mirror of
https://github.com/LCTT/TranslateProject.git
synced 2024-12-26 21:30:55 +08:00
wcnnbdk1 translated 20170111 NMAP Common Scans – Part One.md
This commit is contained in:
Jinwen Zhang
parent
56c0ddeec8
commit
fe2fbdb405
@ -1,95 +0,0 @@
|
||||
wcnnbdk1 translating
|
||||
NMAP Common Scans – Part One
|
||||
========================
|
||||
|
||||
In a previous article, ‘[NMAP Installation][1]’, a listing of ten different ZeNMAP Profiles were listed. Most of the Profiles used various parameters. Most of the parameters represented different scans which can be performed. This article will cover the common four scan types.
|
||||
|
||||
**The Common Four Scan Types**
|
||||
|
||||
The four main scan types which are used most often are the following:
|
||||
|
||||
1. PING Scan (-sP)
|
||||
2. TCP SYN Scan (-sS)
|
||||
3. TCP Connect() Scan (-sT)
|
||||
4. UDP Scan (-sU)
|
||||
|
||||
When using NMAP to perform scans these four scans are the four to keep in mind. The main thing to keep in mind about them is what they do and how they do it. This article covers the PING and UDP scans. The next article will cover the TCP scans.
|
||||
|
||||
**PING Scan (-sP)**
|
||||
|
||||
Some scans can flood the network with packets, but the Ping Scan only puts, at most, two packets on the network. The two packets do not count DNS Lookup or ARP Requests if needed. A minimum of one packet is required per IP Address being scanned.
|
||||
|
||||
A typical PING operation is used to determine if a network host is on-line with the IP Address specified. For example, if I were on the Internet and found that I could not reach a specific Web Server I could PING the Server to determine if it were on-line. The PING would also verify that the route between my system and the Web Server was also functioning.
|
||||
|
||||
**NOTE:** When discussing TCP/IP the information is both useful for the Internet and a Local Area Network (LAN) using TCP/IP. The procedures work for both. The procedures would also work for a Wide Area Network (WAN) just as well.
|
||||
|
||||
If the Domain Name Service (DNS) Server is needed to find the IP Address (if a Domain Name is given) then extra packets are generated. For example, to ‘ping linuxforum.com’ would first require that the IP Address (98.124.199.63) be found for the Domain Name (linuxforum.com). If the command ‘ping 98.124.199.63’ was executed then the DNS Lookup is not needed. If the MAC Address is unknown, then an ARP Request is sent to find the MAC Address of the system with the specified IP Address.
|
||||
|
||||
The PING command sends an Internet Control Message Protocol (ICMP) packet to the given IP Address. The packet is an ICMP Echo Request which needs a response. A response will be sent back if the system is on-line. If a Firewall exists between the two systems a PING can be dropped by the Firewall. Some servers can be configured to ignore PING requests as well to prevent the possibility of a PING of Death.
|
||||
|
||||
**NOTE:** The PING of Death is a malformed PING packet which is sent to a system and causes it to leave a connection open to wait for the rest of the packet. Once a bunch of these are sent to the same system it will refuse any connections since it has all available connection opened. The system is then technically unavailable.
|
||||
|
||||
Once a system receives the ICMP Echo Request it will respond with an ICMP Echo Reply. Once the source system receives the ICMP Echo Reply then it knows the system is on-line.
|
||||
|
||||
Using NMAP you specify a single IP Address or a range of IP Addresses. A PING is then performed on each IP Address when a PING Scan (-sP) is specified.
|
||||
|
||||
In Figure 1 you can see I performed the command ‘nmap -sP 10.0.0.1-10’. The program will try to contact every system with an IP Address of 10.0.0.1 to 10.0.0.10\. An ARP is sent out, three for each IP Address given to the command. In this case thirty requests went out – two for each of the ten IP Addresses.
|
||||
|
||||
|
||||
|
||||
**FIGURE 1**
|
||||
|
||||
Figure 2 shows the Wireshark capture from another machine on the network – yes it is a Windows system. Line 1 shows the first request sent out to IP Address 10.0.0.2\. The IP Address 10.0.0.1 was skipped due to it being the local system on which NMAP was being run. Now we can say that there were only 27 ARP Requests since the local one was skipped. Line 2 shows the ARP Response from the system with the IP Address of 10.0.0.2\. Lines 3 through 10 are ARP Requests for the remaining IP Addresses. Line 11 is another response from the system at IP Address 10.0.0.2 since it has not heard back from the requesting system (10.0.0.1). Line 12 is a response from the source system to 10.0.0.2 responding with ‘SYN’ at Sequence 0\. Line 13 and 14 are the system at 10.0.0.2 responding twice with the Restart (RST) and Synchronize (SYN) response to close the two connections it had opened on Lines 2 and 11\. Notice the Sequence ID is ‘1’ - the source Sequence ID + 1\. Lines 15 on are a continuation of the same.
|
||||
|
||||
|
||||
|
||||
**FIGURE 2**
|
||||
|
||||
Looking back at Figure 1 we can see that there were two hosts found up and running. Of course the local system was found (10.0.0.1) and one other (10.0.0.2). The whole scan took a total time of 14.40 seconds.
|
||||
|
||||
The PING Scan is a fast scan used to find systems which are up and running. No other information is really found about the network or the systems from the scan. The scan is a good start to see what is available on a network so you can perform more complex scans on the on-line systems only. You may also be able to find systems on the network which should not exist. Rogue systems on a network can be dangerous because they can be gathering internal network and system information easily.
|
||||
|
||||
Once you have a list of on-line systems you can then detect what Ports may be open on each system with a UDP Scan.
|
||||
|
||||
**UDP Scan (-sU)**
|
||||
|
||||
Now that you know what systems are available to scan you can concentrate on these IP Addresses only. It is not a good idea to flood a network with a lot of scan activity. Administrators can have programs monitor network traffic and alert them when large amounts of suspicious activities occur.
|
||||
|
||||
The User Datagram Protocol (UDP) is useful to determine open Ports on an on-line system. Since UDP is a connectionless protocol, a response is not needed. This scan can send a UDP packet to a system with a specified Port number. If the target system does not respond then the Port is either closed or filtered. If the Port is open then a response should be made. In most cases a target system will send an ICMP message back that the Port is unreachable. The ICMP information lets NMAP know that the Port is closed. If a Port is open then the target system should respond with an ICMP message to let NMAP know it is an available Port.
|
||||
|
||||
**NOTE: **Only the top 1,000 most used Ports are scanned. A deeper scan will be covered in later articles.
|
||||
|
||||
In my scan I will only perform the scan on the system with the IP Address 10.0.0.2 since I know it is on-line. The scan sends and receives a total of 3,278 packets. The result of the NMAP command ‘sudo nmap -sU 10.0.0.2’ is shown in Figure 3.
|
||||
|
||||
|
||||
|
||||
**FIGURE 3**
|
||||
|
||||
Here you can see that one Port was found open – 137 (netbios-ns). The results from Wireshark are shown in Figure 4\. Not much to see but a bunch of UDP packets.
|
||||
|
||||
|
||||
|
||||
**FIGURE 4**
|
||||
|
||||
What would happen if I turned off the Firewall on the target system? My results are quite a bit different. The NMAP command and results are shown in Figure 5.
|
||||
|
||||
|
||||
|
||||
**FIGURE 5**
|
||||
|
||||
**NOTE:** When performing a UDP Scan you are required to have root permissions.
|
||||
|
||||
The high quantity of the number of packets is due to the fact that UDP is being used. Once the NMAP system sends a request it is not guaranteed that the packet was received. Because of the possible loss of packets the packets are sent multiple times.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://www.linuxforum.com/threads/nmap-common-scans-part-one.3637/
|
||||
|
||||
作者：[Jarret][a]
|
||||
译者：[译者ID](https://github.com/译者ID)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:https://www.linuxforum.com/members/jarret.268/
|
||||
[1]:https://www.linuxforum.com/threads/nmap-installation.3431/
|
||||
94
translated/tech/20170111 NMAP Common Scans – Part One.md
Normal file
94
translated/tech/20170111 NMAP Common Scans – Part One.md
Normal file
@ -0,0 +1,94 @@
|
||||
NMAP 常用扫描简介 - 第一部分
|
||||
========================
|
||||
|
||||
我们之前在‘[NMAP 的安装][1]’一文中，列出了 10 种不同的 ZeNMAP 扫描模式（这里将 Profiles 翻译成了模式，不知是否合适）。大多数的模式使用了各种参数。大多数的参数代表了执行不同的扫描模式。这篇文章将介绍其中的四种通用的扫描类型。
|
||||
|
||||
**四种通用扫描类型**
|
||||
|
||||
下面列出了最常使用的四种扫描类型：
|
||||
|
||||
1. PING 扫描 (-sP)
|
||||
2. TCP SYN 扫描 (-sS)
|
||||
3. TCP Connect() 扫描 (-sT)
|
||||
4. UDP 扫描 (-sU)
|
||||
|
||||
当我们利用 NMAP 来执行扫描的时候，这四种扫描类型是我们需要熟练掌握的。更重要的是需要知道这些命令做了什么并且需要知道这些命令是怎么做的。本文将介绍 PING 扫描和 UDP 扫描。在之后的文中会介绍 TCP 扫描。
|
||||
|
||||
**PING 扫描 (-sP)**
|
||||
|
||||
某些扫描会造成网络拥塞，然而 Ping 扫描在网络中最多只会产生两个包。当然这两个包不包括可能需要的 DNS 搜索和 ARP 请求。每个被扫描的 IP 最少只需要一个包来完成 Ping 扫描。
|
||||
|
||||
通常 Ping 扫描是用来查看在指定的 IP 地址上是否有在线的主机存在。例如，当我拥有网络连接却联不上一台指定的网络服务器的时候，我就可以使用 PING 来判断这台服务器是否在线。PING 同样也可以用来验证我的当前设备与网络服务器之间的路由是否正常。
|
||||
|
||||
**注意:** 当我们讨论 TCP/IP 的时候，相关信息在使用 TCP/IP 协议的英特网与局域网（LAN）中都是相当有用的。这些程序都能工作。同样在广域网（WAN）也能工作得相当好。
|
||||
|
||||
当参数给出的是一个域名的时候，我们就需要域名解析服务来找到相对应的 IP 地址，这个时候将会生成一些额外的包。例如，当我们执行 ‘ping linuxforum.com’ 的时候，需要首先请求域名（linuxforum.com）的 IP 地址（98.124.199.63)。当我们执行 ‘ping 98.124.199.63’ 的时候 DNS 查询就不需要了。当 MAC 地址未知的时候，就需要发送 ARP 请求来获取指定 IP 地址的 MAC 地址了（这里的指定 IP 地址，未必是目的 IP）。
|
||||
|
||||
Ping 命令会向指定的 IP 地址发送一个英特网信息控制协议（ICMP）包。这个包是需要响应的 ICMP Echo 请求。当服务器系统在线的状态下我们会得到一个响应包。当两个系统之间存在防火墙的时候，PING 请求包可能会被防火墙丢弃。一些服务器也会被配置成不响应 PING 请求来避免可能发生的死亡之 PING。（现在的操作系统似乎不太可能）
|
||||
|
||||
**注意:** 死亡之 PING 是一种恶意构造的 PING 包当它被发送到系统的时候，会造成被打开的连接等待一个 rest 包。一旦有一堆这样的恶意请求被系统响应，由于所有的可用连接都已经被打开所以系统将会拒绝所有其它的连接。技术上来说这种状态下的系统就是不可达的。
|
||||
|
||||
当系统收到 ICMP Echo 请求后它将会返回一个 ICMP Echo 响应。当源系统收到 ICMP Echo 响应后我们就能知道目的系统是在线可达的。
|
||||
|
||||
使用 NMAP 的时候你可以指定单个 IP 地址也可以指定 某个 IP 地址段。当被指定为 PING 扫描（-sP）的时候，PING 命令将会对每一个 IP 地址执行。
|
||||
|
||||
在图 1 中你可以看到我执行‘nmap -sP 10.0.0.1-10’命令后的结果。An ARP is sent out, three for each IP Address given to the command. In this case thirty requests went out – two for each of the ten IP Addresses.(这两句话就没有读懂，不清楚具体指的是什么意思，从图2看的话第一句里的三指的是两个 ARP 包和一个 ICMP 包，按照下面一段话的描述的话就是每个 IP 地址会有三个 ARP 请求，但是自己试的时候 Centos6 它发了两个 ARP 请求没获取到 MAC 地址也就就结束了，这里不清楚究竟怎么理解)
|
||||
|
||||
|
||||
|
||||
**图 1**
|
||||
|
||||
图 2 中展示了利用 Wireshark 抓取的从网络上另一台计算机发出的请求-的确是在 Windows 系统下完成这次抓取的。第一行展示了发出的第一条请求，广播请求的是 10.0.0.2 IP 地址对应 MAC 地址。由于 NMAP 是在 10.0.0.1 这台机器上执行的，因此 10.0.0.1 被略过了。由于本机 IP 地址被略过，我们现在可以说总共只发出了 27 个 ARP 请求。第二行展示了 10.0.0.2 这台机器的 ARP 响应。第三行到第十行是其它八个 IP 地址的 ARP 请求。第十一行是由于没有收到请求系统（10.0.0.1）的反馈所以发送的另一个 ARP 响应。（自己试的话它发送一个请求收到一个响应就结束了，也没有搜到相关的重发响应是否存在的具体说明，不是十分清楚）第十二行是源系统向 10.0.0.2 响应的 ‘SYN’ 和 Sequence 0。（这行感觉更像是三次握手里的首包）第十三行和第十四行的两次 Restart（RST）和 Synchronize（SYN）响应是用来关闭第二行和第十一行所打开的连接的。（这个描述似乎有问题 ARP 请求怎么会需要 TCP 来关闭连接呢，感觉像是第十二行的响应）注意 Sequence ID 是 ‘1’ - 是源 Sequence ID + 1。(这个不理解，不是应该 ACK = seq + 1 的么）第十五行开始就是类似相同的内容。
|
||||
|
||||
|
||||
|
||||
**图 2**
|
||||
|
||||
回到图 1 中我们可以看到有两台主机在线。其中一台是本机（10.0.0.1）另一台是（10.0.0.2）。整个扫描花费了 14.40 秒。
|
||||
|
||||
PING 扫描是一种用来发现在线主机的快速扫描方式。扫描结果中没有关于网络、系统的其它信息。这是一种较好的初步发现网络上在线主机的方式，接着你就可以针对在线系统执行更加复杂的扫描了。你可能还会发现一些不应该出现在网络上的系统。出现在网络上的流氓软件是很危险的，他们可以很轻易的收集内网信息和相关的系统信息。
|
||||
|
||||
一旦你获得了在线系统的列表，你就可以使用 UDP 扫描来查看哪些端口是可能开启了的。
|
||||
|
||||
**UDP 扫描 (-sU)**
|
||||
|
||||
现在你已经知道了有那些系统是在线的，你的扫描就可以聚焦在这些 IP 地址之上。在整个网络上执行大量的没有针对性的扫描活动可不是一个好主意。系统管理员可以使用程序来监控网络流量当有大量可以活动发生的时候就会触发警报。
|
||||
|
||||
用户数据报协议（UDP）在发现在线系统的开放端口方面十分有用。由于 UDP 不是一个面向连接的协议，因此是不需要响应的。这种扫描方式可以向指定的端口发送一个 UDP 包。如果目标系统没有回应那么这个端口可能是关闭的也可能是被过滤了的。如果端口是开放状态的那么应该会有一个响应。在大多数的情况下目标系统会返回一个 ICMP 信息说端口不可达。ICMP 信息让 NMAP 知道端口是被关闭了。如果端口是开启的状态那么目标系统应该响应 ICMP 信息来告知 NMAP 端口可达。
|
||||
|
||||
**注意: **只有最前面的1024个常用端口会被扫描。（这里将 1000 改成了1024，因为手册中写的是默认扫描 1 到 1024 端口）在后面的文章中我们会介绍如何进行深度扫描。
|
||||
|
||||
由于我知道 10.0.0.2 这个主机是在线的，因此我只会针对这个 IP 地址来执行扫描。扫描过程中总共收发了 3278 个包。‘sudo nmap -sU 10.0.0.2’这个命令的输出结果在图 3 中展现。
|
||||
|
||||
|
||||
|
||||
**图 3**
|
||||
|
||||
在这副图中你可以看见端口 137（netbios-ns）被发现是开放的。在图 4 中展示了 Wireshark 抓包的结果。不能看到所有抓取的包，但是可以看到一长串的 UDP 包。
|
||||
|
||||
|
||||
|
||||
**图 4**
|
||||
|
||||
如果我把目标系统上的防火墙关闭之后会发生什么呢？我的结果有那么一点的不同。NMAP 命令的执行结果在图 5 中展示。
|
||||
|
||||
|
||||
|
||||
**图 5**
|
||||
|
||||
**注意:** 当你执行 UDP 扫描的时候是需要 root 权限的。
|
||||
|
||||
会产生大量的包是由于我们使用了 UDP。当 NMAP 发送 UDP 请求时它是不保证数据包会被收到的。因为数据包可能会在中途丢失因此它会多次发送请求。
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
via: https://www.linuxforum.com/threads/nmap-common-scans-part-one.3637/
|
||||
|
||||
作者：[Jarret][a]
|
||||
译者：[wcnnbdk1](https://github.com/wcnnbdk1)
|
||||
校对：[校对者ID](https://github.com/校对者ID)
|
||||
|
||||
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
||||
|
||||
[a]:https://www.linuxforum.com/members/jarret.268/
|
||||
[1]:https://www.linuxforum.com/threads/nmap-installation.3431/
|
||||
Loading…
Reference in New Issue
Block a user