0

我现在正在一个网站上学习 nmap，但我什么都不懂。当我尝试使用 nmap 通过以下命令扫描端口时：

sudo nmap -sS x.x.x.x.

我明白了：

Nmap scan report for x.x.x.x

Host is up (0.011s latency).

Not shown: 992 closed ports

PORT    STATE    SERVICE

21/tcp  open     ftp

22/tcp  open     ssh

53/tcp  filtered domain

80/tcp  open     http

110/tcp open     pop3

139/tcp open     netbios-ssn

143/tcp open     imap

445/tcp filtered microsoft-ds

但是当我尝试使用这样的-S命令时：

sudo nmap -sS x.x.x.x -S x.x.x.x -e eth0 -Pn

我明白了：

Nmap done: 1 IP address (0 hosts up) scanned in 1.53 seconds

为什么我没有使用该-S选项获得打开的端口，但是当我使用 -sS/-sT选项时，我得到了显示的端口？您通常什么时候使用该-S选项？

4

1 回答 1

1

这是对该选项的详细说明，当您阅读它们时，您将理解为什么扫描时没有结果我希望您发现此答案对您有所帮助-S <IP_Address>（欺骗源地址）

In some circumstances, Nmap may not be able to determine your source address (Nmap will tell you if this is the case). In this situation, use -S with the IP address of the interface you wish to send packets through.

Another possible use of this flag is to spoof the scan to make the targets think that someone else is scanning them. Imagine a company being repeatedly port scanned by a competitor! The -e option and -Pn are generally required for this sort of usage. Note that you usually won't receive reply packets back (they will be addressed to the IP you are spoofing), so Nmap won't produce useful reports.

-e（使用指定接口）

Tells Nmap what interface to send and receive packets on. Nmap should be able to detect this automatically, but it will tell you if it cannot.

-Pn（无 ping）

This option skips the host discovery stage altogether. Normally, Nmap uses this stage to determine active machines for heavier scanning and to gauge the speed of the network. By default, Nmap only performs heavy probing such as port scans, version detection, or OS detection against hosts that are found to be up. Disabling host discovery with -Pn causes Nmap to attempt the requested scanning functions against every target IP address specified. So if a /16 sized network is specified on the command line, all 65,536 IP addresses are scanned. Proper host discovery is skipped as with the list scan, but instead of stopping and printing the target list, Nmap continues to perform requested functions as if each target IP is active. Default timing parameters are used, which may result in slower scans. To skip host discovery and port scan, while still allowing NSE to run, use the two options -Pn -sn together.

For machines on a local ethernet network, ARP scanning will still be performed (unless --disable-arp-ping or --send-ip is specified) because Nmap needs MAC addresses to further scan target hosts. In previous versions of Nmap, -Pn was -P0 and -PN.
于 2021-06-30T16:37:41.983 回答