French

French - 技术经验
澄其心, 断其欲, 方能悟道
  1. 首页
  2. Linux
  3. Kali
  4. Nmap
  5. 正文

06-Kali中Nmap的脚本扫描

2020-08-11 2292点热度 0人点赞 0条评论

本篇中我们来了解一下Nmap的一些高级用法, 脚本扫描,

在nmap有,有一些官方自带的脚本文件,他们通常被存储在下面这个路径中

/usr/share/nmap/scripts/

我们可以看出,图中有很多后缀为nse的文件,这个文件就是nmap能够运行的脚本文件,我们

--script=auth

# auth: 负责处理鉴权证书
nmap --script=auth IP地址

运行结果:

root@Hoime-Kali:/usr/share/nmap/scripts# nmap --script=auth 192.168.75.3
Starting Nmap 7.80 ( https://nmap.org ) at 2020-07-13 23:25 CST
Nmap scan report for 192.168.75.3
Host is up (0.00057s latency).
Not shown: 997 filtered ports
PORT    STATE  SERVICE
22/tcp  open   ssh
| ssh-auth-methods: 
|   Supported authentication methods: 
|     publickey
|     gssapi-keyex
|     gssapi-with-mic
|_    password
| ssh-publickey-acceptance: 
|_  Accepted Public Keys: No public keys accepted
80/tcp  open   http
|_http-config-backup: ERROR: Script execution failed (use -d to debug)
| http-vuln-cve2010-0738: 
|_  /jmx-console/: Authentication was not required
443/tcp closed https
MAC Address: 00:0C:29:BB:4E:7C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 51.42 seconds

--script=default

# default: 默认扫描脚本
nmap --script=default IP地址

运行结果

root@Hoime-Kali:/usr/share/nmap/scripts# nmap --script=default 192.168.75.3
Starting Nmap 7.80 ( https://nmap.org ) at 2020-07-13 23:32 CST
Nmap scan report for 192.168.75.3
Host is up (0.00045s latency).
Not shown: 997 filtered ports
PORT    STATE  SERVICE
22/tcp  open   ssh
| ssh-hostkey: 
|   2048 72:f4:f3:6e:a6:f3:4b:42:e1:c8:5e:d2:ed:9b:6c:ea (RSA)
|   256 89:10:dc:40:16:68:cd:51:1c:f5:74:5e:a0:d9:2b:fe (ECDSA)
|_  256 5b:cd:40:a3:d7:e1:3f:53:31:fa:35:0f:f5:0d:c1:16 (ED25519)
80/tcp  open   http
|_http-title: French - \xE4\xB8\xBA\xE6\x91\xA7\xE6\xAF\x81AI\xE8\x80\x8C\xE7\x94\x9F
443/tcp closed https
MAC Address: 00:0C:29:BB:4E:7C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 9.72 seconds

--script=fuzzer

# fuzzer: 模糊测试 通过发送异常的数据包到目标机器,从而探测出潜在漏洞
nmap --script=fuzzer IP地址

运行结果

root@Hoime-Kali:/usr/share/nmap/scripts# nmap --script=fuzzer 192.168.75.3
Starting Nmap 7.80 ( https://nmap.org ) at 2020-07-13 23:34 CST
Nmap scan report for 192.168.75.3
Host is up (0.00057s latency).
Not shown: 997 filtered ports
PORT    STATE  SERVICE
22/tcp  open   ssh
80/tcp  open   http
443/tcp closed https
MAC Address: 00:0C:29:BB:4E:7C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 11.79 seconds

--script=broadcast

# broadcast : 局域网内探查更多服务开启状况,如dhcp/dns/sqlserver等服务
nmap --script=broadcast IP地址

运行结果

root@Hoime-Kali:/usr/share/nmap/scripts# nmap --script=broadcast 192.168.75.3
Starting Nmap 7.80 ( https://nmap.org ) at 2020-07-13 23:42 CST
too short
Pre-scan script results:
| broadcast-avahi-dos: 
|   Discovered hosts:
|     224.0.0.251
|   After NULL UDP avahi packet DoS (CVE-2011-1002).
|_  Hosts are all up (not vulnerable).
| broadcast-dhcp-discover: 
|   Response 1 of 1: 
|     IP Offered: 192.168.75.137
|     Server Identifier: 192.168.75.254
|     Subnet Mask: 255.255.255.0
|     Router: 192.168.75.2
|     Domain Name Server: 192.168.75.2
|     Domain Name: localdomain
|     Broadcast Address: 192.168.75.255
|_    NetBIOS Name Server: 192.168.75.2
| broadcast-dns-service-discovery: 
|   224.0.0.251
|     47989/tcp nvstream_dbd
|_      Address=192.168.75.4 fe80::d5dc:c56e:fea:2ee
| broadcast-igmp-discovery: 
|   192.168.75.4
|     Interface: eth0
|     Version: 2
|     Group: 224.0.0.252
|     Description: Link-local Multicast Name Resolution (rfc4795)
|_  Use the newtargets script-arg to add the results as targets
| broadcast-listener: 
|   ether
|       EIGRP Hello
|         
|       ARP Request
|         sender ip     sender mac         target ip
|         192.168.75.4  00:50:56:c0:00:08  192.168.75.2
|   udp
|       LLMNR
|         ip                       query
|         fe80::d5dc:c56e:fea:2ee  DESKTOP-0LKS2M3
|_        192.168.75.4             DESKTOP-0LKS2M3
|_eap-info: please specify an interface with -e
| ipv6-multicast-mld-list: 
|   fe80::a5a4:1b6d:da2:e9da: 
|     device: eth0
|     mac: 00:0c:29:bb:4e:7c
|     multicast_ips: 
|       ff02::1:ffa2:e9da         (NDP Solicited-node)
|       ff02::1:ff58:94d9         (Solicited-Node Address)
|       ff02::1:ffa2:e9da         (NDP Solicited-node)
|       ff02::1:ff58:94d9         (Solicited-Node Address)
|       ff02::1:ff58:94d9         (Solicited-Node Address)
|       ff02::1:ff58:94d9         (Solicited-Node Address)
|       ff02::1:ffa2:e9da         (NDP Solicited-node)
|       ff02::1:ffa2:e9da         (NDP Solicited-node)
|       ff02::1:ffa2:e9da         (NDP Solicited-node)
|   fe80::d5dc:c56e:fea:2ee: 
|     device: eth0
|     mac: 00:50:56:c0:00:08
|     multicast_ips: 
|       ff02::1:ffea:2ee          (NDP Solicited-node)
|       ff02::1:3                 (Link-local Multicast Name Resolution)
|       ff02::1:3                 (Link-local Multicast Name Resolution)
|       ff02::1:3                 (Link-local Multicast Name Resolution)
|       ff02::1:3                 (Link-local Multicast Name Resolution)
|       ff02::1:3                 (Link-local Multicast Name Resolution)
|       ff02::1:3                 (Link-local Multicast Name Resolution)
|       ff02::1:3                 (Link-local Multicast Name Resolution)
|       ff02::1:3                 (Link-local Multicast Name Resolution)
|       ff02::1:ffdd:a515         (Solicited-Node Address)
|       ff02::fb                  (mDNSv6)
|       ff02::1:ffdd:a515         (Solicited-Node Address)
|_      ff02::1:3                 (Link-local Multicast Name Resolution)
| targets-ipv6-multicast-echo: 
|   IP: fe80::a5a4:1b6d:da2:e9da  MAC: 00:0c:29:bb:4e:7c  IFACE: eth0
|_  Use --script-args=newtargets to add the results as targets
| targets-ipv6-multicast-invalid-dst: 
|   IP: fe80::a5a4:1b6d:da2:e9da  MAC: 00:0c:29:bb:4e:7c  IFACE: eth0
|_  Use --script-args=newtargets to add the results as targets
| targets-ipv6-multicast-mld: 
|   IP: fe80::a5a4:1b6d:da2:e9da  MAC: 00:0c:29:bb:4e:7c  IFACE: eth0
|   IP: fe80::d5dc:c56e:fea:2ee   MAC: 00:50:56:c0:00:08  IFACE: eth0
| 
|_  Use --script-args=newtargets to add the results as targets
| targets-ipv6-multicast-slaac: 
|   IP: fe80::d5dc:c56e:fea:2ee    MAC: 00:50:56:c0:00:08  IFACE: eth0
|   IP: fe80::2191:2af6:76dd:a515  MAC: 00:50:56:c0:00:08  IFACE: eth0
|   IP: fe80::50e2:d2f9:9558:94d9  MAC: 00:0c:29:bb:4e:7c  IFACE: eth0
|_  Use --script-args=newtargets to add the results as targets
Nmap scan report for 192.168.75.3
Host is up (0.00039s latency).
Not shown: 997 filtered ports
PORT    STATE  SERVICE
22/tcp  open   ssh
80/tcp  open   http
443/tcp closed https
MAC Address: 00:0C:29:BB:4E:7C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 45.64 seconds

--script=malware

# malware: 探测目标主机是否感染了病毒、开启了后门等信息
nmap --script=malware IP地址

运行结果

root@Hoime-Kali:/usr/share/nmap/scripts# nmap --script=malware 192.168.75.3
Starting Nmap 7.80 ( https://nmap.org ) at 2020-07-13 23:48 CST
Nmap scan report for 192.168.75.3
Host is up (0.00060s latency).
Not shown: 997 filtered ports
PORT    STATE  SERVICE
22/tcp  open   ssh
80/tcp  open   http
443/tcp closed https
MAC Address: 00:0C:29:BB:4E:7C (VMware)

Nmap done: 1 IP address (1 host up) scanned in 6.17 seconds
参数简介
--script=auth负责处理鉴权证书
--script=default默认的扫描方式
--script=fuzzer模糊测试 通过发送异常的数据包到目标机器,从而探测出潜在漏洞
--script=broadcast局域网内探查更多服务开启状况,如dhcp/dns/sqlserver等服务
--script=malware探测目标主机是否感染了病毒、开启了后门等信息

 

 

 

 

本作品采用 知识共享署名-非商业性使用 4.0 国际许可协议 进行许可
标签: Kali Nmap
最后更新:2020-08-12

French

这个人很懒,什么都没留下

打赏 点赞
< 上一篇

文章评论

razz evil exclaim smile redface biggrin eek confused idea lol mad twisted rolleyes wink cool arrow neutral cry mrgreen drooling persevering
取消回复

COPYRIGHT © 2018-2024 French. ALL RIGHTS RESERVED.

Theme Kratos Made By Seaton Jiang

蜀ICP备2022008471号-1

川公网安备 51130202000393号