nmap推荐扫描选项

1.扫描在线主机:

nmap -sP -PS21,22,23,25,80,113,34522 -PA80,113,443,50824 -PE -PP --source-port 53 -T4 目标IP

2.详细扫描:

TCP:

nmap -Pn --source-port 53 -T4 -sS --scanflags SYNFIN  -p- -A 在线目标IP

UDP:

nmap -sU -sV -T4 -F --version-intensity 0 在线目标IP

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Idle scan步骤:

1.找一个zombie

nmap -O -v 目标IP

结果中的IP ID Sequence Generation是Incremental或者Broken little-endian incremental就表示这个IP可以用作zombie

2.Idle scan（只能用来扫描端口）

nmap -Pn -p 1-1023,[1024-] -T4 -sI zombie的IP:zombie上的一个开放端口 目标IP

通过zombie扫描目标IP上1到1023端口（包括1和1023）以及大于等于1024且在nmap-services中注册有服务器的端口

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

nmap脚本分类:

1.auth

These scripts try to determine authentication credentials on the target system, often through a brute-force attack. Examples include snmp-brute, http-auth, and ftp-anon.

2.default

Speed: Finish quickly.

Usefulness: Produce valuable and actionable information.

Verbosity: Output is used for a wide variety of purposes and needs to be readable and concise.

Reliability.

Instrusiveness.

Privacy

3.discovery

discover more about the network by querying public registries, SNMAP-enabled devices, directory services, and the like.

4.external

scripts in this category may send data to a third-party database or other network resource.

5.intrusive

the risks are too high that may crash the target system.

6.malware

test whether the target playform is infected by malware or backdoors.

7.safe

scripts which weren't designed to crash services, use large amounts of network bandwidth or other resources, or exploit security holes.

8.version

an extension to the version detection feature and cannot be selected explicitly.

9.vuln

check for specific known vulnerabilities and generally only report results if they are found.