Nmap也就网络映射器（Network Mapper），是一个免费开放的网络扫描和嗅探工具。该工具可以扫描主机是否在线、所开放的端口号、提供的网络服务及操作系统类型等。本节将介绍Nmap工具的使用。在使用Nmap工具之前，首先需要了解它的几种扫描类型。Nmap主要的扫描类型如表4-1所示。
表4-1 Nmap扫描类型
【实例4-1】使用nmap工具扫描目标主机192.168.6.105的端口号。执行命令如下所示：
root@kali:~# nmap -sS -Pn 192.168.6.105
Starting Nmap 6.46 ( http://nmap.org ) at 2014-07-16 09:25 CST
Nmap scan report for 192.168.6.105
Host is up (0.00014s latency).
Not shown: 977 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
25/tcp open smtp
53/tcp open domain
80/tcp open http
111/tcp open rpcbind
139/tcp open netbios-ssn
445/tcp open microsoft-ds
512/tcp open exec
513/tcp open login
514/tcp open shell
1099/tcp open rmiregistry
1524/tcp open ingreslock
2049/tcp open nfs
2121/tcp open ccproxy-ftp
3306/tcp open mysql
5432/tcp open postgresql
5900/tcp open vnc
6000/tcp open X11
6667/tcp open irc
8009/tcp open ajp13
8180/tcp open unknown
MAC Address: 00:0C:29:13:E0:3D (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.48 seconds
以上输出信息显示了，目标主机192.168.6.105上开放的所有端口号及目标主机的信息，如目标主机的MAC地址、扫描共用了0.48秒。在以上命令中，-sS选项表示使用TCP SYN扫描；-Pn选项表示不进行ping扫描。这里使用TCP SYN扫描，是因为这种方式扫描速度非常快，并且不容易被目标主机发现。
如果用户想查看目标主机的所有启动服务及服务版本，可以指定Nmap工具的-A选项来实现。
【实例4-2】扫描目标主机192.168.6.105上所有的端口号和服务版本。执行命令如下所示：
root@kali:~# nmap -sS -Pn -A 192.168.6.105 Starting Nmap 6.46 ( http://nmap.org ) at 2014-07-16 09:25 CST Nmap scan report for 192.168.6.105 Host is up (0.00035s latency). Not shown: 977 closed ports PORT STATE SERVICE VERSION 21/tcp open ftp vsftpd 2.3.4 |_ftp-anon: Anonymous FTP login allowed (FTP code 230) 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0) | ssh-hostkey: | 1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA) |_ 2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA) 23/tcp open telnet Linux telnetd 25/tcp open smtp Postfix smtpd |_smtp-commands: metasploitable.localdomain, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN, | ssl-cert: Subject: commonName=ubuntu804-base.localdomain/organizationName=OCOSA/stateOrProvinceName=There is no such thing outside US/countryName=XX | Not valid before: 2010-03-17T14:07:45+00:00 |_Not valid after: 2010-04-16T14:07:45+00:00 |_ssl-date: 2014-07-09T06:59:06+00:00; -6d18h27m07s from local time. 53/tcp open domain ISC BIND 9.4.2 | dns-nsid: |_ bind.version: 9.4.2 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) |_http-methods: No Allow or Public header in OPTIONS response (status code 200) |_http-title: Metasploitable2 – Linux …… 6667/tcp open irc Unreal ircd | irc-info: | server: irc.Metasploitable.LAN | version: Unreal3.2.8.1. irc.Metasploitable.LAN | servers: 1 | users: 1 | lservers: 0 | lusers: 1 | uptime: 0 days, 20:28:27 | source host: 45DFBD5E.E9742FE6.FFFA6D49.IP |_ source ident: nmap 8009/tcp open ajp13 Apache Jserv (Protocol v1.3) |_ajp-methods: Failed to get a valid response for the OPTION request 8180/tcp open http Apache Tomcat/Coyote JSP engine 1.1 |_http-favicon: Apache Tomcat |_http-methods: No Allow or Public header in OPTIONS response (status code 200) |_http-title: Apache Tomcat/5.5 MAC Address: 00:0C:29:13:E0:3D (VMware) Device type: general purpose Running: Linux 2.6.X OS CPE: cpe:/o:linux:linux_kernel:2.6 OS details: Linux 2.6.9 - 2.6.33 Network Distance: 1 hop Service Info: Hosts: metasploitable.localdomain, localhost, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel Host script results: |_nbstat: NetBIOS name: METASPLOITABLE, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown) | smb-os-discovery: | OS: Unix (Samba 3.0.20-Debian) | NetBIOS computer name: | Workgroup: WORKGROUP |_ System time: 2014-07-09T02:59:06-04:00 TRACEROUTE HOP RTT ADDRESS 1 0.35 ms 192.168.6.105 OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 25.58 seconds |
从输出的信息中，可以看到目标主机上所启动的服务及服务软件版本。例如Unreal Internet Relay Chat（IRC）服务，它的版本是3.8.1。用户可以通过获取到服务的版本，进行攻击主机。下面将会以例子的形式介绍通过服务版本，攻击主机的方法。
