nmap概念及功能

概念

NMap,也就是Network Mapper,最早是Linux下的网络扫描和嗅探工具包。

nmap是一个网络连接端扫描软件,用来扫描网上电脑开放的网络连接端。确定哪些服务运行在哪些连接端,并且推断计算机运行哪个操作系统(这是亦称 fingerprinting)。它是网络管理员必用的软件之一,以及用以评估网络系统安全。

正如大多数被用于网络安全的工具,nmap 也是不少黑客及骇客(又称脚本小子)爱用的工具 。系统管理员可以利用nmap来探测工作环境中未经批准使用的服务器,但是黑客会利用nmap来搜集目标电脑的网络设定,从而计划攻击的方法。

Nmap 常被跟评估系统漏洞软件Nessus 混为一谈。Nmap 以隐秘的手法,避开闯入检测系统的监视,并尽可能不影响目标系统的日常操作。

Nmap 在黑客帝国(The Matrix)中,连同SSH1的32位元循环冗余校验漏洞,被崔妮蒂用以入侵发电站的能源管理系统。

 

功能

基本功能有三个,一是探测一组主机是否在线;其次是扫描 主机端口,嗅探所提供的网络服务;还可以推断主机所用的操作系统 。Nmap可用于扫描仅有两个节点的LAN,直至500个节点以上的网络。Nmap 还允许用户定制扫描技巧。通常,一个简单的使用ICMP协议的ping操作可以满足一般需求;也可以深入探测UDP或者TCP端口,直至主机所 使用的操作系统;还可以将所有探测结果记录到各种格式的日志中, 供进一步分析操作。

进行ping扫描,打印出对扫描做出响应的主机,不做进一步测试(如端口扫描或者操作系统探测):

nmap -sP 192.168.1.0/24

仅列出指定网络上的每台主机,不发送任何报文到目标主机:

nmap -sL 192.168.1.0/24

探测目标主机开放的端口,可以指定一个以逗号分隔的端口列表(如-PS22,23,25,80):

nmap -PS 192.168.1.234

使用UDP ping探测主机:

nmap -PU 192.168.1.0/24

使用频率最高的扫描选项:SYN扫描,又称为半开放扫描,它不打开一个完全的TCP连接,执行得很快:

nmap -sS 192.168.1.0/24

 

nmap安装

本文以linux Ubuntu16.04为例,最后主要用python操作

1. 先安装nmap

sudo apt-get install nmap

2.再安装python-nmap

sudo pip install python-nmap

安装完之后python导入nmap测试验证是否成功

root@LiDebin:~# python
Python 2.7.12 (default, Jul  1 2016, 15:12:24) 
[GCC 5.4.0 20160609] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import nmap

 

python操作nmap

1.简单的小案例

创建PortScanner实例,然后扫描159.239.210.26这个IP的20-443端口。

import nmap

nm = nmap.PortScanner()
ret = nm.scan(\'115.239.210.26\',\'20\')
print ret

返回格式如下:
{\'nmap\': {\'scanstats\': 
{\'uphosts\': \'1\', \'timestr\': \'Tue Oct 25 11:30:47 2016\', \'downhosts\': \'0\', \'totalhosts\': \'1\', \'elapsed\': \'1.11\'},
 \'scaninfo\': {\'tcp\': {\'services\': \'20\', \'method\': \'connect\'}}, \'command_line\': \'nmap -oX - -p 20 -sV 115.239.210.26\'},
 \'scan\': {\'115.239.210.26\': {\'status\': {\'state\': \'up\', \'reason\': \'syn-ack\'}, \'hostnames\': [{\'type\': \'\', \'name\': \'\'}],
 \'vendor\': {}, \'addresses\': {\'ipv4\': \'115.239.210.26\'},
 \'tcp\': {20: {\'product\': \'\', \'state\': \'filtered\', \'version\': \'\', \'name\': \'ftp-data\', \'conf\': \'3\', \'extrainfo\': \'\', 
\'reason\': \'no-response\', \'cpe\': \'\'} } } } }

 

2.内置方法:

还可以打印出简单的信息

import nmap  
nm = nmap.PortScanner() 
print nm.scaninfo()
# {u\'tcp\': {\'services\': u\'20-443\', \'method\': u\'syn\'}}
print nm.command_line() 
# u\'nmap -oX - -p 20-443 -sV 115.239.210.26\' 

查看有多少个host

print nm.all_hosts()
# [u\'115.239.210.26\'] 

查看该host的详细信息

nm[\'115.239.210.26\']

查看该host包含的所有协议

nm[\'115.239.210.26\'].all_protocols() 

查看该host的哪些端口提供了tcp协议

nm[\'115.239.210.26\'][\'tcp\']

nm[\'115.239.210.26\'][\'tcp\'].keys() 

查看该端口是否提供了tcp协议

nm[\'115.239.210.26\'].has_tcp(21)

还可以像这样设置nmap执行的参数

nm.scan(hosts=\'192.168.1.0/24\', arguments=\'-n -sP -PE -PA21,23,80,3389\') 

更多操作请进官网http://xael.org/pages/python-nmap-en.html 

 

实验案例

检测内网机器端口

1.定义函数库mytools.py

#-*- coding:utf-8 -*- 
import smtplib 
from email.mime.text import MIMEText 
from email.header import Header 
def sendemail(sender,receiver,subject,content,smtpserver,smtpuser,smtppass): 
    msg = MIMEText(content,\'html\',\'utf-8\')#中文需参数‘utf-8\',单字节字符不需要 
    msg[\'Subject\'] = Header(subject, \'utf-8\') 
    msg[\'From\'] = \'<%s>\' % sender 
    msg[\'To\'] = ";".join(receiver) 
    try: 
        smtp = smtplib.SMTP() 
        smtp.connect(smtpserver) 
        smtp.login(smtpuser, smtppass) 
        smtp.sendmail(sender, receiver, msg.as_string()) 
        smtp.quit() 
    except Exception,e: 
        print e

2. 实现端口扫描的程序,单线程版本nmscan.py

# !/usr/bin/python 
# -*- coding:utf-8 -*- 

import nmap
import re
import mytools as tool
import sys

reload(sys)
sys.setdefaultencoding(\'utf8\')


def nmScan(hostlist, portrange, whitelist):
    p = re.compile("^(\d*)\-(\d*)$")


    if type(hostlist) != list:
        help()
    portmatch = re.match(p, portrange)
    if not portmatch:
        help()
    l = []
    for host in hostlist:
        result = \'\'
    nm = nmap.PortScanner()
    tmp = nm.scan(host, portrange)
    result = result + "<h2>ip地址:%s 主机名:[%s]  ......  %s</h2><hr>" % (
    host, tmp[\'scan\'][host][\'hostname\'], tmp[\'scan\'][host][\'status\'][\'state\'])
    try:
        ports = tmp[\'scan\'][host][\'tcp\'].keys()
    except KeyError, e:
        if whitelist:
            whitestr = \',\'.join(whitelist)
            result = result + "未扫到开放端口!请检查%s端口对应的服务状态" % whitestr
        else:
            result = result + "扫描结果正常,无暴漏端口"
    for port in ports:
        info = \'\'
        if port not in whitelist:
            info = \'<strong><font color=red>Alert:非预期端口</font><strong>&nbsp;&nbsp;\'
        else:
            info = \'<strong><font color=green>Info:正常开放端口</font><strong>&nbsp;&nbsp;\'
        portinfo = "%s <strong>port</strong> : %s &nbsp;&nbsp;<strong>state</strong> : %s &nbsp;&nbsp;<strong>product<strong/> : %s <br>" % (
        info, port, tmp[\'scan\'][host][\'tcp\'][port][\'state\'],
        tmp[\'scan\'][host][\'tcp\'][port][\'product\'])
        result = result + portinfo
    l.append([host, str(result)])
    return l


def help():
    print "Usage: nmScan([\'127.0.0.1\',],\'0-65535\')"


if __name__ == "__main__":
    hostlist = [\'10.10.10.10\', \'10.10.10.11\']
    portrange = \'0-65535\'
    whitelist = [80, 443]
    l = nmScan(hostlist, portrange, whitelist)
    sender = \'75501664@qq.com\'
    receiver = [\'zhangyanlin8851@163.com\', \'877986976@qq.com\']
    subject = \'服务器端口扫描\'
    smtpserver = \'smtp.exmail.qq.com\'
    smtpuser = \'zhangyanlin8851@163.cn\'
    smtppass = \'linuxidc163\'
    mailcontent = \'\'
    for i in range(len(l)):
        mailcontent = mailcontent + l[i][1]
    tool.sendemail(sender, receiver, subject, mailcontent, smtpserver, smtpuser, smtppass)

3.多线程版本

# !/usr/bin/python
# -*- coding:utf-8 -*-

import nmap
import re
import mytools as tool
import sys
from multiprocessing import Pool
from functools import partial

reload(sys)
sys.setdefaultencoding(\'utf8\')


def nmScan(host, portrange, whitelist):
    p = re.compile("^(\d*)\-(\d*)$")
    # if type(hostlist) != list:
    #    help()
    portmatch = re.match(p, portrange)
    if not portmatch:
        help()

    if host == \'121.42.32.172\':
        whitelist = [25, ]
    result = \'\'
    nm = nmap.PortScanner()
    tmp = nm.scan(host, portrange)
    result = result + "<h2>ip地址:%s 主机名:[%s]  ......  %s</h2><hr>" % (
    host, tmp[\'scan\'][host][\'hostname\'], tmp[\'scan\'][host][\'status\'][\'state\'])
    try:
        ports = tmp[\'scan\'][host][\'tcp\'].keys()
        for port in ports:
            info = \'\'
            if port not in whitelist:
                info = \'<strong><font color=red>Alert:非预期端口</font><strong>&nbsp;&nbsp;\'
            else:
                info = \'<strong><font color=green>Info:正常开放端口</font><strong>&nbsp;&nbsp;\'
            portinfo = "%s <strong>port</strong> : %s &nbsp;&nbsp;<strong>state</strong> : %s &nbsp;&nbsp;<strong>product<strong/> : %s <br>" % (
            info, port, tmp[\'scan\'][host][\'tcp\'][port][\'state\'], tmp[\'scan\'][host][\'tcp\'][port][\'product\'])
            result = result + portinfo
    except KeyError, e:
        if whitelist:
            whitestr = \',\'.join(whitelist)
            result = result + "未扫到开放端口!请检查%s端口对应的服务状态" % whitestr
        else:
            result = result + "扫描结果正常,无暴漏端口"
    return result


def help():
    print "Usage: nmScan([\'127.0.0.1\',],\'0-65535\')"
    return None


if __name__ == "__main__":
    hostlist = [\'10.10.10.10\', \'10.10.10.11\']
    portrange = \'0-65535\'
    whitelist = [80, 443]
    l = nmScan(hostlist, portrange, whitelist)
    sender = \'75501664@qq.com\'
    receiver = [\'zhangyanlin8851@163.com\', \'877986976@qq.com\']
    subject = \'服务器端口扫描\'
    smtpserver = \'smtp.exmail.qq.com\'
    smtpuser = \'zhangyanlin8851@163.cn\'
    smtppass = \'linuxidc163\'
    mailcontent = \'\'
    for i in range(len(l)):
        mailcontent = mailcontent + l[i][1]
    tool.sendemail(sender, receiver, subject, mailcontent, smtpserver, smtpuser, smtppass)

 

 

 

版权声明:本文为aylin原创文章,遵循 CC 4.0 BY-SA 版权协议,转载请附上原文出处链接和本声明。
本文链接:https://www.cnblogs.com/aylin/p/5996229.html