nmap 学习笔记#

1
~ ❯ nmap -A -T4 scanme.nmap.org
2

3
Starting Nmap 7.93 ( https://nmap.org ) at 2025-12-05 11:27 CST
4
Nmap scan report for scanme.nmap.org (45.33.32.156)
5
Host is up (0.13s latency).
6
Other addresses for scanme.nmap.org (not scanned): 2600:3c01::f03c:91ff:fe18:bb2f
7
Not shown: 995 closed tcp ports (reset)
8
PORT      STATE    SERVICE    VERSION
9
22/tcp    open     ssh        OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.13 (Ubuntu Linux; protocol 2.0)
10
| ssh-hostkey:
11
|   1024 ac00a01a82ffcc5599dc672b34976b75 (DSA)
12
|   2048 203d2d44622ab05a9db5b30514c2a6b2 (RSA)
13
|   256 9602bb5e57541c4e452f564c4a24b257 (ECDSA)
14
|_  256 33fa910fe0e17b1f6d05a2b0f1544156 (ED25519)
15
25/tcp    filtered smtp
16
80/tcp    open     http       Apache httpd 2.4.7 ((Ubuntu))
17
|_http-title: Go ahead and ScanMe!
18
|_http-favicon: Nmap Project
19
|_http-server-header: Apache/2.4.7 (Ubuntu)
20
9929/tcp  open     nping-echo Nping echo
21
31337/tcp open     tcpwrapped
22
Device type: general purpose
23
Running: Linux 4.X|5.X
24
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
25
OS details: Linux 4.15 - 5.6
26
Network Distance: 18 hops
27
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
28

29
TRACEROUTE (using port 80/tcp)
30
HOP RTT       ADDRESS
31
1   3.57 ms   11.73.1.158
32
2   9.77 ms   11.73.1.217
33
3   4.83 ms   10.216.247.202
34
4   3.55 ms   117.49.36.154
35
5   4.14 ms   10.216.224.170
36
6   5.33 ms   101.95.211.117
37
7   6.62 ms   101.95.208.9
38
8   ...
39
9   6.17 ms   202.97.24.242
40
10  7.59 ms   202.97.90.57
41
11  160.14 ms 202.97.92.78
42
12  143.93 ms 218.30.53.51
43
13  128.46 ms ae-3.akamai.snjsca04.us.bb.gin.ntt.net (140.174.21.78)
44
14  131.68 ms ae22.gw3.scz1.netarch.akamai.com (23.203.158.51)
45
15  ... 17
46
18  127.14 ms scanme.nmap.org (45.33.32.156)
47

48
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
49
Nmap done: 1 IP address (1 host up) scanned in 41.12 seconds

1
nmap -sn 192.168.1.0/24          # 局域网 ping 扫描，输出存活列表

1
nmap -sS -F -oG - 192.168.1.0/24 | awk '{print $2","$5}' > live_ports.csv

1
nmap -sV -p80,443,8080-8090 -T4 --open 10.0.0.0/8

1
nmap -sS -f -r -D 1.1.1.1,8.8.8.8,ME -S 4.4.4.4 -e eth0  target.com

1
nmap -A -p- -T5 --min-rate=1000 --max-rtt-timeout=200ms -oA full_scan  target_ip

1
nmap --resume full_scan.nmap   # 只支持 normal/-oN 格式续扫