Nmap网络扫描完全指南：基础与技术

下载需积分: 9 | PDF格式 | 1.4MB | 更新于2024-07-17 | 29 浏览量 | 举报

"这是一本全面介绍Nmap的指南，涵盖了网络扫描的基础知识和技术，包括互联网协议、TCP和UDP协议、ICMP、Nmap的基本使用方法以及各种扫描技术的详细解释，如SYN扫描、连接扫描、隐身扫描、版本检测、UDP扫描等，并涉及到IDLE扫描的工作原理和实施步骤。" 在《Syngress - A Comprehensive Guide to Nmap》中，作者深入浅出地介绍了网络扫描的重要概念和工具Nmap。首先，书中提到了互联网的基础——互联网协议（Internet Protocol, IP）和传输控制协议（Transmission Control Protocol, TCP），其中TCP是互联网上最广泛使用的面向连接的协议，涉及TCP端口和TCP握手过程。而无连接的User Datagram Protocol (UDP)同样被提及，包括UDP端口及没有握手过程的特点。接下来，书中详细阐述了Internet Control Message Protocol (ICMP)，这是一种用于网络诊断和错误报告的协议，对网络管理员进行故障排查至关重要。此外，Nmap作为一款强大的网络发现和安全审计工具，其基本使用方法在第一章中被详尽介绍，如Nmap扫描过程、命令行使用、目标指定、权限需求、支持文件的位置和使用等。第二章主要聚焦于Nmap的各种扫描技术。这些技术包括： 1. TCP SYN扫描（-sS）：只发送SYN数据包，不会完成三次握手，可以隐蔽地探测主机是否在线。 2. TCP connect()扫描（-sT）：直接尝试与目标建立完整的TCP连接，适合检测服务状态。 3. 隐身扫描，包括FIN扫描（-sF）、Xmas Tree扫描（-sX）和Null扫描（-sN）：通过发送非标准的TCP旗标来检测目标，以减少被检测到的风险。 4. Ping扫描（-sP）：利用ICMP回显请求来探测主机的活跃性。 5. 版本检测（-sV）：识别目标系统和服务的版本信息，提高扫描的精确度。 6. UDP扫描（-sU）：用于检测运行在UDP端口上的服务。 7. IP协议扫描（-sO）：扫描目标主机支持的所有IP协议。 8. ACK扫描（-sA）：用于检测防火墙规则和端口过滤。 9. Window扫描（-sW）：确定目标主机的TCP窗口大小，有助于理解其网络配置。 10. RPC扫描（-sR）：查找远程过程调用（RPC）服务。 11. List扫描（-sL）：列出可用的扫描类型。 12. IDLE扫描（-sI<zombiehost:[probeport]>）：通过借用“僵尸”主机的IP ID来隐蔽扫描，降低了扫描源被发现的可能性。 IDLE扫描部分还详细解释了其实现原理、准备工作和扫描过程的分解，这对于理解和执行高级扫描策略至关重要。这本书为读者提供了关于Nmap及其扫描技术的全面知识，无论是网络安全初学者还是经验丰富的专业人士，都能从中受益匪浅，提升网络侦查和防护能力。

Source Destination Summary

--------------------------------------------------------------------------------

-----

[192.168.0.8] [192.168.0.10] TCP: D=113 S=57283 SYN SEQ=2360927338 LEN=0

WIN=3072

[192.168.0.10] [192.168.0.8} TCP: D=57283 S=113 RST ACK=2360927339 WIN=0

If nmap receives an acknowledgment to a SYN request, then the port is open. Nmap then sends an

RST to reset the session, and the handshake is never completed.

Source Destination Summary

--------------------------------------------------------------------------------

-----

[192.168.0.8] [192.168.0.10] TCP: D=80 S=57283 SYN SEQ=2360927338 LEN=0

WIN=3072

[192.168.0.10] [192.168.0.8] TCP: D=57283 S=80 SYN ACK=2360927339

SEQ=1622899389 LEN=0 WIN=65535

[192.168.0.8] [192.168.0.10] TCP: D=80 S=57283 RST WIN=0

The nmap output shows the results of this TCP SYN scan. As expected, most of the packets sent

during this scan were built using the operating system's raw sockets:

# nmap -sS -v 192.168.0.10

Starting nmap 3.81 ( http://www.insecure.org/nmap/ ) at 2005-04-11 12:25 EDT

Initiating SYN Stealth Scan against 192.168.0.10 [1663 ports] at 12:25

Discovered open port 80/tcp on 192.168.0.10

Discovered open port 3389/tcp on 192.168.0.10

Discovered open port 3306/tcp on 192.168.0.10

Discovered open port 139/tcp on 192.168.0.10

Discovered open port 135/tcp on 192.168.0.10

Discovered open port 520/tcp on 192.168.0.10

Discovered open port 445/tcp on 192.168.0.10

The SYN Stealth Scan took 1.35s to scan 1663 total ports.

Host 192.168.0.10 appears to be up ... good.

Interesting ports on 192.168.0.10:

(The 1656 ports scanned but not shown below are in state: closed)

PORT STATE SERVICE

80/tcp open http

135/tcp open msrpc

139/tcp open netbios-ssn

445/tcp open microsoft-ds

520/tcp open efs

3306/tcp open mysql

3389/tcp open ms-term-serv

MAC Address: 00:30:48:11:AB:5A (Supermicro Computer)

Nmap finished: 1 IP address (1 host up) scanned in 2.117 seconds

Raw packets sent: 1705 (68.2KB) | Rcvd: 1664 (76.5KB)

Advantages of the TCP SYN Scan

The TCP SYN scan never actually creates a TCP session, so isn't logged by the destination host's

applications. This is a much "quieter" scan than the TCP connect() scan, and there's less visibility in

the destination system's application logs since no sessions are ever initiated. Since an application

session is never opened, the SYN scan is also less stressful to the application service.

Disadvantages of the TCP SYN Scan

The TCP SYN scan requires that nmap have privileged access to the system. Without privileged

access, nmap can't create the raw packets necessary for this half-open connection process.

When to use the TCP SYN Scan

The SYN scan is a common scan when looking for open ports on a remote device, and its simple SYN

methodology works on all operating systems. Because it only half-opens the TCP connections, it's

considered a very 'clean' scan type.

The TCP SYN scan only provides open, closed, or filtered port information. To determine operating

system or process version information, more intrusive scanning is required, such as the version scan

(-sV) or the operating system fingerprinting (-O) option.

The TCP SYN scan is the most common scan to use because it works on all networks, across all

operating systems, and it's invisible to applications. If the SYN scan didn't work, then TCP wouldn't

work!

TCP connect() Scan (-sT)

Requires Privileged Access: NO

Identifies TCP Ports: YES

Identifies UDP Ports: NO

The TCP connect() scan is named after the connect() call that's used by the operating system to

initiate a TCP connection to a remote device. Unlike the TCP SYN scan (-sS), the TCP connect()

scan uses a normal TCP connection to determine if a port is available. This scan method uses the

same TCP handshake connection that every other TCP-based application uses on the network.

TCP connect() Scan Operation

Interesting ports on 192.168.0.10:

(The 1656 ports scanned but not shown below are in state: closed)

PORT STATE SERVICE

80/tcp open http

135/tcp open msrpc

139/tcp open netbios-ssn

445/tcp open microsoft-ds

520/tcp open efs

3306/tcp open mysql

3389/tcp open ms-term-serv

MAC Address: 00:30:48:11:AB:5A (Supermicro Computer)

Nmap finished: 1 IP address (1 host up) scanned in 2.242 seconds

Raw packets sent: 2 (68B) | Rcvd: 1 (46B)

Advantages of the TCP connect() Scan

No special privileges are required to run the TCP connect() scan. Nmap uses the operating system's

normal method of connecting to remote devices via TCP before it tears down the connection with the

RST packet. Because these are TCP-based methods that any user can employ, no additional rights or

privileges are required.

Disadvantages of the TCP connect() Scan

The disadvantage of this scan is apparent when application connection logs are examined. Since the

TCP connect() scan is completing a TCP connection, normal application processes immediately

follow. These applications are immediately met with a RST packet, but the application has already

provided the appropriate login screen or introductory page. By the time the RST is received, the

application initiation process is already well underway and additional system resources are used.

When to use the TCP connect() Scan

Because this scan is so obvious when browsing through the application event logs, it might be

considered the TCP scan of last resort. If privileged access isn't available and determination of open

TCP ports is absolutely necessary, however, this scan may be the only method available.

The only option to the TCP connect() scan that does not require privileged access but still scans TCP

ports is the FTP bounce attack (-b). Given the small number of susceptible FTP servers that will

participate in a bounce attack, this option is becoming less viable.

I try not to use the connect() scan unless it's absolutely necessary. It's very obvious (in both network

traces and in application log files), and it uses many more system and application resources than the

SYN scan!

Steath Scanning - The FIN Scan (-sF), Xmas Tree Scan (-sX), and Null Scan (-sN)

Requires Privileged Access: YES

Identifies TCP Ports: YES

Identifies UDP Ports: NO

These three scans are grouped together because their individual functionality is very similar. These

are called "stealth" scans because they send a single frame to a TCP port without any TCP

handshaking or additional packet transfers. This is a scan type that sends a single frame with the

expectation of a single response.

These scans operate by manipulating the bits of the TCP header to induce a response from the remote

station. Except for the FIN scan, nmap creates TCP headers that combine bit options that should never

occur in the real world. Instead of an obscure bit pattern, the FIN scan creates a scenario that should

never occur in the real world. These purposely-mangled TCP header packets are thrown at a remote

device, and nmap watches for the responses.

One of the references in RFC 793, Transmission Control Protocol, states that stations receiving

information on a closed TCP port should send a RST frame and an available TCP port should not

respond at all. During any of these stealth scans, nmap categorizes the responses as either closed, or

open|filtered (In computer-speak, a vertical bar between values generally signifies an "or" condition).

The open|filtered result is combined because firewalls often drop these frames without a response.

Because it's impossible to determine if a missing response was due to an open port or a filtered

network connection, there's no way to differentiate between an open port and an administratively

dropped frame.

Different TCP/IP stacks may handle these scans in different ways, so it may be necessary to run

additional non-stealth scans to get the best overview of responses. For example, Windows-based

systems will reply with a RST frame for all queries, regardless of the status of the specific port that

was queried. If open|filtered ports appear during an nmap stealth scan, the remote device is definitely

not a Windows-based system! Windows-based systems aren't the only TCP/IP stacks that work this

way, so special attention should be taken when the results show that all ports are closed; this may not

really be the case!

Because these scans create unusual bit combinations in TCP headers, these packets must be built by

nmap using the raw sockets functionality of the operating system. Because of these "customized"

packets, nmap requires privileged access to perform stealth scans.

FIN, Xmas Tree, and Null Scan Operation

In the following examples, the graphical descriptions and trace files for the open and closed ports will

look functionally identical, except that the bits in the TCP flags will be different in each scan type.

FIN Scan

The FIN scan's "stealth" frames are unusual because they are sent to a device without first going

through the normal TCP handshaking. If a TCP session isn't active, the session certainly can't be

formally closed!

In this FIN scan, TCP port 443 is closed so the remote station sends a RST frame response to the FIN

packet:

剩余132页未读，继续阅读

drjiachen

粉丝: 172
资源: 2138

Nmap网络扫描完全指南：基础与技术

网络制图的秘密：Nmap的综合指南Secrets of Network Cartography: A Comprehensive Guide to Nmap

Syngress - Webmasters Guide To The Wireless Internet

Syngress - Consumer's Guide to Cell Phones & Wireless Services.pdf

Syngress - Cisco Security Specialist’s Guide to PIX Firewall.pdf

Syngress - How to Cheat at Administering Office Communicator.pdf

Syngress - Hacking a Terror Network. The Silent Threat of Covert Channels.pdf

Syngress - Xss Attacks - Cross Site Scripting Exploits And Defense.pdf

Syngress - MCSA_MCSE Exam 70-290.Windows Server 2003 Environment.pdf

Syngress - Stealing the Network - How to Own the Box (2003).pdf

Syngress - How to Cheat at Securing Windows 2000 Server TCP-IP Connections.pdf

最新资源