Nmap試驗(yàn)報(bào)告

1、網(wǎng)絡(luò)掃描軟件Nmap的應(yīng)用在網(wǎng)絡(luò)攻擊時(shí)，攻擊者往往會(huì)使用網(wǎng)絡(luò)和端口掃描軟件對(duì)目標(biāo)主機(jī)進(jìn)行掃描，發(fā)現(xiàn)漏洞，為后續(xù)攻擊 做準(zhǔn)備。本實(shí)驗(yàn)使用網(wǎng)絡(luò)掃描軟件Nma畫北郵官網(wǎng) IP地址：1 0.3. 9.2 5 4 進(jìn) 行多類型的主機(jī)和端口掃描并進(jìn)行分析。1.隱藏掃描(Stealth Scanning)-s S 為TCFW步掃描，原理是源主機(jī)發(fā)送一個(gè)TCFW步包SYN,然后等待目的主機(jī)的回應(yīng)。如 果對(duì)方返回SYN AC血，就表示該目標(biāo)端口翻開。WiresharkM包可以看出4610.3.7122410J.9JM TCP址即E0制5炯 蒂1驚LerH醇1地M1M.TUN TCP60 臥 5W

2、3 鏘虹 1 洶MHMileH 嶼 5=1 撕mwnsi10170.224在掃描過程中，源主機(jī)(10 .8 . 7 0.224 )向目標(biāo)主機(jī)(10 . 3 .9 .254 )最可能打開的 1 0 0 0 個(gè)端口發(fā)送了TCFW步包，其中只有 8 0 端口和 3 3 0 6端口返回了SYN AC血，說明 目標(biāo)主機(jī)開放了這兩個(gè)端口。從Nmapfi描結(jié)果可以看出 8 0端口提供的是效勞，3 3 0 6提供的 是mysq效勞。2.端口掃描(port scanning)1U/0J4返延時(shí)變量很大，應(yīng)該網(wǎng)絡(luò)擁塞引起的。從wireshark抓包看出刑軍 岫貝刷 娜 做 鮑帽0m誡劉障 0桐機(jī)血M知胴 咐54丸

3、 5M0 tt刪破浦湄 LtHM JJM 誡加闕他 1VH L4-s T 掃描是調(diào)用系統(tǒng)函數(shù)connect用來翻開一個(gè)鏈接，所以耗時(shí)要比一 s S要多RTTVA R往ML 訥V10.OJ24 W1心朋的陽 協(xié)IfillN D皿心 KF源主機(jī)與目的主機(jī)之間建立了完全的TCF接，探測(cè)到端口開放后立即發(fā)送RS幅開鏈接3.UDF6描(UDP ScanningUDFfi描是向目標(biāo)主機(jī)的每個(gè)端口發(fā)送一個(gè)0字節(jié)的UDFfe,如果收到端口不可到達(dá)的ICMP肖息，端 口就是關(guān)閉的。如wireshark抓包所示user Datagram Protocol, src Port: 35793 C35793), Dst

4、 Port: 1031 1031) Source Port: 35793 (35793) Destination Port: 1031(1031) Length： 8源主機(jī)向目標(biāo)機(jī)的1031端口發(fā)送了一個(gè)0字節(jié)的UD咆折馳101。.8UDP42 source port: 35?93 Destination port: 1031|168 36JZ75130103J.2Mi帥70 Destination uirechable(POTTunreachable) |端口1031收到了ICMP肖息，說明端口是關(guān)閉的60 260J03467 10.8J0.22410.L9.2MNTP90NTPVersio

5、n 4, client661 260.67718610. L9J5410.8JO. 224NT?90 NTP Version 4, serverUser Dataran Protocol, rc Port: 35757 (35787)(Dst Port: 123 (123) Source Port: 35787 (35787) Destinarion port: 123 (123)Length: 56端口123開啟的是ntp效勞。值得注意的是，此時(shí)發(fā)送的并不是0字節(jié)的UDFfe,而是內(nèi)容為ntp的總長為224bit的UD咆。4.Ping掃描(Ping SweepingM*E-Sp，以,Stil

6、ting Nnap 6+4? (:/nffl3p,org ) at中國布春升間，加淳p scan ppbt for 10+S . 64 1由等t is up 934 latency)AC54 ; 39:0f ; CE : E9: 1 (Hua*ci IcchnclDEies Co,)曲“5C0n rcpo-t Far 65*123Host is up (1. Is latency)WC Address : C8:f&：B：7C ： M: 4 (Apple)F*ii#p scon report for 10+865.2WHost is up(研32s lateicy),KAC Mdyss

7、t AB;/:明：酷;E:就(Irrtel CorpornteMnnap scan report for ie.3,67.22OHost is up(吼latency)HAC Address:_LBI:CF；EA (Arris Srouu)伽$can report for日*8*58.54Hoirt If up (e. L6& iat*ocyH4C Address: 5C;f9：3S：19：9B:11 (Apple)MTAP SCAHreport for 10+8.68.64Host is up (14s latencyl,FWC Adgress! Wj7ft：BS OD:26:C4

8、Huawei lechrwlogie Co*)Mniap scan report for 10.S.T1.194Ho*t 11 up (0.G44s latency).MAC ESS: M:巽：90!93:JB:99 ( Liteon lecnnolog/伽卬can report手時(shí)手時(shí)ie.S72146Ho%t is up (G.16 latency)-陽打，；芯：2日一？P : EM : ?8 : E8 (0BIC Conmunitcit Technoloey Co、)F4TAPC3H report *cr 10,/74.135Host 11 up ft.13s latency),AUC

9、fiddresi: F4Ft.5A；&:9E:E1 (Apple)Sp scan report for 10,8,74.151Host is up (9.Latency)mF)pHostsNmap Obtpul Ports / Hosts Topology Host DetaikSEAM05 * Host詢問IP地址上的主機(jī)是否活動(dòng)的，如果收到ARP回復(fù)包，那么說明該主機(jī)在線所示36 TH. S1426tK:M: 7d:00： a7; taeroidcascMP42 Mho h踮L0.&64.4*2437 衣 L5144 邳上 5：F：?！埃?6rodc(AA

10、P42 whohas10PB. 64.5Tell10*& 7Q.ZZ43S 皿-5147 舞 H；b5：r 土 oo#：aaSrqadlcilsCWP42 WtiQhasTell10Pa,70.254押 Z31, 4916ac:b5:7d:00:a7：SaBroadcascARP42 Mno h*s10,8.64.7?El10,70,22440 231.515J61 it:b5:7(1:00a7:ftaBroadcast4RP42 Who has10.B64BS?Tell10-8-70.22441 211. H55 53JCJb5L7di00: d7: SaBroddcjst4RP42

11、 who has10. B. 64.9?Ten10.8B70,22442 211. 5157?* acjbSLZdiOO: i7:tiBroi dlcastaAP42 who has1(LB 64 1Wnil10.2Z4秘 1 - 515980 ac：h5： -d：OCJA7：BAerodciscAftP4 2 *tXhu10.B.64 11Ter10.B.70.ZZ444 231. $12Q5Hl5H7d；OO；ft7:BroadciisCARP42 Who h 心 2?TE110. . 70224d5 2 Ji- 519462 ic：b5： d:00：SroadcastA

12、JRP42 Whohas10,8,64-15T11 10, 8 . 70-.224211. 519A1S it: b5: ZdTOOi V: AdBroadcastARP42 who has6?TEl 10. 8. 70. 22447 231. 616021 4L：bS:7diOO:i7:AjEr oadcjst.MP42 who h 心 ?TEH244t 2il. 7O51B7 ic：b|;7d:OO：i7：UBraidlcast42 whoi has10. 8. 64 5?Tail10.B.70.224. 70667 5A7：BiBro

13、il de as caap4 2 who h*$ 10.8. 64.67Tll10+8.70.2245Q 1 706器 3=;15;7 小 00 淖 7;心BrgadtuCAfl；P4 2 who has108BC47?Tell10.8/70.2245,捉 L 7Qn?6 M：b5：Fdr。：；隊(duì)BroadcastMP42 Who has10,8.64.8?Tell10,8.70,22452 2ilr71DOOa dc:b5; .*d;00;a?:#aBroadcastARP42 who hasitn10, B. 70.224S3 211. 71022 lC:bS：7d:Oaji71UBroa

14、dcast.AAP42 who ha 10.B.64.10?Tell 10. fl. 70.224源主機(jī)播送所掃描網(wǎng)段的ARP求，沒有回復(fù)的主機(jī)均視為沒有在線34 23L51O?Mac:M:7d:(:a7:8a BroadcastARP42枷has Tell 10370.22435 HL513980樁d:00:8a ARP 60 10.8,64.1 is at:39:tf:ce:e9:al回復(fù)了ARP肯求，說明在線5.TCP ACK描wireshark抓包TCP AC們描是向目標(biāo)機(jī)的端口發(fā)送AC也，如果返回一個(gè)RS也，那么這個(gè)端口就視為unfiltered狀

15、態(tài)如wireshark抓包所示滿&934841001。優(yōu)知22410J.9.2M TCP S4 5S15MOACKseq-l Ack=l頃41024 LeH560 6.?XX)10J.9JM l(Um2K TCP的外泯56 RST網(wǎng)=1 WiH Len=0如9 0端口收到了RETfe，說明這個(gè)端口處丁unfiltered狀態(tài)6.操作系統(tǒng)類型掃描的Ew.bid pLedu cn 10uSuiS iH&st StatusStaEe:Opfl pgrts：AhiS grt玳MP2QuClcwd po*tu98Sc.nnK prU：1W0ILjp GeuNE Avail ableLj或松*匕Not Avail ableIPv4 10J.S2MUMfc wail abiwMAONLC4打1罩HEH&ltRAmefNanw - T*p； wwwJbv pt*duxn - uterQperfeting SyltefnNirwrActwracy必Ffirtt wMdOS CltuMType Vend#WAP AVMCommEritfiAVM FRITZlfiox FON WIAN