一.nmap的主要功能
1.端口扫描
2.主机探测：查找目标网络的在线主机
3.服务/版本检测：发现开放端口后，进一步检测目标主机的检测服务协议、应用程序名称、版本号等信息
4.操作系统检测
5.网络路由追踪
二.nmap的6种端口状态
1.开放：开放端口的服务器程序可以受理TCP连接、接受UDP数据包或者响应SCTP（流控制传输协议）请求
2.关闭：可以访问相关的端口，但是没有应用程序在该端口
3.过滤：不能确定端口是否开放，包过滤设备屏蔽了我们向主机发送的探测包
4.未过滤：可以访问制定端口，但是不确定端口是否开放
5.打开|过滤： 不能确定是打开还是过滤，在遇到没有响应的开放端口时，Nmap或做出这样的判断。
6.关闭|过滤
基本用法：Usage: nmap [Scan Type(s)] [Options] {target specification}
三.指定扫描目标
TARGET SPECIFICATION: #目标格式说明
Can pass hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254 #可以接受单个域名，单个主机，多个主机，CIDR表示的网段，十进制的ip区间等形式的扫描目标
-iL <inputfilename>: Input from list of hosts/networks #指定文本文件读取扫描清单
-iR <num hosts>: Choose random targets #（随机挑选几个目标进行扫描）
--exclude <host1[,host2][,host3],...>: Exclude hosts/networks #除去列表中的地址
--excludefile <exclude_file>: Exclude list from file #除去清单中的地址
可以使用tcpdump来监测网卡的数据包流量，打开一个终端窗口，输入（Vboxnet0是我的虚拟网卡，根据实际情况更改）
tcpdump -i vboxnet0
接下来扫描脆弱主机metasploitable2，扫描结果如下
# nmap 192.168.56.101
Starting Nmap 7.60 ( https://nmap.org ) at 2017-12-18 21:13 CST
Nmap scan report for 192.168.56.101
Host is up (0.00034s latency).
Not shown: 977 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
25/tcp open smtp
53/tcp open domain
80/tcp open http
111/tcp open rpcbind
139/tcp open netbios-ssn
445/tcp open microsoft-ds
512/tcp open exec
513/tcp open login
514/tcp open shell
1099/tcp open rmiregistry
1524/tcp open ingreslock
2049/tcp open nfs
2121/tcp open ccproxy-ftp
3306/tcp open mysql
5432/tcp open postgresql
5900/tcp open vnc
6000/tcp open X11
6667/tcp open irc
8009/tcp open ajp13
8180/tcp open unknown
MAC Address: 08:00:27:41:71:79 (Oracle VirtualBox virtual NIC)
Nmap done: 1 IP address (1 host up) scanned in 0.28 seconds
四.扫描选项
SCAN TECHNIQUES:#扫描选项
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans #sT:完整三次握手 sS:设置SYN sM：设置FIN/ACK sA：设置ACK sW：检测返回的TCP窗口字段
-sU: UDP Scan #UDP仅有的一种方式
-sN/sF/sX: TCP Null, FIN, and Xmas scans #sN：不设置控制位 sF：设置FIN位 sX：设置FIN、PSH和URG
--scanflags <flags>: Customize TCP scan flags #设置自定义的TCP扫描方式
-sI <zombie host[:probeport]>: Idle scan #设置僵尸主机进行扫描
-sY/sZ: SCTP INIT/COOKIE-ECHO scans
-sO: IP protocol scan
-b <FTP relay host>: FTP bounce scan
五.目标端口选项
nmap默认从常用端口中随机挑选1000个进行扫描，其nmap-services文件对端口的命中率进行了排行
PORT SPECIFICATION AND SCAN ORDER: #端口说明和扫描顺序
-p <port ranges>: Only scan specified ports #设置端口范围，单个端口，多个端口，范围端口等
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
--exclude-ports <port ranges>: Exclude the specified ports from scanning #去除某些端口
-F: Fast mode - Scan fewer ports than the default scan #快速扫描，仅扫描常用的100个端口
-r: Scan ports consecutively - don't randomize #顺序扫描，从小到大
--top-ports <number>: Scan <number> most common ports #扫描name-services中前number个端口
--port-ratio <ratio>: Scan ports more common than <ratio>
六.输出选项
OUTPUT: #输出选项
-oN/-oX/-oS/-oG <file>: Output scan in normal, XML, s|<rIpt kIddi3,#oN：正常输出，不显示runtime和警告信息 oX：生成xml文件 oG：保存为便于Grep使用的文件
and Grepable format, respectively, to the given filename.
-oA <basename>: Output in the three major formats at once
-v: Increase verbosity level (use -vv or more for greater effect)
-d: Increase debugging level (use -dd or more for greater effect)
--reason: Display the reason a port is in a particular state
--open: Only show open (or possibly open) ports
--packet-trace: Show all packets sent and received
--iflist: Print host interfaces and routes (for debugging)
--append-output: Append to rather than clobber specified output files
--resume <filename>: Resume an aborted scan
--stylesheet <path/URL>: XSL stylesheet to transform XML output to HTML
--webxml: Reference stylesheet from Nmap.Org for more portable XML
--no-stylesheet: Prevent associating of XSL stylesheet w/XML output
七.时间排程控制选项
TIMING AND PERFORMANCE: #时间和执行
Options which take <time> are in seconds, or append 'ms' (milliseconds),
's' (seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
-T<0-5>: Set timing template (higher is faster) #6种时间排程模式，默认为模式3
--min-hostgroup/max-hostgroup <size>: Parallel host scan group sizes
--min-parallelism/max-parallelism <numprobes>: Probe parallelization
--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout <time>: Specifies
probe round trip time.
--max-retries <tries>: Caps number of port scan probe retransmissions.
--host-timeout <time>: Give up on target after this long
--scan-delay/--max-scan-delay <time>: Adjust delay between probes
--min-rate <number>: Send packets no slower than <number> per second
--max-rate <number>: Send packets no faster than <number> per second
八.常用选项
1.服务版本识别
SERVICE/VERSION DETECTION: #服务/版本检测
-sV: Probe open ports to determine service/version info #检测服务器软件的版本信息
--version-intensity <level>: Set from 0 (light) to 9 (try all probes)
--version-light: Limit to most likely probes (intensity 2)
--version-all: Try every single probe (intensity 9)
--version-trace: Show detailed version scan activity (for debugging)
2.操作系统检测
OS DETECTION:#操作系统检测
-O: Enable OS detection #开启系统检测功能
--osscan-limit: Limit OS detection to promising targets
--osscan-guess: Guess OS more aggressively
3.主机检测
HOST DISCOVERY:
-sL: List Scan - simply list targets to scan
-sn: Ping Scan - disable port scan
-Pn: Treat all hosts as online -- skip host discovery #认为所有主机都在线，防止其他主机对本机进行了ping屏蔽
-PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO[protocol list]: IP Protocol Ping
-n/-R: Never do DNS resolution/Always resolve [default: sometimes]
--dns-servers <serv1[,serv2],...>: Specify custom DNS servers
--system-dns: Use OS's DNS resolver
--traceroute: Trace hop path to each host
4.强有力扫描和扫描ipv6主机
MISC:
-6: Enable IPv6 scanning #允许ipv6扫描模式
-A: Enable OS detection, version detection, script scanning, and traceroute #扫描服务版本，操作系统，脚本扫描，traceroute
--datadir <dirname>: Specify custom Nmap data file location
--send-eth/--send-ip: Send using raw ethernet frames or IP packets
--privileged: Assume that the user is fully privileged
--unprivileged: Assume the user lacks raw socket privileges
-V: Print version number
-h: Print this help summary page.