{"position":0,"title":"介绍","layout":"doc-fullscreen","text":"## 介绍nnNmap (Network Mapper) 是网络安全和管理中的一个基本工具。这个实验向你介绍了 Nmap 扫描标志，这些标志使你能够执行有效的网络侦察和漏洞评估。通过实践，你将学习如何使用各种 Nmap 命令来发现主机、扫描端口以及识别网络上的服务。这些技能对于网络管理员和安全专业人员来说至关重要，可以帮助他们维护安全的网络环境。n","need_verify":false,"has_solution":false},{"position":1,"title":"安装 Nmap 和基本扫描","layout":"doc-workbench-split","text":"## 安装 Nmap 和基本扫描nn### 安装 NmapnnNmap 并没有预先安装在大多数系统上，所以我们的第一步是安装它。在你的 LabEx 环境中打开一个终端，并运行以下命令：nn```bashnsudo apt updatensudo apt install nmap -yn```nn安装完成后，通过检查 Nmap 的版本来验证它是否正确安装：nn```bashnnmap --versionn```nn你应该看到类似这样的输出：nn```nNmap version 7.80 ( https://nmap.org )nPlatform: x86_64-pc-linux-gnunCompiled with: liblua-5.3.3 openssl-1.1.1f libssh2-1.8.0 libz-1.2.11 libpcre-8.39 libpcap-1.9.1 nmap-libdnet-1.12 ipv6nCompiled without:nA vailable nsock engines: epoll poll select 理解 Nmap 基础知识 Nmap 的工作方式，说白了就是向目标主机发送专门构造的数据包，再根据返回结果做分析。借助这一点，可以判断出： - 网络上哪些主机是在线的 - 它们对外提供了哪些服务（端口） - 它们运行的是哪种操作系统 - 使用的是什么类型的包过滤器或防火墙 Nmap 命令的基本语法是： nmap [scan type] [options] target 其中： - `[scan type]` 用来指定要执行的扫描类型 - `[options]` 是对扫描进行自定义的附加参数 - `target` 则是要扫描的 IP 地址、主机名，或者一段 IP 范围 ### 你的第一次扫描：扫描本地主机 先从自己的机器，也就是本地主机开始。执行下面这条命令： ```bash nmap localhost ``` 这条命令会扫描本机上最常见的 1000 个 TCP 端口，输出大致如下： ``` Starting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 15:30 UTC Nmap scan report for localhost (127.0.0.1) Host is up (0.00010s latency). Not shown: 996 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 631/tcp open ipp 3306/tcp open mysql Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds ``` 这段输出展示了这些信息： - 扫描开始的时间 - 当前正在扫描的主机（localhostt/127.0.0.1）n- 开放端口及其相关服务n- 扫描完成时间和统计信息nn### 理解扫描结果nn让我们分析一下输出：nn- `PORT`: 显示端口号和协议（例如，22/tcp）n- `STATE`: 指示端口是开放、关闭还是被过滤n- `SERVICE`: 显示通常与该端口关联的服务nn最常见的端口状态是：nn- `open`: 端口正在接受连接n- `closed`: 端口可访问，但没有应用程序正在侦听它n- `filtered`: Nmap 无法确定端口是否开放，因为数据包过滤正在阻止其探测nn### 扫描特定端口nn要扫描特定端口，请使用 `-p` 标志，后跟端口号：nn```bashnnmap -p 22 localhostn```nn输出将集中在端口 22 上：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 15:35 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00013s latency).nnPORT STATE SERVICEn22/tcp open sshnnNmap done: 1 IP address (1 host up) scanned in 0.01 secondsn```nn### 扫描端口范围nn你可以使用连字符扫描端口范围：nn```bashnnmap -p 20-25 localhostn```nn这将扫描端口 20 到 25：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 15:40 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00012s latency).nnPORT STATE SERVICEn20/tcp closed ftp-datan21/tcp closed ftpn22/tcp open sshn23/tcp closed telnetn24/tcp closed priv-mailn25/tcp closed smtpnnNmap done: 1 IP address (1 host up) scanned in 0.03 secondsn```nn现在你已经学会了如何安装 Nmap 并执行基本的端口扫描。在下一步中，我们将探索使用各种 Nmap 标志的更高级的扫描技术。n","need_verify":true,"has_solution":false},{"position":2,"title":"探索必要的 Nmap 扫描标志","layout":"doc-workbench-split","text":"## 探索必要的 Nmap 扫描标志nn现在你已经了解了 Nmap 的基础知识，让我们探索一些必要的扫描标志，这些标志将让你从扫描中获得更多的控制和信息。nn### TCP SYN 扫描 (-sS)nnTCP SYN 扫描是在以 root 身份运行时默认的扫描类型。它通常被称为“半开放”扫描，因为它从不完成 TCP 连接。它相对隐蔽且快速。nn让我们在本地主机上运行一个 SYN 扫描：nn```bashnsudo nmap -sS localhostn```nn输出将类似于：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 16:00 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00011s latency).nNot shown: 996 closed portsnPORT STATE SERVICEn22/tcp open sshn80/tcp open httpn631/tcp open ippn3306/tcp open mysqlnnNmap done: 1 IP address (1 host up) scanned in 0.10 secondsn```nn### TCP Connect 扫描 (-sT)nn当 Nmap 未以 root 权限运行时，TCP Connect 扫描是默认扫描。它完成了完整的 TCP 握手，这使得它更容易被检测到，但在某些情况下也更可靠。nn```bashnnmap -sT localhostn```nn输出：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 16:05 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00014s latency).nNot shown: 996 closed portsnPORT STATE SERVICEn22/tcp open sshn80/tcp open httpn631/tcp open ippn3306/tcp open mysqlnnNmap done: 1 IP address (1 host up) scanned in 0.15 secondsn```nn### 服务版本检测 (-sV)nn版本检测标志告诉 Nmap 尝试确定在开放端口上运行的服务的版本：nn```bashnnmap -sV localhostn```nn输出：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 16:10 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00012s latency).nNot shown: 996 closed portsnPORT STATE SERVICE VERSIONn22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)n80/tcp open http Apache httpd 2.4.41 ((Ubuntu))n631/tcp open ipp CUPS 2.3n3306/tcp open mysql MySQL 8.0.30-0ubuntu0.20.04.2nService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelnnNmap done: 1 IP address (1 host up) scanned in 6.41 secondsn```nn请注意，输出现在包括每个服务的详细版本信息。这对于安全评估来说非常宝贵，因为某些版本可能存在已知的漏洞。nn### 操作系统检测 (-O)nn操作系统检测标志尝试确定目标操作系统的类型：nn```bashnsudo nmap -O localhostn```nn输出：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 16:15 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00011s latency).nNot shown: 996 closed portsnPORT STATE SERVICEn22/tcp open sshn80/tcp open httpn631/tcp open ippn3306/tcp open mysqlnDevice type: general purposenRunning: Linux 4.X|5.XnOS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5nOS details: Linux 4.15 - 5.6nNetwork Distance: 0 hopsnnOS detection performed. Please report any incorrect results at https://nmap.org/submit/ .nNmap done: 1 IP address (1 host up) scanned in 1.57 secondsn```nn请注意，Nmap 已经检测到系统正在运行 Linux 内核版本 4.X 或 5.X。nn### 结合标志进行全面扫描nn你可以结合多个标志来获得更全面的结果。例如，让我们结合服务版本检测和操作系统检测：nn```bashnsudo nmap -sV -O localhostn```nn输出：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 16:20 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00015s latency).nNot shown: 996 closed portsnPORT STATE SERVICE VERSIONn22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)n80/tcp open http Apache httpd 2.4.41 ((Ubuntu))n631/tcp open ipp CUPS 2.3n3306/tcp open mysql MySQL 8.0.30-0ubuntu0.20.04.2nDevice type: general purposenRunning: Linux 4.X|5.XnOS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5nOS details: Linux 4.15 - 5.6nNetwork Distance: 0 hopsnService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelnnOS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .nNmap done: 1 IP address (1 host up) scanned in 7.23 secondsn```nn### 积极扫描 (-A)nn积极扫描标志结合了几个扫描选项，包括操作系统检测、版本检测、脚本扫描和 traceroute：nn```bashnsudo nmap -A localhostn```nn输出（为简洁起见已截断）：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 16:25 UTC Nmap 对 localhost（127.0.0.1）的扫描结果如下： 主机在线，延迟为 0.00014 秒。 另外有 996 个端口处于关闭状态。 端口 状态 服务 版本 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5（Ubuntu Linux；协议 2.0） | ssh-hostkey: | 3072 e2:5d:9c:5c:62:42:44:cd:fc:31:e0:a6:18:11:69:1c（RSA） | 256 7d:95:f0:2f:7a:95:3a:4d:f3:52:ef:6f:6b:af:01:71（ECDSA） |_ 256 90:12:20:de:cb:c0:76:3a:fb:15:db:75:4e:78:fc:d7（ED25519） 80/tcp open http Apache httpd 2.4.41（Ubuntu） |_http-server-header: Apache/2.4.41（Ubuntu） |_http-title: Apache2 Ubuntu Default Page: It works 631/tcp open ipp CUPS 2.3 |_http-server-header: CUPS/2.3 IPP/2.1 |_http-title: Home - CUPS 2.3.1 3306/tcp open mysql MySQL 8.0.30-0ubuntu0.20.04.2 | mysql-info: | Protocol: 10 | Version: 8.0.30-0ubuntu0.20.04.2n| Thread ID: 11n| Capabilities flags: 65535n| Some Capabilities: SupportsLoadDataLocal, Support41Auth, Speaks41ProtocolOld, IgnoreSigpipes, DontAllowDatabaseTableColumn, FoundRows, SupportsCompression, ConnectWithDatabase, LongPassword, InteractiveClient, SwitchToSSLAfterHandshake, ODBCClient, Speaks41ProtocolNew, IgnoreSpaceBeforeParenthesis, LongColumnFlag, SupportsTransactions, SupportsMultipleResults, SupportsAuthPlugins, SupportsMultipleStatmentsn| Status: Autocommitn| Salt: \x14\x12\x1Fjw\x182\x15\x0D\x12\x13C\x1F\x14\x0D\x07n|_ Auth Plugin Name: caching_sha2_passwordnDevice type: general purposenRunning: Linux 4.X|5.XnOS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5nOS details: Linux 4.15 - 5.6nNetwork Distance: 0 hopsnnOS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .nNmap done: 1 IP address (1 host up) scanned in 10.12 secondsn```nn请注意积极扫描提供的额外信息量，包括 SSH 密钥信息、HTTP 服务器详细信息以及更详细的 MySQL 服务信息。nn在这一步中，你已经了解了几个必要的 Nmap 扫描标志以及如何将它们组合起来以获得更全面的结果。在下一步中，我们将探索针对不同场景的实用扫描策略。n","need_verify":true,"has_solution":false},{"position":3,"title":"网络扫描策略和时间控制","layout":"doc-workbench-split","text":"## 网络扫描策略和时间控制nn在这一步中，我们将学习网络扫描策略以及如何控制 Nmap 扫描的时间和性能。这在扫描大型网络或需要更谨慎时至关重要。nn### 扫描多个主机nnNmap 可以通过多种方式扫描多个主机：nn#### 扫描 IP 列表nn你可以指定多个 IP 地址，用空格分隔：nn```bashnnmap 127.0.0.1 127.0.0.2n```nn#### 扫描 IP 范围nn你可以使用 CIDR 符号扫描 IP 范围：nn```bashnnmap 127.0.0.1/30n```nn此命令扫描 127.0.0.0 到 127.0.0.3。输出将显示：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 16:35 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00013s latency).nNot shown: 996 closed portsnPORT STATE SERVICEn22/tcp open sshn80/tcp open httpn631/tcp open ippn3306/tcp open mysqlnnNmap scan report for 127.0.0.2nHost is up (0.00015s latency).nAll 1000 scanned ports on 127.0.0.2 are closednnNmap scan report for 127.0.0.3nHost is up (0.00013s latency).nAll 1000 scanned ports on 127.0.0.3 are closednnNmap done: 4 IP addresses (3 hosts up) scanned in 0.92 secondsn```nn### 主机发现选项nn#### Ping 扫描 (-sn)nn有时你只想知道哪些主机在线，而无需扫描端口。Ping 扫描非常适合此目的：nn```bashnnmap -sn 127.0.0.1/24n```nn此命令将扫描整个 127.0.0.1/24 子网，但仅执行主机发现，而不进行端口扫描。由于输出长度，我们只显示一个片段：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 16:40 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00011s latency).nNmap scan report for 127.0.0.2nHost is up (0.00013s latency).nNmap scan report for 127.0.0.3nHost is up (0.00014s latency).n...nNmap done: 256 IP addresses (256 hosts up) scanned in 2.34 secondsn```nn#### 跳过主机发现 (-Pn)nn有时防火墙会阻止 ping 请求。要绕过此限制并扫描所有主机，而不考虑 ping 响应，请使用 `-Pn` 标志：nn```bashnnmap -Pn localhostn```nn输出：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 16:45 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00012s latency).nNot shown: 996 closed portsnPORT STATE SERVICEn22/tcp open sshn80/tcp open httpn631/tcp open ippn3306/tcp open mysqlnnNmap done: 1 IP address (1 host up) scanned in 0.12 secondsn```nn### 时间和性能控制nnNmap 提供了几个时间模板，用于调整各种扫描参数：nn- `-T0`: Paranoid（偏执）- 非常慢，用于规避 IDSn- `-T1`: Sneaky（鬼祟）- 慢，用于规避 IDSn- `-T2`: Polite（礼貌）- 减慢速度以减少带宽消耗n- `-T3`: Normal（正常）- 默认，平衡速度和可靠性n- `-T4`: Aggressive（激进）- 更快，假设网络速度合理且可靠n- `-T5`: Insane（疯狂）- 非常快，假设网络速度极快nn让我们尝试一个激进的扫描：nn```bashnnmap -T4 localhostn```nn输出：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 16:50 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00011s latency).nNot shown: 996 closed portsnPORT STATE SERVICEn22/tcp open sshn80/tcp open httpn631/tcp open ippn3306/tcp open mysqlnnNmap done: 1 IP address (1 host up) scanned in 0.09 secondsn```nn请注意，扫描完成的速度略快于默认扫描。nn### 输出格式nnNmap 可以将扫描结果保存为各种格式，以便以后进行分析或报告：nn#### 正常输出 (-oN)nn将扫描结果以正常格式保存到文件中：nn```bashnnmap -oN scan_results.txt localhostn```nn此命令将扫描输出保存到当前目录中的 `scan_results.txt`。nn#### XML 输出 (-oX)nn将扫描结果保存为 XML 格式，这对于使用其他工具进行解析很有用：nn```bashnnmap -oX scan_results.xml localhostn```nn#### 所有格式 (-oA)nn将扫描结果保存为所有格式（正常、XML 和 grepable）：nn```bashnnmap -oA scan_results localhostn```nn这将创建三个文件：`scan_results.nmap`、`scan_results.xml` 和 `scan_results.gnmap`。nn让我们检查正常输出文件的内容：nn```bashncat scan_results.txtn```nn输出：nn```n## Nmap 7.80 scan initiated Thu Sep 14 16:55:23 2023 as: nmap -oN scan_results.txt localhostnNmap scan report for localhost (127.0.0.1)nHost is up (0.00013s latency).nNot shown: 996 closed portsnPORT STATE SERVICEn22/tcp open sshn80/tcp open httpn631/tcp open ippn3306/tcp open mysqlnn## Nmap done at Thu Sep 14 16:55:23 2023 -- 1 IP address (1 host up) scanned in 0.12 secondsn```nn### 实用扫描策略nn让我们结合我们所学到的知识，为全面扫描创建一个实用的扫描策略：nn```bashnsudo nmap -sS -sV -O -T4 -oA comprehensive_scan localhostn```nn此命令：nn- 使用 SYN 隐身扫描 (-sS)n- 检测服务版本 (-sV)n- 尝试操作系统检测 (-O)n- 使用激进的时间设置 (-T4)n- 将结果保存为所有格式 (-oA)nn输出：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 17:00 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00012s latency).nNot shown: 996 closed portsnPORT STATE SERVICE VERSIONn22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)n80/tcp open http Apache httpd 2.4.41 ((Ubuntu))n631/tcp open ipp CUPS 2.3n3306/tcp open mysql MySQL 8.0.30-0ubuntu0.20.04.2nDevice type: general purposenRunning: Linux 4.X|5.XnOS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5nOS details: Linux 4.15 - 5.6nNetwork Distance: 0 hopsnService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelnnOS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .nNmap done: 1 IP address (1 host up) scanned in 7.42 secondsn```nn现在你可以在任何输出文件中查看全面的扫描结果：nn```bashnls comprehensive_scan.*n```nn输出：nn```ncomprehensive_scan.gnmap comprehensive_scan.nmap comprehensive_scan.xmln```nn### 道德考量nn请记住，网络扫描应该仅在你拥有或已获得明确许可扫描的网络上执行。未经授权的扫描可能：nn1. 在许多司法管辖区是非法的n2. 被网络管理员视为敌对行为n3. 可能会中断网络服务nn在这个实验环境中，我们只扫描了 `localhost`，这总是允许的，因为它属于你自己的系统。nn你现在已经了解了不同的网络扫描策略、时间控制和输出格式。你拥有使用 Nmap 执行有效网络侦察所需的所有基础知识。n","need_verify":true,"has_solution":false},{"position":4,"title":"脚本扫描和目标服务分析","layout":"doc-workbench-split","text":"## 脚本扫描和目标服务分析nn在这一步中，我们将探索 Nmap 强大的脚本引擎 (NSE)，并学习如何执行目标服务分析。NSE 脚本通过启用对特定服务和漏洞的更详细扫描来扩展 Nmap 的功能。nn### Nmap 脚本引擎 (NSE) 简介nnNmap 脚本引擎允许用户编写和共享脚本，以自动化各种网络任务。Nmap 附带了数百个预先编写的脚本，这些脚本被分类到各种组中：nn- `auth`: 与身份验证相关的脚本n- `default`: 默认情况下使用 `-sC` 运行的脚本n- `discovery`: 主机和服务发现n- `exploit`: 尝试利用漏洞n- `malware`: 检测恶意软件和后门n- `safe`: 安全的、非侵入性的脚本n- `vuln`: 漏洞检测脚本nn### 运行默认脚本 (-sC)nn`-sC` 标志运行默认的脚本集，这些脚本通常是安全的，并提供有用的信息：nn```bashnnmap -sC localhostn```nn输出：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 17:10 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00012s latency).nNot shown: 996 closed portsnPORT STATE SERVICEn22/tcp open sshn| ssh-hostkey:n| 3072 e2:5d:9c:5c:62:42:44:cd:fc:31:e0:a6:18:11:69:1c (RSA)n| 256 7d:95:f0:2f:7a:95:3a:4d:f3:52:ef:6f:6b:af:01:71 (ECDSA)n|_ 256 90:12:20:de:cb:c0:76:3a:fb:15:db:75:4e:78:fc:d7 (ED25519)n80/tcp open httpn|_http-title: Apache2 Ubuntu Default Page: It worksn631/tcp open ippn|_http-server-header: CUPS/2.3 IPP/2.1n|_http-title: Home - CUPS 2.3.1n3306/tcp open mysqln|_mysql-info: ERROR: Script execution failed (use -d to debug)nnNmap done: 1 IP address (1 host up) scanned in 3.42 secondsn```nn请注意，脚本如何提供了关于每个服务的附加信息，例如 SSH 主机密钥和 HTTP 页面标题。nn### 运行特定脚本nn你可以使用 `--script` 标志运行特定脚本，后跟脚本名称或类别：nn```bashnnmap --script=http-title localhostn```nn这仅运行 http-title 脚本，该脚本检索 HTTP 页面的标题：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 17:15 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00013s latency).nNot shown: 996 closed portsnPORT STATE SERVICEn22/tcp open sshn80/tcp open httpn|_http-title: Apache2 Ubuntu Default Page: It worksn631/tcp open ippn|_http-title: Home - CUPS 2.3.1n3306/tcp open mysqlnnNmap done: 1 IP address (1 host up) scanned in 0.68 secondsn```nn### 按类别运行脚本nn你可以运行特定类别中的所有脚本：nn```bashnnmap --script=discovery localhostn```nn这将运行所有发现脚本，这些脚本可以提供关于网络服务的丰富信息（为简洁起见，输出已截断）：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 17:20 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00014s latency).nNot shown: 996 closed portsnPORT STATE SERVICEn22/tcp open sshn| ssh-hostkey:n| 3072 e2:5d:9c:5c:62:42:44:cd:fc:31:e0:a6:18:11:69:1c (RSA)n| 256 7d:95:f0:2f:7a:95:3a:4d:f3:52:ef:6f:6b:af:01:71 (ECDSA)n|_ 256 90:12:20:de:cb:c0:76:3a:fb:15:db:75:4e:78:fc:d7 (ED25519)n80/tcp open httpn|_http-fa vicon: Unknown fa vicon MD5: 6D33949773573A11BEBE0D20AC1B7967n| http-methods:n|_ Supported Methods: GET POST OPTIONS HEADn|_http-title: Apache2 Ubuntu Default Page: It worksn631/tcp open ippn| cups-info:n| CUPS Server:n| Server: CUPS/2.3 IPP/2.1n|_ Authentication-Method: Basicn| http-methods:n|_ Supported Methods: GET HEAD OPTIONS POSTn|_http-server-header: CUPS/2.3 IPP/2.1n|_http-title: Home - CUPS 2.3.1n3306/tcp open mysqln| mysql-info:n| Protocol: 10n| Version: 8.0.30-0ubuntu0.20.04.2n| Thread ID: 15n| Capabilities flags: 65535n| Some Capabilities: ConnectWithDatabase, SupportsLoadDataLocal, SupportsTransactions, DontAllowDatabaseTableColumn, Support41Auth, InteractiveClient, Speaks41ProtocolOld, FoundRows, IgnoreSigpipes, ODBCClient, SwitchToSSLAfterHandshake, IgnoreSpaceBeforeParenthesis, LongColumnFlag, Speaks41ProtocolNew, SupportsMultipleStatments, LongPassword, SupportsCompression, SupportsMultipleResults, SupportsAuthPluginsn| Status: Autocommitn| Salt: \x7FeL)\x0C\x5C#S\x06N%\x1E\x7EYaCn|_ Auth Plugin Name: caching_sha2_passwordnnNmap done: 1 IP address (1 host up) scanned in 5.28 secondsn```nn### 将脚本扫描与服务检测相结合nn为了获得最全面的结果，请将脚本扫描与服务检测相结合：nn```bashnnmap -sV -sC localhostn```nn输出：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 17:25 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00012s latency).nNot shown: 996 closed portsnPORT STATE SERVICE VERSIONn22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)n| ssh-hostkey:n| 3072 e2:5d:9c:5c:62:42:44:cd:fc:31:e0:a6:18:11:69:1c (RSA)n| 256 7d:95:f0:2f:7a:95:3a:4d:f3:52:ef:6f:6b:af:01:71 (ECDSA)n|_ 256 90:12:20:de:cb:c0:76:3a:fb:15:db:75:4e:78:fc:d7 (ED25519)n80/tcp open http Apache httpd 2.4.41 ((Ubuntu))n|_http-server-header: Apache/2.4.41 (Ubuntu)n|_http-title: Apache2 Ubuntu Default Page: It worksn631/tcp open ipp CUPS 2.3n|_http-server-header: CUPS/2.3 IPP/2.1n|_http-title: Home - CUPS 2.3.1n3306/tcp open mysql MySQL 8.0.30-0ubuntu0.20.04.2n|_mysql-info: ERROR: Script execution failed (use -d to debug)nService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelnnService detection performed. Please report any incorrect results at https://nmap.org/submit/ .nNmap done: 1 IP address (1 host up) scanned in 9.03 secondsn```nn### 目标服务分析nn让我们重点关注更详细地分析特定服务。nn#### 分析 HTTP 服务nn要详细分析 HTTP 服务，我们可以使用 `http-*` 脚本：nn```bashnnmap --script="http-*" -p 80 localhostn```nn这会针对端口 80 运行所有与 HTTP 相关的脚本：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 17:30 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00012s latency).nnPORT STATE SERVICEn80/tcp open httpn|_http-chrono: Request times for /; a vg: 32.68ms; min: 32.68ms; max: 32.68msn|_http-comments-displayer: Couldn't find any comments.n|_http-date: Thu, 14 Sep 2023 17:30:24 GMT; +6s from local time.n|_http-devframework: Couldn't determine the underlying framework or CMS. Try increasing 'httpspider.maxpagecount' value to spider more pages.n|_http-dombased-xss: Couldn't find any DOM based XSS.n|_http-fa vicon: Unknown fa vicon MD5: 6D33949773573A11BEBE0D20AC1B7967n|_http-feed: Couldn't find any feeds.n|_http-fetch: Please enter the complete path of the directory to sa ve data in.n|_http-generator: Couldn't find any generator in the HTML headers and bodyn| http-methods:n|_ Supported Methods: GET POST OPTIONS HEADn|_http-mobileversion-checker: No mobile version detected.n|_http-referer-checker: Couldn't find any cross-domain scripts.n|_http-security-headers:n| http-server-header:n| Apache/2.4.41n|_ Apache/2.4.41 (Ubuntu)n|_http-title: Apache2 Ubuntu Default Page: It worksn|_http-traceroute: ERROR: Script execution failed (use -d to debug)n|_http-useragent-tester:n|_http-xssed: No previously reported XSS vuln.nnNmap done: 1 IP address (1 host up) scanned in 2.31 secondsn```nn#### 分析 SSH 服务nn同样，我们可以分析 SSH 服务：nn```bashnnmap --script="ssh-*" -p 22 localhostn```nn输出：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 17:35 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00013s latency).nnPORT STATE SERVICEn22/tcp open sshn| ssh-hostkey:n| 3072 e2:5d:9c:5c:62:42:44:cd:fc:31:e0:a6:18:11:69:1c (RSA)n| 256 7d:95:f0:2f:7a:95:3a:4d:f3:52:ef:6f:6b:af:01:71 (ECDSA)n|_ 256 90:12:20:de:cb:c0:76:3a:fb:15:db:75:4e:78:fc:d7 (ED25519)n|_ssh-run: ERROR: Script execution failed (use -d to debug)nnNmap done: 1 IP address (1 host up) scanned in 0.26 secondsn```nn### 漏洞扫描nnNmap 包含可以检测潜在漏洞的脚本。使用 `vuln` 类别可以帮助识别安全问题：nn```bashnnmap --script=vuln localhostn```nn这可能需要一些时间，因为它会运行各种漏洞检查。输出可能如下所示：nn```nStarting Nmap 7.80 ( https://nmap.org ) at 2023-09-14 17:40 UTCnNmap scan report for localhost (127.0.0.1)nHost is up (0.00012s latency).nNot shown: 996 closed portsnPORT STATE SERVICEn22/tcp open sshn80/tcp open httpn|_http-csrf: Couldn't find any CSRF vulnerabilities.n|_http-dombased-xss: Couldn't find any DOM based XSS.n| http-slowloris-check:n| VULNERABLE:n| Slowloris DOS attackn| State: LIKELY VULNERABLEn| IDs: CVE:CVE-2007-6750n| Slowloris tries to keep many connections to the target web server open and holdn| them open as long as possible. It accomplishes this by opening connections ton| the target web server and sending a partial request. By doing so, it starvesn| the http server's resources causing Denial Of Service.n|n| Disclosure date: 2009-09-17n| References:n| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750n|_ https://ha.ckers.org/slowloris/n|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.n631/tcp open ippn3306/tcp open mysqlnnNmap done: 1 IP address (1 host up) scanned in 87.28 secondsn```nn在这种情况下，Nmap 已经确定 Apache Web 服务器可能容易受到 Slowloris DoS 攻击。此信息对于保护你的系统可能很有价值。nn### 创建全面的扫描报告nn现在，让我们结合我们所学到的一切来创建全面的安全报告：nn```bashnsudo nmap -sS -sV -O -sC --script=vuln -T4 -oA comprehensive_security_report localhostn```nn此命令：nn- 使用 SYN 隐身扫描 (-sS)n- 检测服务版本 (-sV)n- 尝试操作系统检测 (-O)n- 运行默认脚本 (-sC)n- 运行漏洞检测脚本 (--script=vuln)n- 使用激进的时间设置 (-T4)n- 将结果保存为所有格式 (-oA)nn输出将是全面的，可能需要一些时间才能完成。完成后，你将获得一份详细的安全报告，其中包含各种格式（正常、XML 和 grepable），你可以参考这些报告进行安全分析。nn在这一步中，你已经学习了如何使用 Nmap 的脚本引擎来收集关于服务的详细信息并检测潜在的漏洞。这些高级技术对于全面的网络安全评估至关重要。n","need_verify":true,"has_solution":false},{"position":5,"title":"总结","layout":"doc-fullscreen","text":"## 总结nn在这个实验中，你已经学习了使用 Nmap 进行网络侦察和安全评估的基础知识。你现在了解：nn1. 如何安装 Nmap 并执行对主机和端口的基本扫描n2. 如何使用 Nmap 的基本扫描标志进行不同类型的扫描n3. 如何实施有效的扫描策略并控制时间参数n4. 如何利用 Nmap 脚本引擎进行详细的服务分析和漏洞检测nn这些技能构成了网络安全评估的基础，并且对于网络安全专业人员至关重要。请记住，始终负责任地使用这些技术，并且仅在你有权扫描的网络上使用。nn在你继续你的网络安全之旅时，请考虑探索更高级的 Nmap 功能，例如自定义 NSE 脚本开发、防火墙规避技术以及与其他安全工具的集成。定期练习 Nmap 将帮助你更熟练地识别网络环境中潜在的安全问题。n","need_verify":false,"has_solution":false}