Nmap

"Vedete anche Trinity di Matrix usa Nmap"

Nmap è un tools inserito in BT, che permette di effettuare scansioni di reti per controllare la sicurezza della propria rete. Molti amministratori di rete trovano utile nmap per compiti come l'inventario della rete, la gestione dei programmi di aggiornamento del servizio, e il monitoraggio di accoglienza o di uptime del servizio. Nmap utilizza dei semplici pacchetti IP per determinare quali host sono disponibili sulla rete, quali servizi (nome di applicazione e versione) questi host offrono, quali i sistemi operativi (e versioni del sistema operativo) sono in esecuzione, che tipo di filtri di pacchetti / firewall sono in uso, e decine di altre caratteristiche. È stato progettato per velocizzare la scansione di reti di grandi dimensioni, ma funziona bene anche contro singoli host (Linux, Windows, e Mac OS X. Nmap viene eseguito su tutti i principali sistemi operativi per computer, i pacchetti ufficiali sono disponibili per Linux, Windows e Mac OS X. Vi elenco alcuni comandi di nmap utili per effettuare una scansione di rete, comunque vi consiglio di leggervi le guide online su http://nmap.org/. Avviate nmap da shell e date i seguenti comandi:

morfes@morfes:~$ nmap --help
Nmap 5.00 ( http://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
Can pass hostnames, IP addresses, networks, etc.
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iL : Input from list of hosts/networks
-iR : Choose random targets
--exclude : Exclude hosts/networks
--excludefile : Exclude list from file
HOST DISCOVERY:
-sL: List Scan - simply list targets to scan
-sP: Ping Scan - go no further than determining if host is online
-PN: Treat all hosts as online -- skip host discovery
-PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
-PO[protocol list]: IP Protocol Ping
-n/-R: Never do DNS resolution/Always resolve [default: sometimes]
--dns-servers : Specify custom DNS servers
--system-dns: Use OS's DNS resolver
--traceroute: Trace hop path to each host
SCAN TECHNIQUES:
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sU: UDP Scan
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags : Customize TCP scan flags
-sI : Idle scan
-sY/sZ: SCTP INIT/COOKIE-ECHO scans
-sO: IP protocol scan
-b : FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
-p : Only scan specified ports
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080
-F: Fast mode - Scan fewer ports than the default scan
-r: Scan ports consecutively - don't randomize
--top-ports : Scan  most common ports
--port-ratio : Scan ports more common than 
SERVICE/VERSION DETECTION:
-sV: Probe open ports to determine service/version info
--version-intensity : Set from 0 (light) to 9 (try all probes)
--version-light: Limit to most likely probes (intensity 2)
--version-all: Try every single probe (intensity 9)
--version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
-sC: equivalent to --script=default
--script=:  is a comma separated list of
directories, script-files or script-categories
--script-args=: provide arguments to scripts
--script-trace: Show all data sent and received
--script-updatedb: Update the script database.
OS DETECTION:
-O: Enable OS detection
--osscan-limit: Limit OS detection to promising targets
--osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
Options which take  are in milliseconds, unless you append 's'
(seconds), 'm' (minutes), or 'h' (hours) to the value (e.g. 30m).
-T<0-5>: Set timing template (higher is faster)
--min-hostgroup/max-hostgroup : Parallel host scan group sizes
--min-parallelism/max-parallelism : Probe parallelization
--min-rtt-timeout/max-rtt-timeout/initial-rtt-timeout : Specifies
probe round trip time.
--max-retries : Caps number of port scan probe retransmissions.
--host-timeout : Give up on target after this long
--scan-delay/--max-scan-delay : Adjust delay between probes
--min-rate : Send packets no slower than  per second
--max-rate : Send packets no faster than  per second
FIREWALL/IDS EVASION AND SPOOFING:
-f; --mtu : fragment packets (optionally w/given MTU)
-D : Cloak a scan with decoys
-S : Spoof source address
-e : Use specified interface
-g/--source-port : Use given port number
--data-length : Append random data to sent packets
--ip-options : Send packets with specified ip options
--ttl : Set IP time-to-live field
--spoof-mac : Spoof your MAC address
--badsum: Send packets with a bogus TCP/UDP/SCTP checksum
--adler32: Use deprecated Adler32 instead of CRC32C for SCTP checksums
OUTPUT:
-oN/-oX/-oS/-oG : Output scan in normal, XML, s|: Output in the three major formats at once
-v: Increase verbosity level (use twice or more for greater effect)
-d[level]: Set or increase debugging level (Up to 9 is meaningful)
--reason: Display the reason a port is in a particular state
--open: Only show open (or possibly open) ports
--packet-trace: Show all packets sent and received
--iflist: Print host interfaces and routes (for debugging)
--log-errors: Log errors/warnings to the normal-format output file
--append-output: Append to rather than clobber specified output files
--resume : Resume an aborted scan
--stylesheet : XSL stylesheet to transform XML output to HTML
--webxml: Reference stylesheet from Nmap.Org for more portable XML
--no-stylesheet: Prevent associating of XSL stylesheet w/XML output
MISC:
-6: Enable IPv6 scanning
-A: Enables OS detection and Version detection, Script scanning and Traceroute
--datadir : Specify custom Nmap data file location
--send-eth/--send-ip: Send using raw ethernet frames or IP packets
--privileged: Assume that the user is fully privileged
--unprivileged: Assume the user lacks raw socket privileges
-V: Print version number
-h: Print this help summary page.
EXAMPLES:
nmap -v -A scanme.nmap.org
nmap -v -sP 192.168.0.0/16 10.0.0.0/8
nmap -v -iR 10000 -PN -p 80
SEE THE MAN PAGE (http://nmap.org/book/man.html) FOR MORE OPTIONS AND EXAMPLES

questo è l'help di nmap dove potete vedere tutte le sue opzioni

morfes@morfes:~$ nmap 192.168.1.0/24

comando per scansionare il range degli ip della nostra rete lan

morfes@morfes:~$ nmap -sV -T Aggressive 192.168.1.103 -v

Starting Nmap 5.00 ( http://nmap.org ) at 2010-01-17 22:42 CET
NSE: Loaded 3 scripts for scanning.
Initiating Ping Scan at 22:42
Scanning 192.168.1.103 [2 ports]
Completed Ping Scan at 22:42, 0.00s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 22:42
Completed Parallel DNS resolution of 1 host. at 22:42, 0.05s elapsed
Initiating Connect Scan at 22:42
Scanning 192.168.1.103 [1000 ports]
Discovered open port 139/tcp on 192.168.1.103
Discovered open port 1025/tcp on 192.168.1.103
Discovered open port 445/tcp on 192.168.1.103
Discovered open port 135/tcp on 192.168.1.103
Completed Connect Scan at 22:42, 0.22s elapsed (1000 total ports)
Initiating Service scan at 22:42
Scanning 4 services on 192.168.1.103
Completed Service scan at 22:42, 6.02s elapsed (4 services on 1 host)
NSE: Script scanning 192.168.1.103.
NSE: Script Scanning completed.
Host 192.168.1.103 is up (0.0020s latency).
Interesting ports on 192.168.1.103:
Not shown: 996 closed ports
PORT     STATE SERVICE      VERSION
135/tcp  open  mstask       Microsoft mstask (task server - c:\winnt\system32\Mstask.exe)
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds Microsoft Windows XP microsoft-ds
1025/tcp open  mstask       Microsoft mstask (task server - c:\winnt\system32\Mstask.exe)
Service Info: OS: Windows

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.51 seconds

comando per una scansione approfondita di un indirizzo ip, dove vengono rilevate le porte aperte con i relativi servizi e il sistema operativo dell'host!