python-nmap使用及案例
python-nmap使用及案例
nmap概念及功能
概念
NMap,也就是Network Mapper,最早是Linux下的網路掃描和嗅探工具包。
nmap是一個網路連線端掃描軟體,用來掃描網上電腦開放的網路連線端。確定哪些服務執行在哪些連線端,並且推斷計算機執行哪個作業系統(這是亦稱 fingerprinting)。它是網路管理員必用的軟體之一,以及用以評估網路系統安全。
正如大多數被用於網路安全的工具,nmap 也是不少黑客及駭客(又稱指令碼小子)愛用的工具 。系統管理員可以利用nmap來探測工作環境中未經批准使用的伺服器,但是黑客會利用nmap來蒐集目標電腦的網路設定,從而計劃攻擊的方法。
Nmap 常被跟評估系統漏洞軟體Nessus混為一談。Nmap 以隱祕的手法,避開闖入檢測系統的監視,並儘可能不影響目標系統的日常操作。
Nmap 在黑客帝國(The Matrix)中,連同SSH1的32位元迴圈冗餘校驗漏洞,被崔妮蒂用以入侵發電站的能源管理系統。
功能
基本功能有三個,一是探測一組主機是否線上;其次是掃描 主機埠,嗅探所提供的網路服務;還可以推斷主機所用的作業系統 。Nmap可用於掃描僅有兩個節點的LAN,直至500個節點以上的網路。Nmap 還允許使用者定製掃描技巧。通常,一個簡單的使用ICMP協議的ping操作可以滿足一般需求;也可以深入探測UDP或者TCP埠,直至主機所 使用的作業系統;還可以將所有探測結果記錄到各種格式的日誌中, 供進一步分析操作。
進行ping掃描,打印出對掃描做出響應的主機,不做進一步測試(如埠掃描或者作業系統探測):
nmap -sP 192.168.1.0/24
僅列出指定網路上的每臺主機,不傳送任何報文到目標主機:
nmap -sL 192.168.1.0/24
探測目標主機開放的埠,可以指定一個以逗號分隔的埠列表(如-PS22,23,25,80):
nmap -PS 192.168.1.234
使用UDP ping探測主機:
nmap -PU 192.168.1.0/24
使用頻率最高的掃描選項:SYN掃描,又稱為半開放掃描,它不開啟一個完全的TCP連線,執行得很快:
nmap -sS 192.168.1.0/24
nmap安裝
本文以linux Ubuntu16.04為例,最後主要用python操作
1. 先安裝nmap
sudo apt-get install nmap
2.再安裝python-nmap
sudo pip install python-nmap
安裝完之後python匯入nmap測試驗證是否成功
root@LiDebin:~# python Python 2.7.12 (default, Jul 1 2016, 15:12:24) [GCC 5.4.0 20160609] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import nmap
python操作nmap
1.簡單的小案例
建立PortScanner例項,然後掃描159.239.210.26這個IP的20-443埠。
import nmap nm = nmap.PortScanner() ret = nm.scan('115.239.210.26','20') print ret 返回格式如下: {'nmap': {'scanstats': {'uphosts': '1', 'timestr': 'Tue Oct 25 11:30:47 2016', 'downhosts': '0', 'totalhosts': '1', 'elapsed': '1.11'}, 'scaninfo': {'tcp': {'services': '20', 'method': 'connect'}}, 'command_line': 'nmap -oX - -p 20 -sV 115.239.210.26'}, 'scan': {'115.239.210.26': {'status': {'state': 'up', 'reason': 'syn-ack'}, 'hostnames': [{'type': '', 'name': ''}], 'vendor': {}, 'addresses': {'ipv4': '115.239.210.26'}, 'tcp': {20: {'product': '', 'state': 'filtered', 'version': '', 'name': 'ftp-data', 'conf': '3', 'extrainfo': '',
'reason': 'no-response', 'cpe': ''} } } } }
2.內建方法:
還可以打印出簡單的資訊
import nmap nm = nmap.PortScanner() print nm.scaninfo() # {u'tcp': {'services': u'20-443', 'method': u'syn'}} print nm.command_line() # u'nmap -oX - -p 20-443 -sV 115.239.210.26'
檢視有多少個host
print nm.all_hosts() # [u'115.239.210.26']
檢視該host的詳細資訊
nm['115.239.210.26']
檢視該host包含的所有協議
nm['115.239.210.26'].all_protocols()
檢視該host的哪些埠提供了tcp協議
nm['115.239.210.26']['tcp'] nm['115.239.210.26']['tcp'].keys()
檢視該埠是否提供了tcp協議
nm['115.239.210.26'].has_tcp(21)
還可以像這樣設定nmap執行的引數
nm.scan(hosts='192.168.1.0/24', arguments='-n -sP -PE -PA21,23,80,3389')
更多操作請進官網http://xael.org/pages/python-nmap-en.html
實驗案例
檢測內網機器埠
1.定義函式庫mytools.py
#-*- coding:utf-8 -*- import smtplib from email.mime.text import MIMEText from email.header import Header def sendemail(sender,receiver,subject,content,smtpserver,smtpuser,smtppass): msg = MIMEText(content,'html','utf-8')#中文需引數‘utf-8',單位元組字元不需要 msg['Subject'] = Header(subject, 'utf-8') msg['From'] = '<%s>' % sender msg['To'] = ";".join(receiver) try: smtp = smtplib.SMTP() smtp.connect(smtpserver) smtp.login(smtpuser, smtppass) smtp.sendmail(sender, receiver, msg.as_string()) smtp.quit() except Exception,e: print e
2.實現埠掃描的程式,單執行緒版本nmscan.py
# !/usr/bin/python # -*- coding:utf-8 -*- import nmap import re import mytools as tool import sys reload(sys) sys.setdefaultencoding('utf8') def nmScan(hostlist, portrange, whitelist): p = re.compile("^(\d*)\-(\d*)$") if type(hostlist) != list: help() portmatch = re.match(p, portrange) if not portmatch: help() l = [] for host in hostlist: result = '' nm = nmap.PortScanner() tmp = nm.scan(host, portrange) result = result + "<h2>ip地址:%s 主機名:[%s] ...... %s</h2><hr>" % ( host, tmp['scan'][host]['hostname'], tmp['scan'][host]['status']['state']) try: ports = tmp['scan'][host]['tcp'].keys() except KeyError, e: if whitelist: whitestr = ','.join(whitelist) result = result + "未掃到開放埠!請檢查%s埠對應的服務狀態" % whitestr else: result = result + "掃描結果正常,無暴漏埠" for port in ports: info = '' if port not in whitelist: info = '<strong><font color=red>Alert:非預期埠</font><strong> ' else: info = '<strong><font color=green>Info:正常開放埠</font><strong> ' portinfo = "%s <strong>port</strong> : %s <strong>state</strong> : %s <strong>product<strong/> : %s <br>" % ( info, port, tmp['scan'][host]['tcp'][port]['state'], tmp['scan'][host]['tcp'][port]['product']) result = result + portinfo l.append([host, str(result)]) return l def help(): print "Usage: nmScan(['127.0.0.1',],'0-65535')" if __name__ == "__main__": hostlist = ['10.10.10.10', '10.10.10.11'] portrange = '0-65535' whitelist = [80, 443] l = nmScan(hostlist, portrange, whitelist) sender = '[email protected]' receiver = ['[email protected]', '[email protected]'] subject = '伺服器埠掃描' smtpserver = 'smtp.exmail.qq.com' smtpuser = '[email protected]' smtppass = 'linuxidc163' mailcontent = '' for i in range(len(l)): mailcontent = mailcontent + l[i][1] tool.sendemail(sender, receiver, subject, mailcontent, smtpserver, smtpuser, smtppass)
3.多執行緒版本
# !/usr/bin/python # -*- coding:utf-8 -*- import nmap import re import mytools as tool import sys from multiprocessing import Pool from functools import partial reload(sys) sys.setdefaultencoding('utf8') def nmScan(host, portrange, whitelist): p = re.compile("^(\d*)\-(\d*)$") # if type(hostlist) != list: # help() portmatch = re.match(p, portrange) if not portmatch: help() if host == '121.42.32.172': whitelist = [25, ] result = '' nm = nmap.PortScanner() tmp = nm.scan(host, portrange) result = result + "<h2>ip地址:%s 主機名:[%s] ...... %s</h2><hr>" % ( host, tmp['scan'][host]['hostname'], tmp['scan'][host]['status']['state']) try: ports = tmp['scan'][host]['tcp'].keys() for port in ports: info = '' if port not in whitelist: info = '<strong><font color=red>Alert:非預期埠</font><strong> ' else: info = '<strong><font color=green>Info:正常開放埠</font><strong> ' portinfo = "%s <strong>port</strong> : %s <strong>state</strong> : %s <strong>product<strong/> : %s <br>" % ( info, port, tmp['scan'][host]['tcp'][port]['state'], tmp['scan'][host]['tcp'][port]['product']) result = result + portinfo except KeyError, e: if whitelist: whitestr = ','.join(whitelist) result = result + "未掃到開放埠!請檢查%s埠對應的服務狀態" % whitestr else: result = result + "掃描結果正常,無暴漏埠" return result def help(): print "Usage: nmScan(['127.0.0.1',],'0-65535')" return None if __name__ == "__main__": hostlist = ['10.10.10.10', '10.10.10.11'] portrange = '0-65535' whitelist = [80, 443] l = nmScan(hostlist, portrange, whitelist) sender = '[email protected]' receiver = ['[email protected]', '[email protected]'] subject = '伺服器埠掃描' smtpserver = 'smtp.exmail.qq.com' smtpuser = '[email protected]' smtppass = 'linuxidc163' mailcontent = '' for i in range(len(l)): mailcontent = mailcontent + l[i][1] tool.sendemail(sender, receiver, subject, mailcontent, smtpserver, smtpuser, smtppass)