Difference between revisions of "Nmap"

From Christoph's Personal Wiki
Jump to: navigation, search
(See also)
(Examples)
Line 36: Line 36:
 
*To launch a full port scan with OS detection and service identification, use:
 
*To launch a full port scan with OS detection and service identification, use:
 
  nmap -p 1-65535 -T5 -A -v 128.92.67.0/24 -oX scan.xml
 
  nmap -p 1-65535 -T5 -A -v 128.92.67.0/24 -oX scan.xml
Replace <code>128.92.67.0/24</code> with your network description or the IP address of Metasploitable.
+
Replace <code>128.92.67.0/24</code> with your network description or the IP address of [http://blog.metasploit.com/2010/05/introducing-metasploitable.html Metasploitable].
  
 
==See also==
 
==See also==

Revision as of 04:04, 7 February 2011

nmap is network exploration tool and security scanner.

Nmap ("Network Mapper") is a free and open source utility for network exploration or security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and both console and graphical versions are available.

Usage

Note: The man page has many more examples.

Examples

  • Check to see if a port is open on your localhost:
nmap -v localhost -p 80

It will return something like the following if the port is open:

PORT   STATE SERVICE
80/tcp open  http
  • Get extended information on ports, etc.:
nmap -A -T4 localhost
  • Determine which ports are listening for TCP connections from the network:
nmap -sT -O localhost
  • If you find an "unknown" service, look it up:
grep 873 /etc/services

then find out more information about this service like so:

netstat -anp | grep 873

also:

lsof -i | grep 873
  • Misc.:
nmap -v -A scanme.nmap.org
nmap -v -sP 192.168.0.0/16 10.0.0.0/8
nmap -sS -O scanme.nmap.org/24
nmap -sV -p 22,53,110,143,4564 198.116.0-255.1-127
  • Make Nmap choose 100,000 hosts at random and scan them for web servers (port 80). Host enumeration is disabled with -P0 since first sending a couple probes to determine whether a host is up is wasteful when you are only probing one port on each target host anyway:
nmap -v -iR 10000 -P0 -p 80
  • To launch a full port scan with OS detection and service identification, use:
nmap -p 1-65535 -T5 -A -v 128.92.67.0/24 -oX scan.xml

Replace 128.92.67.0/24 with your network description or the IP address of Metasploitable.

See also

External links

Further reading

Tutorials, resources, etc.