机,不做进一步测试(如端口扫描或者操作系统探测)：
nmap -sP 192.168.1.0/24
仅列出指定网络上的每台主机，不发送任何报文到目标主机：
nmap -sL 192.168.1.0/24
探测目标主机开放的端口，可以指定一个以逗号分隔的端口列表(如-PS22，23，25，80)：
nmap -PS 192.168.1.234
使用UDP ping探测主机：
nmap -PU 192.168.1.0/24
使用频率最高的扫描选项：SYN扫描,又称为半开放扫描，它不打开一个完全的TCP连接，执行得很快：
nmap -sS 192.168.1.0/24
nmap安装
本文以linux Ubuntu16.04为例，最后主要用python操作
1. 先安装nmap
sudo apt-get install nmap
2.再安装python-nmap
sudo pip install python-nmap
安装完之后python导入nmap测试验证是否成功
root@LiDebin:~# python Python 2.7.12 (default, Jul 1 2016, 15:12:24) [GCC 5.4.0 20160609] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import nmap
python操作nmap
1.简单的小案例
创建PortScanner实例，然后扫描159.239.210.26这个IP的20-443端口。
import nmap nm = nmap.PortScanner() ret = nm.scan(\'115.239.210.26\',\'20\') print ret 返回格式如下: {\'nmap\': {\'scanstats\': {\'uphosts\': \'1\', \'timestr\': \'Tue Oct 25 11:30:47 2016\', \'downhosts\': \'0\', \'totalhosts\': \'1\', \'elapsed\': \'1.11\'}, \'scaninfo\': {\'tcp\': {\'services\': \'20\', \'method\': \'connect\'}}, \'command_line\': \'nmap -oX - -p 20 -sV 115.239.210.26\'}, \'scan\': {\'115.239.210.26\': {\'status\': {\'state\': \'up\', \'reason\': \'syn-ack\'}, \'hostnames\': [{\'type\': \'\', \'name\': \'\'}], \'vendor\': {}, \'addresses\': {\'ipv4\': \'115.239.210.26\'}, \'tcp\': {20: {\'product\': \'\', \'state\': \'filtered\', \'version\': \'\', \'name\': \'ftp-data\', \'conf\': \'3\', \'extrainfo\': \'\',
\'reason\': \'no-response\', \'cpe\': \'\'} } } } }
2.内置方法：
还可以打印出简单的信息
import nmap nm = nmap.PortScanner() print nm.scaninfo() # {u\'tcp\': {\'services\': u\'20-443\', \'method\': u\'syn\'}} print nm.command_line() # u\'nmap -oX - -p 20-443 -sV 115.239.210.26\'
查看有多少个host
print nm.all_hosts() # [u\'115.239.210.26\']
查看该host的详细信息
nm[\'115.239.210.26\']
查看该host包含的所有协议
nm[\'115.239.210.26\'].all_protocols()
查看该host的哪些端口提供了tcp协议
nm[\'115.239.210.26\'][\'tcp\'] nm[\'115.239.210.26\'][\'tcp\'].keys()
查看该端口是否提供了tcp协议
nm[\'115.239.210.26\'].has_tcp(21)
还可以像这样设置nmap执行的参数
nm.scan(hosts=\'192.168.1.0/24\', arguments=\'-n -sP -PE -PA21,23,80,3389\')
更多操作请进官网http://xael.org/pages/python-nmap-en.html
实验案例
检测内网机器端口
1.定义函数库mytools.py
#-*- coding:utf-8 -*- import smtplib from email.mime.text import MIMEText from email.header import Header def sendemail(sender,receiver,subject,content,smtpserver,smtpuser,smtppass): msg = MIMEText(content,\'html\',\'utf-8\')#中文需参数‘utf-8\'，单字节字符不需要 msg[\'Subject\'] = Header(subject, \'utf-8\') msg[\'From\'] = \'<%s>\' % sender msg[\'To\'] = ";".join(receiver) try: smtp = smtplib.SMTP() smtp.connect(smtpserver) smtp.login(smtpuser, smtppass) smtp.sendmail(sender, receiver, msg.as_string()) smtp.quit() except Exception,e: print e
2. 实现端口扫描的程序，单线程版本nmscan.py
# !/usr/bin/python # -*- coding:utf-8 -*- import nmap import re import mytools as tool import sys reload(sys) sys.setdefaultencoding(\'utf8\') def nmScan(hostlist, portrange, whitelist): p = re.compile("^(\d*)\-(\d*)$") if type(hostlist) != list: help() portmatch = re.match(p, portrange) if not portmatch: help() l = [] for host in hostlist: result = \'\' nm = nmap.PortScanner() tmp = nm.scan(host, portrange) result = result + "<h2>ip地址:%s 主机名:[%s] ...... %s</h2><hr>" % ( host, tmp[\'scan\'][host][\'hostname\'], tmp[\'scan\'][host][\'status\'][\'state\']) try: ports = tmp[\'scan\'][host][\'tcp\'].keys() except KeyError, e: if whitelist: whitestr = \',\'.join(whitelist) result = result + "未扫到开放端口!请检查%s端口对应的服务状态" % whitestr else: result = result + "扫描结果正常，无暴漏端口" for port in ports: info = \'\' if port not in whitelist: info = \'<strong><font color=red>Alert:非预期端口</font><strong> \' else: info = \'<strong><font color=green>Info:正常开放端口</font><strong> \' portinfo = "%s <strong>port</strong> : %s <strong>state</strong> : %s <strong>product<strong/> : %s <br>" % ( info, port, tmp[\'scan\'][host][\'tcp\'][port][\'state\'], tmp[\'scan\'][host][\'tcp\'][port][\'product\']) result = result + portinfo l.append([host, str(result)]) return l def help(): print "Usage: nmScan([\'127.0.0.1\',],\'0-65535\')" if __name__ == "__main__": hostlist = [\'10.10.10.10\', \'10.10.10.11\'] portrange = \'0-65535\' whitelist = [80, 443] l = nmScan(hostlist, portrange, whitelist) sender = \'75501664@qq.com\' receiver = [\'zhangyanlin8851@163.com\', \'877986976@qq.com\'] subject = \'服务器端口扫描\' smtpserver = \'smtp.exmail.qq.com\' smtpuser = \'zhangyanlin8851@163.cn\' smtppass = \'linuxidc163\' mailcontent = \'\' for i in range(len(l)): mailcontent = mailcontent + l[i][1] tool.sendemail(sender, receiver, subject, mailcontent, smtpserver, smtpuser, smtppass)
3.多线程版本
# !/usr/bin/python # -*- coding:utf-8 -*- import nmap import re import mytools as tool import sys from multiprocessing import Pool from functools import partial reload(sys) sys.setdefaultencoding(\'utf8\') def nmScan(host, portrange, whitelist): p = re.compile("^(\d*)\-(\d*)$") # if type(hostlist) != list: # help() portmatch = re.match(p, portrange) if not portmatch: help() if host == \'121.42.32.172\': whitelist = [25, ] result = \'\' nm = nmap.PortScanner() tmp = nm.scan(host, portrange) result = result + "<h2>ip地址:%s 主机名:[%s] ...... %s</h2><hr>" % ( host, tmp[\'scan\'][host][\'hostname\'], tmp[\'scan\'][host][\'status\'][\'state\']) try: ports = tmp[\'scan\'][host][\'tcp\'].keys() for port in ports: info = \'\' if port not in whitelist: info = \'<strong><font color=red>Alert:非预期端口</font><strong> \' else: info = \'<strong><font color=green>Info:正常开放端口</font><strong> \' portinfo = "%s <strong>port</strong> : %s <strong>state</strong> : %s <strong>product<strong/> : %s <br>" % ( info, port, tmp[\'scan\'][host][\'tcp\'][port][\'state\'], tmp[\'scan\'][host][\'tcp\'][port][\'product\']) result = result + portinfo except KeyError, e: if whitelist: whitestr = \',\'.join(whitelist) result = result + "未扫到开放端口!请检查%s端口对应的服务状态" % whitestr else: result = result + "扫描结果正常，无暴漏端口" return result def help(): print "Usage: nmScan([\'127.0.0.1\',],\'0-65535\')" return None if __name__ == "__main__": hostlist = [\'10.10.10.10\', \'10.10.10.11\'] portrange = \'0-65535\' whitelist = [80, 443] l = nmScan(hostlist, portrange, whitelist) sender = \'75501664@qq.com\' receiver = [\'zhangyanlin8851@163.com\', \'877986976@qq.com\'] subject = \'服务器端口扫描\' smtpserver = \'smtp.exmail.qq.com\' smtpuser = \'zhangyanlin8851@163.cn\' smtppass = \'linuxidc163\' mailcontent = \'\' for i in range(len(l)): mailcontent = mailcontent + l[i][1] tool.sendemail(sender, receiver, subject, mailcontent, smtpserver, smtpuser, smtppass)
版权声明：本文为aylin原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。