（1）-sP ：进行ping扫描
|
1
|
nmap -sP 10.0.3.0/24 |
这个命令可以用于探测局域网有哪些机器
|
1
2
3
4
5
6
7
8
9
10
11
|
[root@B ~]# nmap -sP 10.0.3.0/24Starting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 11:24 CSTNmap scan report for 10.0.3.1Host is up (0.0079s latency).Nmap scan report for 10.0.3.2Host is up (0.0046s latency).Nmap scan report for 10.0.3.3Host is up (0.0037s latency).Nmap done: 256 IP addresses (3 hosts up) scanned in 10.01 seconds[root@B ~]# |
（2） -sn：
-sn: Ping Scan - disable port scan #ping探测扫描主机， 不进行端口扫描 （测试过对方主机把icmp包都丢弃掉，依然能检测到对方开机状态）
|
1
2
3
4
5
6
7
8
9
10
|
[root@B ~]# nmap -sn 10.0.1.161-166Starting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 11:25 CSTNmap scan report for 10.0.1.161Host is up (0.00076s latency).MAC Address: 00:0C:29:56:DE:46 (VMware)Nmap scan report for 10.0.1.162Host is up.Nmap done: 6 IP addresses (2 hosts up) scanned in 0.76 seconds[root@B ~]# |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
[root@B ~]# nmap 10.0.1.161 -sAStarting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 13:55 CSTNmap scan report for 10.0.1.161Host is up (0.00030s latency).All 1000 scanned ports on 10.0.1.161 are unfilteredMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 1.53 seconds[root@B ~]# nmap 10.0.1.166 -sAStarting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 13:55 CSTNote: Host seems down. If it is really up, but blocking our ping probes, try -PnNmap done: 1 IP address (0 hosts up) scanned in 0.51 seconds[root@B ~]# |
|
1
2
3
4
5
|
使用频率最高的扫描选项：SYN扫描,又称为半开放扫描，它不打开一个完全的TCP连接，执行得很快，效率高（一个完整的tcp连接需要3次握手，而-sS选项不需要3次握手）Tcp SYN Scan (sS) 它被称为半开放扫描优点：Nmap发送SYN包到远程主机，但是它不会产生任何会话，目标主机几乎不会把连接记入系统日志。（防止对方判断为扫描攻击），扫描速度快，效率高，在工作中使用频率最高缺点：它需要root/administrator权限执行 |
命令如下
|
1
|
nmap -sS 10.0.1.161 |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
[root@B ~]# nmap -sS 10.0.1.161 Starting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 11:38 CSTNmap scan report for 10.0.1.161Host is up (0.00028s latency).Not shown: 995 closed portsPORT STATE SERVICE22/tcp open ssh111/tcp open rpcbind873/tcp open rsync7777/tcp open cbt8888/tcp open sun-answerbookMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 1.31 seconds[root@B ~]# |
|
1
2
3
4
|
Tcp connect() scan (sT)和上面的Tcp SYN 对应，TCP connect()扫描就是默认的扫描模式.不同于Tcp SYN扫描,Tcp connect()扫描需要完成三次握手,并且要求调用系统的connect().优点：你勿需root权限。普通用户也可以使用。缺点：这种扫描很容易被检测到，在目标主机的日志中会记录大批的连接请求以及错误信息，由于它要完成3次握手，效率低，速度慢，建议使用-sS |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
[root@B ~]# nmap -sT 10.0.1.161Starting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 11:40 CSTNmap scan report for 10.0.1.161Host is up (0.00048s latency).Not shown: 995 closed portsPORT STATE SERVICE22/tcp open ssh111/tcp open rpcbind873/tcp open rsync7777/tcp open cbt8888/tcp open sun-answerbookMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 0.27 seconds[root@B ~]# |
（3）sU：udp端口的扫描
|
1
|
nmap -sU 10.0.1.161 |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
[root@B ~]# nmap -sF 10.0.1.161Starting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 11:46 CSTNmap scan report for 10.0.1.161Host is up (0.00050s latency).Not shown: 997 closed portsPORT STATE SERVICE22/tcp open|filtered ssh111/tcp open|filtered rpcbind873/tcp open|filtered rsyncMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 2.59 seconds[root@B ~]# |
-sF、-sX、-sN
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
秘密FIN数据包扫描、圣诞树(XmasTree)、空(Null)扫描模式有的防火墙可能专门阻止-sS扫描。使用这些扫描可以发送特殊标记位的数据包比如，-sF发送一个设置了FIN标志的数据包它们和-sS一样也需要完成TCP的握手.和sS扫描效果差不多，都比sT速度快除了探测报文的标志位不同，三种扫描在行为上一致优势：能躲过一些无状态防火墙和报文过滤路由器，比SYN还要隐秘劣势：现代的IDS产品可以发现，并非所有的系统严格遵循RFC 793即使SYN扫描都无法确定的情况下使用：一些防火墙和包过滤软件能够对发送到被限制端口的SYN数据包进行监视，而且有些程序比如synlogger和courtney能够检测那些扫描。使用-sF、-sX、-sN可以逃过这些干扰。这些扫描方式的理论依据是：关闭的端口需要对你的探测包回应RST包，而打开的端口必需忽略有问题的包。FIN扫描使用暴露的FIN数据包来探测，而圣诞树扫描打开数据包的FIN、URG和PUSH标志。由于微软决定完全忽略这个标准，另起炉灶。所以这种扫描方式对Windows无效。不过，从另外的角度讲，可以使用这种方式来分别两种不同的平台。如果使用这种扫描方式可以发现打开的端口，你就可以确定目标注意运行的不是Windows系统。如果使用-sF、-sX或者-sN扫描显示所有的端口都是关闭的，而使用-sS（SYN）扫描显示有打开的端口，你可以确定目标主机可能运行的是Windwos系统。现在这种方式没有什么太大的用处，因为nmap有内嵌的操作系统检测功能。还有其它几个系统使用和windows同样的处理方式，包括Cisco、BSDI、HP/UX、MYS、IRIX。在应该抛弃数据包时，以上这些系统都会从打开的端口发出复位数据包。 |
|
1
2
3
4
5
6
7
8
9
10
11
|
[root@B ~]# nmap -sW 10.0.1.161 -p22Starting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 13:17 CSTNmap scan report for 10.0.1.161Host is up (0.0027s latency).PORT STATE SERVICE22/tcp closed sshMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 0.34 seconds[root@B ~]# |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
[root@B ~]# nmap -sV 10.0.1.161Starting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 13:18 CSTNmap scan report for 10.0.1.161Host is up (0.00017s latency).Not shown: 997 closed portsPORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 5.3 (protocol 2.0)111/tcp open rpcbind873/tcp open rsync (protocol version 30)MAC Address: 00:0C:29:56:DE:46 (VMware)Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 6.60 seconds[root@B ~]# |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
[root@B ~]# nmap -iR 2 -Pn -p22Starting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 13:51 CSTNmap scan report for LFbn-1-4041-19.w86-233.abo.wanadoo.fr (86.233.49.19)Host is up.PORT STATE SERVICE22/tcp filtered sshNmap scan report for 209.236.30.216Host is up.PORT STATE SERVICE22/tcp filtered sshNmap done: 2 IP addresses (2 hosts up) scanned in 15.28 seconds[root@B ~]# |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
[root@B ~]# nmap --top-ports 5 10.0.1.161Starting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 13:58 CSTNmap scan report for 10.0.1.161Host is up (0.00074s latency).PORT STATE SERVICE21/tcp closed ftp22/tcp open ssh23/tcp closed telnet80/tcp closed http443/tcp closed httpsMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 0.40 seconds[root@B ~]# |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
|
[root@B ~]# nmap --port-ratio 0.1 10.0.1.161Starting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 13:59 CSTNmap scan report for 10.0.1.161Host is up (0.0011s latency).PORT STATE SERVICE21/tcp closed ftp22/tcp open ssh23/tcp closed telnet25/tcp closed smtp80/tcp closed http443/tcp closed httpsMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 0.35 seconds[root@B ~]# |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
|
[root@B ~]# nmap -sO 10.0.1.161Starting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 14:00 CSTStats: 0:04:10 elapsed; 0 hosts completed (1 up), 1 undergoing IPProto ScanIPProto Scan Timing: About 91.69% done; ETC: 14:05 (0:00:23 remaining)Nmap scan report for 10.0.1.161Host is up (0.00082s latency).Not shown: 249 closed protocolsPROTOCOL STATE SERVICE1 open icmp2 open|filtered igmp6 open tcp17 open udp47 open|filtered gre103 open|filtered pim136 open|filtered udpliteMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 289.19 seconds[root@B ~]# |
|
1
2
3
4
5
6
7
8
9
|
[root@A ~]# netstat -lntp --inet | grep -v 127.0.0.1Active Internet connections (only servers)Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:45654 0.0.0.0:* LISTEN 22257/nc tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2157/sshd tcp 0 0 0.0.0.0:13306 0.0.0.0:* LISTEN 21699/mysqld tcp 0 0 0.0.0.0:873 0.0.0.0:* LISTEN 2640/rsync tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 21505/rpcbind [root@A ~]# |
如下，对于一些端口号仍然没检测出
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
[root@B ~]# nmap 10.0.1.161 --allportsStarting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 14:07 CSTNmap scan report for 10.0.1.161Host is up (0.000098s latency).Not shown: 997 closed portsPORT STATE SERVICE22/tcp open ssh111/tcp open rpcbind873/tcp open rsyncMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 0.20 seconds[root@B ~]# |
其余很少使用的参数
|
1
2
3
4
|
-P0在扫描之前，不必ping主机。有些网络的防火墙不允许ICMPecho请求穿过，使用这个选项可以对这些网络进行扫描。microsoft.com就是一个例子，因此在扫描这个站点时，你应该一直使用-P0或者-PT80选项。-PT扫描之前，使用TCPping确定哪些主机正在运行。nmap不是通过发送ICMPecho请求包然后等待响应来实现这种功能，而是向目标网络(或者单一主机)发出TCPACK包然后等待回应。 |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
[root@B ~]# nmap -A www.baidu.comStarting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 14:10 CSTNmap scan report for www.baidu.com (115.239.210.27)Host is up (0.0046s latency).Other addresses for www.baidu.com (not scanned): 115.239.211.112Not shown: 998 filtered portsPORT STATE SERVICE VERSION80/tcp open http Apache httpd|_http-methods: No Allow or Public header in OPTIONS response (status code 302)| http-robots.txt: 8 disallowed entries|_/baidu /s? /ulink? /link? /shifen/ /homepage/ /cpro /|_http-title: \xE7\x99\xBE\xE5\xBA\xA6\xE4\xB8\x80\xE4\xB8\x8B\xEF\xBC\x8C\xE4\xBD\xA0\xE5\xB0\xB1\xE7\x9F\xA5\xE9\x81\x93|_http-favicon:443/tcp open ssl/https?|_http-title: 405 Not Allowed|_http-methods: No Allow or Public header in OPTIONS response (status code 405)1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :SF-Port443-TCP:V=5.51%T=SSL%I=7%D=12/29%Time=5864A904%P=x86_64-redhat-linuSF:x-gnu%r(RTSPRequest,1000,"<html>\r\n<head>\r\n<meta\x20http-equiv=\"conSF:tent-type\"\x20content=\"text/html;charset=utf-8\">\r\n<style\x20data-fSF:or=\"result\"\x20id=\"css_result\">\r\nbody{color:#333;background:#fff;SF:padding:6px\x200\x200;margin:0;position:relative;min-width:900px}body,tSF:h,td,\.p1,\.p2{font-family:arial}p,form,ol,ul,li,dl,dt,dd,h3{margin:0;pSF:adding:0;list-style:none}input{padding-top:0;padding-bottom:0;-moz-box-SF:sizing:border-box;-webkit-box-sizing:border-box;box-sizing:border-box}tSF:able,img{border:0}td{font-size:9pt;line-height:18px}\r\n\r\n\r\n\r\n#foSF:ot{font-size:12px}\.logo{width:117px;height:38px;cursor:pointer}\r\n\r\SF:n#u,#head,#tool,#search,\.p1{line-height:120%;margin-left:-12pt}\.p2{wiSF:dth:100%;line-height:120%;margin-left:-12pt}#wrapper{_zoom:1}#containerSF:{word-break:break-all;word-wrap:break-word}\.container_s{width:1002px}\SF:.container_l{width:1222px}#content_left{width:636px;float:left;padding-SF:left:35px}#content_right{border-left:1px\x20solid\x20#e1e1e1;f")%r(RPCCSF:heck,1000,"HTTP/1\.1\x20302\x20Moved\x20Temporarily\r\nServer:\x20bfe/1SF:\.0\.8\.18\r\nDate:\x20Thu,\x2029\x20Dec\x202016\x2006:11:16\x20GMT\r\nSF:Content-Type:\x20text/html\r\nContent-Length:\x2017931\r\nConnection:\xSF:20close\r\nETag:\x20\"54d9748e-460b\"\r\nSet-Cookie:\x20__bsi=168002475SF:26252574989_00_4_R_N_0_0303_C02F_N_I_I_0;\x20expires=Thu,\x2029-Dec-16\SF:x2006:11:21\x20GMT;\x20domain=www\.baidu\.com;\x20path=/\r\n\r\n<html>\SF:r\n<head>\r\n<meta\x20http-equiv=\"content-type\"\x20content=\"text/htmSF:l;charset=utf-8\">\r\n<style\x20data-for=\"result\"\x20id=\"css_result\SF:">\r\nbody{color:#333;background:#fff;padding:6px\x200\x200;margin:0;poSF:sition:relative;min-width:900px}body,th,td,\.p1,\.p2{font-family:arial}SF:p,form,ol,ul,li,dl,dt,dd,h3{margin:0;padding:0;list-style:none}input{paSF:dding-top:0;padding-bottom:0;-moz-box-sizing:border-box;-webkit-box-sizSF:ing:border-box;box-sizing:border-box}table,img{border:0}td{font-size:9pSF:t;line-height:18px}\r\n\r\n\r\n\r\n#foot{font-size:12px}\.logo{width:11SF:7px;height:38px;cursor:pointer}\r\n\r\n#u,#head,#tool,#");Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed portDevice type: switchRunning (JUST GUESSING): HP embedded (86%)Aggressive OS guesses: HP 4000M ProCurve switch (J4121A) (86%)No exact OS matches for host (test conditions non-ideal).Network Distance: 10 hopsTRACEROUTE (using port 443/tcp)HOP RTT ADDRESS1 ...2 2.75 ms 192.168.19.23 2.09 ms 192.168.0.14 ... 910 3.60 ms 115.239.210.27OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 30.58 seconds[root@B ~]# |
-e：指定网络接口,扫描时使用哪个网卡
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
[root@B ~]# nmap 10.0.1.161 -e eth0Starting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 14:25 CSTNmap scan report for 10.0.1.161Host is up (0.00020s latency).Not shown: 997 closed portsPORT STATE SERVICE22/tcp open ssh111/tcp open rpcbind873/tcp open rsyncMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 1.28 seconds[root@B ~]# |
-S：可以伪装源地址进行扫描。这样好处在于不会被对方发现自己的真实IP
接下来我们来验证一下
|
1
2
3
4
5
6
7
8
9
10
11
12
|
A机器添加一条规则，比如，拒绝源地址为10.0.1.162的任何访问请求[root@A ~]# iptables -I INPUT -s 10.0.1.162 -j DROP[root@A ~]# iptables -L -nChain INPUT (policy ACCEPT)target prot opt source destination DROP all -- 10.0.1.162 0.0.0.0/0 Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@A ~]# |
然后我们使用B机器伪装成10.0.1.167去扫描A机器，是可以扫描成功的
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
[root@B ~]# nmap -e eth0 10.0.1.161 -S 10.0.1.167 -PnStarting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 14:30 CSTNmap scan report for 10.0.1.161Host is up (0.0016s latency).Not shown: 997 closed portsPORT STATE SERVICE22/tcp open ssh111/tcp open rpcbind873/tcp open rsyncMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 0.47 seconds[root@B ~]# |
假如我们在A机器上禁止源地址为10.0.1.167的访问请求，那么B机器就应该无法扫描A的端口了。我们来验证下
A机器禁止源地址为10.0.1.167的机器访问
|
1
2
3
4
5
6
7
8
9
10
11
12
13
|
[root@A ~]# iptables -I INPUT -s 10.0.1.167 -j DROP[root@A ~]# iptables -L -nChain INPUT (policy ACCEPT)target prot opt source destination DROP all -- 10.0.1.167 0.0.0.0/0 DROP all -- 10.0.1.162 0.0.0.0/0 Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@A ~]# |
B机器伪装成10.0.1.167扫描A机器，扫描不到对方端口
|
1
2
3
4
5
6
7
8
9
10
|
[root@B ~]# nmap -e eth0 10.0.1.161 -S 10.0.1.167 -PnStarting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 14:33 CSTNmap scan report for 10.0.1.161Host is up (0.0012s latency).All 1000 scanned ports on 10.0.1.161 are filteredMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 22.95 seconds[root@B ~]# |
如果我们伪装成别的地址就应该能继续扫描到端口
我们伪装成了10.0.1.168，扫描成功
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
[root@B ~]# nmap -e eth0 10.0.1.161 -S 10.0.1.168 -PnStarting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 14:34 CSTNmap scan report for 10.0.1.161Host is up (0.00026s latency).Not shown: 997 closed portsPORT STATE SERVICE22/tcp open ssh111/tcp open rpcbind873/tcp open rsyncMAC Address: 00:0C:29:56:DE:46 (VMware)Nmap done: 1 IP address (1 host up) scanned in 0.50 seconds[root@B ~]# |
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
|
[root@B ~]# nmap -iflistStarting Nmap 5.51 ( http://nmap.org ) at 2016-12-29 14:37 CST************************INTERFACES************************DEV (SHORT) IP/MASK TYPE UP MTU MAClo (lo) 127.0.0.1/8 loopback up 65536eth0 (eth0) 10.0.1.162/24 ethernet up 1500 00:0C:29:11:64:A1**************************ROUTES**************************DST/MASK DEV GATEWAY10.0.1.0/24 eth0169.254.0.0/16 eth00.0.0.0/0 eth0 10.0.1.1[root@B ~]# route -nKernel IP routing tableDestination Gateway Genmask Flags Metric Ref Use Iface10.0.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0169.254.0.0 0.0.0.0 255.255.0.0 U 1002 0 0 eth00.0.0.0 10.0.1.1 0.0.0.0 UG 0 0 0 eth0[root@B ~]# |
nmap功能参数还有很多，个人觉得以上功能能应付工作中99%的需要了。没特殊必要，不用花太多时间在上面。
小结：
|
1
2
3
4
5
6
7
8
|
nmap工具很强大。建议先用Nmap扫描一个熟悉的系统，感觉一下Nmap的基本运行模式，熟悉之后，再将扫描范围扩大到其他系统。<br>首先扫描内部网络看看Nmap报告的结果，然后从一个外部IP地址扫描，注意防火墙、入侵检测系统（IDS）以及其他工具对扫描操作的反应。通常，TCP connect()会引起IDS系统的反应（默认的nmap扫描就是sT的方式，也就是3次握手的方式扫描）但IDS不一定会记录俗称“半连接”的TCP SYN扫描（-sS方式的）。如果你打算熟悉和使用Nmap，下面几点经验可能对你有帮助：1、 避免误解。不要随意选择测试Nmap的扫描目标。许多单位把端口扫描视为恶意行为，所以测试Nmap最好在内部网络进行。如有必要，应该告诉同事你正在试验端口扫描，因为扫描可能引发IDS警报以及其他网络问题。2、 关闭不必要的服务。根据Nmap提供的报告（同时考虑网络的安全要求），关闭不必要的服务，或者调整路由器的访问控制规则（ACL），禁用网络开放给外界的某些端口。3、 建立安全基准。在Nmap的帮助下加固网络、搞清楚哪些系统和服务可能受到攻击之后，下一步是从这些已知的系统和服务出发建立一个安全基准，以后如果要启用新的服务或者服务器，就可以方便地根据这个安全基准执行。 |
一些nmap相关的链接，有时间可以参照下，这两篇笔记总结的比较全了
http://www.91ri.org/4105.html
http://www.91ri.org/3870.html
http://blog.163.com/jianshitianxia_ao/blog/static/1765693842012731114821230/
https://nmap.org/download.html#windows
http://www.91ri.org/8516.html
http://blog.csdn.net/huangwwu11/article/details/20230795
http://blog.csdn.net/tan6600/article/details/45340511
原文：https://www.cnblogs.com/luwei0915/p/10601254.html