Ah Nmap qui ne le connait pas ? Le scanner de port qui passe dans pleins de films : Matrix Reloaded, Bourne Ultimatum, Die Hard 4 et pleins d’autres. Plus d’informations ici.
Plus sérieusement, Nmap permet en plus de scanner des ports, d’identifier les services hébergés ainsi que le système d’exploitation distant.
Voici quelques commandes, cette liste est bien sûre non exhaustive, je me permettrai de rajouter les commandes qui peuvent m’être utile par la suite !
Un scan nmap « basique » :
# nmap 192.168.1.1 Starting Nmap 6.01 ( http://nmap.org ) at 2012-09-12 20:07 CEST Nmap scan report for 192.168.1.1 Host is up (0.00040s latency). Not shown: 989 filtered ports PORT STATE SERVICE 21/tcp open ftp 80/tcp open http 139/tcp open netbios-ssn 445/tcp open microsoft-ds 548/tcp closed afp 554/tcp open rtsp 5000/tcp open upnp 5001/tcp closed commplex-link 5678/tcp open rrac 8090/tcp open unknown 9091/tcp open xmltec-xmlmail MAC Address: 13:37:13:37:13:37 (La box de mon FAI) Nmap done: 1 IP address (1 host up) scanned in 4.77 seconds |
Utiliser le TCP Scan connu sous le nom de Scan SYN. Le paquet SYN est le premier envoyé lors d’une connexion TCP, le TCP handshake sera réinitialisé si le port est détecté comme ouvert.
# nmap -sS 192.168.1.1 Starting Nmap 6.01 ( http://nmap.org ) at 2012-09-12 20:07 CEST Nmap scan report for 192.168.1.1 Host is up (0.00037s latency). Not shown: 989 filtered ports PORT STATE SERVICE 21/tcp open ftp 80/tcp open http 139/tcp open netbios-ssn 445/tcp open microsoft-ds 548/tcp closed afp 554/tcp open rtsp 5000/tcp open upnp 5001/tcp closed commplex-link 5678/tcp open rrac 8090/tcp open unknown 9091/tcp open xmltec-xmlmail MAC Address: 13:37:13:37:13:37 (La box de mon FAI) Nmap done: 1 IP address (1 host up) scanned in 5.06 seconds |
Et pour voir les ports UDP ouvert :
# nmap -sU 192.168.1.1 Starting Nmap 6.01 ( http://nmap.org ) at 2012-09-12 20:20 CEST Nmap scan report for 192.168.1.17 Nmap scan report for 192.168.1.1 Host is up (0.00035s latency). Not shown: 993 closed ports PORT STATE SERVICE 53/udp open domain 67/udp open|filtered dhcps 123/udp open ntp 137/udp open netbios-ns 138/udp open|filtered netbios-dgm 1900/udp open|filtered upnp 5353/udp open zeroconf MAC Address: 13:37:13:37:13:37 (La box de mon FAI) Nmap done: 1 IP address (1 host up) scanned in 1087.27 seconds |
Scan de port
Scanner un port bien précis :
nmap -p 1337 192.168.1.1 Starting Nmap 6.01 ( http://nmap.org ) at 2012-09-12 20:20 CEST Nmap scan report for 192.168.1.1 Host is up (0.00024s latency). PORT STATE SERVICE 1337/tcp filtered waste MAC Address: 13:37:13:37:13:37 (La box de mon FAI) Nmap done: 1 IP address (1 host up) scanned in 0.08 seconds |
Lorsque l’on souhaite scanner des plages avec nmap, (plages de ports) :
# nmap -p 1337-7331,80 192.168.1.1 Starting Nmap 6.01 ( http://nmap.org ) at 2012-09-12 20:21 CEST Nmap scan report for 192.168.1.1 Host is up (0.00029s latency). Not shown: 5991 filtered ports PORT STATE SERVICE 80/tcp open http 5000/tcp open upnp 5001/tcp closed commplex-link 5678/tcp open rrac 6600/tcp closed mshvlm MAC Address: 13:37:13:37:13:37 (La box de mon FAI) Nmap done: 1 IP address (1 host up) scanned in 17.94 seconds |
Ici on scanne la rangée de port suivante : 1337 à 7331
Ainsi que le port 80.
Avant on faisait un scan de ping ( -sP ), dans les nouvelles versions de nmap c’est « No port scan » soit -sn.
Quand on fait cette commande avec les droits root, on scanne : ‘ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default’
Quand on fait cette commande avec les droits utilisateurs : seulement le paquet SYN est envoyé pour le port 80 et 443
No port scan :
# nmap -sn 192.168.1.1 Starting Nmap 6.01 ( http://nmap.org ) at 2012-09-12 20:54 CEST Nmap scan report for 192.168.1.1 Host is up (0.00027s latency). MAC Address: 13:37:13:37:13:37 (La box de mon FAI) Nmap done: 1 IP address (1 host up) scanned in 0.21 seconds |
Scan système d’exploitation
Découvrir le système d’exploitation de la machine distance :
nmap -O 192.168.1.1 Starting Nmap 6.01 ( http://nmap.org ) at 2012-09-12 20:21 CEST Nmap scan report for 192.168.1.1 Host is up (0.00030s latency). Not shown: 989 filtered ports PORT STATE SERVICE 21/tcp open ftp 80/tcp open http 139/tcp open netbios-ssn 445/tcp open microsoft-ds 548/tcp closed afp 554/tcp open rtsp 5000/tcp open upnp 5001/tcp closed commplex-link 5678/tcp open rrac 8090/tcp open unknown 9091/tcp open xmltec-xmlmail MAC Address: 13:37:13:37:13:37 (La box de mon FAI) Device type: general purpose Running: Linux 2.6.X|3.X OS CPE: cpe:/o:linux:kernel:2.6 cpe:/o:linux:kernel:3 OS details: Linux 2.6.38 - 3.2 Network Distance: 1 hop OS detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.91 seconds |
Si celui-ci n’arrive pas à affiner les recherches, il fait une recherche agressive :
# nmap -O --osscan-guess 192.168.1.1 Starting Nmap 6.01 ( http://nmap.org ) at 2012-09-12 20:22 CEST Nmap scan report for 192.168.1.1 Host is up (0.00028s latency). Not shown: 989 filtered ports PORT STATE SERVICE 21/tcp open ftp 80/tcp open http 139/tcp open netbios-ssn 445/tcp open microsoft-ds 548/tcp closed afp 554/tcp open rtsp 5000/tcp open upnp 5001/tcp closed commplex-link 5678/tcp open rrac 8090/tcp open unknown 9091/tcp open xmltec-xmlmail MAC Address: 13:37:13:37:13:37 (La box de mon FAI) Device type: general purpose Running: Linux 2.6.X|3.X OS CPE: cpe:/o:linux:kernel:2.6 cpe:/o:linux:kernel:3 OS details: Linux 2.6.38 - 3.2 Network Distance: 1 hop OS detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 6.74 seconds |
Scan exhaustif
Le scan typique de NMAP, qui comprend le scan des ports, le traceroute la détection d’OS et sa version. Et le T4 signifie que le scan doit être plus rapide
# nmap -A -T4 192.168.1.1 Starting Nmap 6.01 ( http://nmap.org ) at 2012-09-12 20:23 CEST Nmap scan report for 192.168.1.1 Host is up (0.00031s latency). Not shown: 989 filtered ports PORT STATE SERVICE VERSION 21/tcp open ftp box ftpd 80/tcp open http nginx |_http-methods: No Allow or Public header in OPTIONS response (status code 405) | http-robots.txt: 1 disallowed entry |_/ |_http-title: Accueil box Server 139/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) 445/tcp open netbios-ssn Samba smbd 3.X (workgroup: WORKGROUP) 548/tcp closed afp 554/tcp open rtsp box rtspd 1.2 | rtsp-methods: |_ DESCRIBE, OPTIONS, SETUP, TEARDOWN, PLAY, PAUSE 5000/tcp open rtsp RogueAmoeba Airfoil rtspd 110.63 | rtsp-methods: |_ ANNOUNCE, SETUP, RECORD, PAUSE, FLUSH, TEARDOWN, OPTIONS, GET_PARAMETER, SET_PARAMETER, POST, GET 5001/tcp closed commplex-link 5678/tcp open upnp fbxigdd 1.0 (AliceBox PM203 UPnP; UPnP 1.0) 8090/tcp open hadoop-jobtracker Apache Hadoop |_http-methods: No Allow or Public header in OPTIONS response (status code 302) |_http-title: Probl\xC3\xA8me de connexion Internet 9091/tcp open http nginx |_http-methods: No Allow or Public header in OPTIONS response (status code 405) |_http-title: 403 Forbidden MAC Address: 13:37:13:37:13:37 (La box de mon FAI) Device type: general purpose Running: Linux 2.6.X|3.X OS CPE: cpe:/o:linux:kernel:2.6 cpe:/o:linux:kernel:3 OS details: Linux 2.6.38 - 3.2 Network Distance: 1 hop Service Info: OSs: Mac OS X, Linux 2.6; Devices: media device, WAP; CPE: cpe:/o:apple:mac_os_x, cpe:/o:linux:kernel:2.6 Host script results: | smb-security-mode: | Account that was used for smb scripts: guest | User-level authentication | SMB Security: Challenge/response passwords supported |_ Message signing disabled (dangerous, but default) |_nbstat: NetBIOS name: box, NetBIOS user: , NetBIOS MAC: |_smbv2-enabled: Server doesn't support SMBv2 protocol | smb-os-discovery: | OS: Unix (Samba 3.0.37) | NetBIOS computer name: | Workgroup: WORKGROUP |_ System time: 2012-09-12 20:23:42 UTC+0 TRACEROUTE HOP RTT ADDRESS 1 0.31 ms 192.168.1.1 OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 23.24 seconds |
Nmap bonus
Scanner toujours la meme machine mais on spoof notre adresse mac.
nmap --spoof-mac Apple 192.168.1.1 |
Starting Nmap 6.01 ( http://nmap.org ) at 2012-09-12 20:24 CEST
Spoofing MAC address 00:03:93:4B:A8:C4 (Apple Computer)
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 0.48 seconds
Sauvegarder les résultats dans un fichier :
XML :
nmap -oX output.xml 192.168.1.1 |
Standard :
nmap -oN output 192.168.1.1 |
Ce qui peut aussi être intéressant est Nmap Scripting Engine (NSE) : Le but du NSE est de fournir à Nmap une infrastructure flexible afin d’étendre ses capacités et ainsi offrir à ses utilisateurs une façon simple de créer ses propres tests personnalisés. Plus d’informations ici.
Scan avec les scripts par défaut :
# nmap -sC 192.168.1.254 Starting Nmap 6.01 ( http://nmap.org ) at 2012-09-12 21:26 CEST Nmap scan report for 192.168.1.254 Host is up (0.00035s latency). Not shown: 989 filtered ports PORT STATE SERVICE 21/tcp open ftp 80/tcp open http | http-robots.txt: 1 disallowed entry |_/ |_http-methods: No Allow or Public header in OPTIONS response (status code 405) |_http-title: Accueil box Server 139/tcp open netbios-ssn 445/tcp open microsoft-ds 548/tcp closed afp 554/tcp open rtsp | rtsp-methods: |_ DESCRIBE, OPTIONS, SETUP, TEARDOWN, PLAY, PAUSE 5000/tcp open upnp 5001/tcp closed commplex-link 5678/tcp open rrac 8090/tcp open unknown 9091/tcp open xmltec-xmlmail MAC Address: 13:37:13:37:13:37 (La box de mon FAI) Host script results: |_nbstat: NetBIOS name: box, NetBIOS user: , NetBIOS MAC: | smb-security-mode: | Account that was used for smb scripts: guest | User-level authentication | SMB Security: Challenge/response passwords supported |_ Message signing disabled (dangerous, but default) |_smbv2-enabled: Server doesn't support SMBv2 protocol | smb-os-discovery: | OS: Unix (Samba 3.0.37) | NetBIOS computer name: | Workgroup: WORKGROUP |_ System time: 2012-09-12 21:26:55 UTC+0 Nmap done: 1 IP address (1 host up) scanned in 12.44 seconds |
Et en plus de NSE, contourner un pare-feu avec nmap : http://nmap.org/man/fr/man-bypass-firewalls-ids.html
Source :
Le site officiel : http://nmap.org/
Le man de nmap : http://nmap.org/man/fr/
It’s oversimple isn’t it?
Excellent !
Je regarde quelques outils du genre en ce moment, et je venais de tester nmap. Voici qui me donne un peu plus d’information, et en français :p !