python-nmap使用及案例
nmap 概念及功能
概念
NMap，也就是 Network Mapper，最早是 Linux 下的网络扫描和嗅探工具包。
nmap 是一个网络连接端扫描软件，用来扫描网上电脑开放的网络连接端。确定哪些服务运行在哪些连接端，并且推断计算机运行哪个操作系统（这是亦称 fingerprinting）。它是网络管理员必用的软件之一，以及用以评估网络系统安全。
正如大多数被用于网络安全的工具，nmap 也是不少黑客及骇客（又称脚本小子）爱用的工具 。系统管理员可以利用 nmap 来探测工作环境中未经批准使用的服务器，但是黑客会利用 nmap 来搜集目标电脑的网络设定，从而计划攻击的方法。
Nmap 常被跟评估系统漏洞软件Nessus 混为一谈。Nmap 以隐秘的手法，避开闯入检测系统的监视，并尽可能不影响目标系统的日常操作。
Nmap 在黑客帝国(The Matrix) 中，连同SSH1 的 32 位元循环冗余校验漏洞，被崔妮蒂用以入侵发电站的能源管理系统。
功能
基本功能有三个，一是探测一组主机是否在线；其次是扫描 主机端口，嗅探所提供的网络服务；还可以推断主机所用的操作系统 。Nmap 可用于扫描仅有两个节点的 LAN，直至 500 个节点以上的网络。Nmap 还允许用户定制扫描技巧。通常，一个简单的使用ICMP 协议的 ping 操作可以满足一般需求；也可以深入探测 UDP 或者 TCP 端口，直至主机所 使用的操作系统；还可以将所有探测结果记录到各种格式的日志中， 供进一步分析操作。
进行 ping 扫描，打印出对扫描做出响应的主机, 不做进一步测试 ( 如端口扫描或者操作系统探测 )：
nmap -sP 192.168.1.0/24
仅列出指定网络上的每台主机，不发送任何报文到目标主机：
nmap -sL 192.168.1.0/24
探测目标主机开放的端口，可以指定一个以逗号分隔的端口列表 (如 -PS22，23，25，80)：
nmap -PS 192.168.1.234
使用 UDP ping 探测主机：
nmap -PU 192.168.1.0/24
使用频率最高的扫描选项：SYN 扫描, 又称为半开放扫描，它不打开一个完全的 TCP 连接，执行得很快：
nmap -sS 192.168.1.0/24
nmap 安装
本文以 linux Ubuntu16.04 为例，最后主要用 python 操作
1. 先安装 nmap
sudo apt-get install nmap
2. 再安装 python-nmap
sudo pip install python-nmap
安装完之后 python 导入 nmap 测试验证是否成功
root@LiDebin:~# python Python 2.7.12 (default, Jul 1 2016, 15:12:24) [GCC 5.4.0 20160609] on linux2 Type "help", "copyright", "credits" or "license" for more information. >>> import nmap
python 操作 nmap
1. 简单的小案例
创建 PortScanner 实例，然后扫描 159.239.210.26 这个 IP 的 20-443 端口。
import nmapnm = nmap.PortScanner()
ret = nm.scan('115.239.210.26','20')
print ret返回格式如下:
{'nmap': {'scanstats':
{'uphosts': '1', 'timestr': 'Tue Oct 25 11:30:47 2016', 'downhosts': '0', 'totalhosts': '1', 'elapsed': '1.11'},
'scaninfo': {'tcp': {'services': '20', 'method': 'connect'}}, 'command_line': 'nmap -oX - -p 20 -sV 115.239.210.26'},
'scan': {'115.239.210.26': {'status': {'state': 'up', 'reason': 'syn-ack'}, 'hostnames': [{'type': '', 'name': ''}],
'vendor': {}, 'addresses': {'ipv4': '115.239.210.26'},
'tcp': {20: {'product': '', 'state': 'filtered', 'version': '', 'name': 'ftp-data', 'conf': '3', 'extrainfo': '',
'reason': 'no-response', 'cpe': ''}
}
}
}
}
2. 内置方法：
还可以打印出简单的信息
import nmap nm = nmap.PortScanner() print nm.scaninfo() # {u'tcp': {'services': u'20-443', 'method': u'syn'}} print nm.command_line() # u'nmap -oX - -p 20-443 -sV 115.239.210.26'
查看有多少个 host
print nm.all_hosts() # [u'115.239.210.26']
查看该 host 的详细信息
nm['115.239.210.26']
查看该 host 包含的所有协议
nm['115.239.210.26'].all_protocols()
查看该 host 的哪些端口提供了 tcp 协议
nm['115.239.210.26']['tcp']nm['115.239.210.26'][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">tcp</span><span style="color: rgba(128, 0, 0, 1)">'</span>].keys()
查看该端口是否提供了 tcp 协议
nm['115.239.210.26'].has_tcp(21)
还可以像这样设置 nmap 执行的参数
nm.scan(hosts='192.168.1.0/24', arguments='-n -sP -PE -PA21,23,80,3389')
更多操作请进官网 http://xael.org/pages/python-nmap-en.html
实验案例
检测内网机器端口
1. 定义函数库 mytools.py
#-*- coding:utf-8 -*- import smtplib from email.mime.text import MIMEText from email.header import Header def sendemail(sender,receiver,subject,content,smtpserver,smtpuser,smtppass): msg = MIMEText(content,'html','utf-8')#中文需参数‘utf-8'，单字节字符不需要 msg['Subject'] = Header(subject, 'utf-8') msg['From'] = '<%s>' % sender msg['To'] = ";".join(receiver) try: smtp = smtplib.SMTP()smtp.connect(smtpserver) smtp.login(smtpuser, smtppass) smtp.sendmail(sender, receiver, msg.as_string()) smtp.quit() except Exception,e: print e
2. 实现端口扫描的程序，单线程版本 nmscan.py
# !/usr/bin/python # -*- coding:utf-8 -*-import nmap
import re
import mytools as tool
import sysreload(sys)
sys.setdefaultencoding('utf8')def nmScan(hostlist, portrange, whitelist):
p = re.compile("^(\d*)-(\d*)$")</span><span style="color: rgba(0, 0, 255, 1)">if</span> type(hostlist) !=<span style="color: rgba(0, 0, 0, 1)"> list: help() portmatch </span>=<span style="color: rgba(0, 0, 0, 1)"> re.match(p, portrange) </span><span style="color: rgba(0, 0, 255, 1)">if</span> <span style="color: rgba(0, 0, 255, 1)">not</span><span style="color: rgba(0, 0, 0, 1)"> portmatch: help() l </span>=<span style="color: rgba(0, 0, 0, 1)"> [] </span><span style="color: rgba(0, 0, 255, 1)">for</span> host <span style="color: rgba(0, 0, 255, 1)">in</span><span style="color: rgba(0, 0, 0, 1)"> hostlist: result </span>= <span style="color: rgba(128, 0, 0, 1)">''</span><span style="color: rgba(0, 0, 0, 1)"> nm </span>=<span style="color: rgba(0, 0, 0, 1)"> nmap.PortScanner() tmp </span>=<span style="color: rgba(0, 0, 0, 1)"> nm.scan(host, portrange) result </span>= result + <span style="color: rgba(128, 0, 0, 1)">"</span><span style="color: rgba(128, 0, 0, 1)"><h2>ip地址:%s 主机名:[%s] ...... %s</h2><hr></span><span style="color: rgba(128, 0, 0, 1)">"</span> %<span style="color: rgba(0, 0, 0, 1)"> ( host, tmp[</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">scan</span><span style="color: rgba(128, 0, 0, 1)">'</span>][host][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">hostname</span><span style="color: rgba(128, 0, 0, 1)">'</span>], tmp[<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">scan</span><span style="color: rgba(128, 0, 0, 1)">'</span>][host][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">status</span><span style="color: rgba(128, 0, 0, 1)">'</span>][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">state</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(0, 0, 0, 1)">]) </span><span style="color: rgba(0, 0, 255, 1)">try</span><span style="color: rgba(0, 0, 0, 1)">: ports </span>= tmp[<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">scan</span><span style="color: rgba(128, 0, 0, 1)">'</span>][host][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">tcp</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(0, 0, 0, 1)">].keys() </span><span style="color: rgba(0, 0, 255, 1)">except</span><span style="color: rgba(0, 0, 0, 1)"> KeyError, e: </span><span style="color: rgba(0, 0, 255, 1)">if</span><span style="color: rgba(0, 0, 0, 1)"> whitelist: whitestr </span>= <span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">,</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(0, 0, 0, 1)">.join(whitelist) result </span>= result + <span style="color: rgba(128, 0, 0, 1)">"</span><span style="color: rgba(128, 0, 0, 1)">未扫到开放端口!请检查%s端口对应的服务状态</span><span style="color: rgba(128, 0, 0, 1)">"</span> %<span style="color: rgba(0, 0, 0, 1)"> whitestr </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)">: result </span>= result + <span style="color: rgba(128, 0, 0, 1)">"</span><span style="color: rgba(128, 0, 0, 1)">扫描结果正常，无暴漏端口</span><span style="color: rgba(128, 0, 0, 1)">"</span> <span style="color: rgba(0, 0, 255, 1)">for</span> port <span style="color: rgba(0, 0, 255, 1)">in</span><span style="color: rgba(0, 0, 0, 1)"> ports: info </span>= <span style="color: rgba(128, 0, 0, 1)">''</span> <span style="color: rgba(0, 0, 255, 1)">if</span> port <span style="color: rgba(0, 0, 255, 1)">not</span> <span style="color: rgba(0, 0, 255, 1)">in</span><span style="color: rgba(0, 0, 0, 1)"> whitelist: info </span>= <span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)"><strong><font color=red>Alert:非预期端口</font><strong>&nbsp;&nbsp;</span><span style="color: rgba(128, 0, 0, 1)">'</span> <span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)">: info </span>= <span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)"><strong><font color=green>Info:正常开放端口</font><strong>&nbsp;&nbsp;</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(0, 0, 0, 1)"> portinfo </span>= <span style="color: rgba(128, 0, 0, 1)">"</span><span style="color: rgba(128, 0, 0, 1)">%s <strong>port</strong> : %s &nbsp;&nbsp;<strong>state</strong> : %s &nbsp;&nbsp;<strong>product<strong/> : %s <br></span><span style="color: rgba(128, 0, 0, 1)">"</span> %<span style="color: rgba(0, 0, 0, 1)"> ( info, port, tmp[</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">scan</span><span style="color: rgba(128, 0, 0, 1)">'</span>][host][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">tcp</span><span style="color: rgba(128, 0, 0, 1)">'</span>][port][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">state</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(0, 0, 0, 1)">], tmp[</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">scan</span><span style="color: rgba(128, 0, 0, 1)">'</span>][host][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">tcp</span><span style="color: rgba(128, 0, 0, 1)">'</span>][port][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">product</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(0, 0, 0, 1)">]) result </span>= result +<span style="color: rgba(0, 0, 0, 1)"> portinfo l.append([host, str(result)]) </span><span style="color: rgba(0, 0, 255, 1)">return</span><span style="color: rgba(0, 0, 0, 1)"> ldef help():
print "Usage: nmScan(['127.0.0.1',],'0-65535')"if name == "main":
hostlist = ['10.10.10.10', '10.10.10.11']
portrange = '0-65535'
whitelist = [80, 443]
l = nmScan(hostlist, portrange, whitelist)
sender = '75501664@qq.com'
receiver = ['zhangyanlin8851@163.com', '877986976@qq.com']
subject = '服务器端口扫描'
smtpserver = 'smtp.exmail.qq.com'
smtpuser = 'zhangyanlin8851@163.cn'
smtppass = 'linuxidc163'
mailcontent = ''
for i in range(len(l)):
mailcontent = mailcontent + l[i][1<span style="color: rgba(0, 0, 0, 1)">]
tool.sendemail(sender, receiver, subject, mailcontent, smtpserver, smtpuser, smtppass)
3. 多线程版本
# !/usr/bin/python # -*- coding:utf-8 -*-import nmap
import re
import mytools as tool
import sys
from multiprocessing import Pool
from functools import partialreload(sys)
sys.setdefaultencoding('utf8')def nmScan(host, portrange, whitelist):
p = re.compile("^(\d*)-(\d*)$")
# if type(hostlist) != list:
# help()
portmatch = re.match(p, portrange)
if not portmatch:
help()</span><span style="color: rgba(0, 0, 255, 1)">if</span> host == <span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">121.42.32.172</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(0, 0, 0, 1)">: whitelist </span>= [25<span style="color: rgba(0, 0, 0, 1)">, ] result </span>= <span style="color: rgba(128, 0, 0, 1)">''</span><span style="color: rgba(0, 0, 0, 1)"> nm </span>=<span style="color: rgba(0, 0, 0, 1)"> nmap.PortScanner() tmp </span>=<span style="color: rgba(0, 0, 0, 1)"> nm.scan(host, portrange) result </span>= result + <span style="color: rgba(128, 0, 0, 1)">"</span><span style="color: rgba(128, 0, 0, 1)"><h2>ip地址:%s 主机名:[%s] ...... %s</h2><hr></span><span style="color: rgba(128, 0, 0, 1)">"</span> %<span style="color: rgba(0, 0, 0, 1)"> ( host, tmp[</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">scan</span><span style="color: rgba(128, 0, 0, 1)">'</span>][host][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">hostname</span><span style="color: rgba(128, 0, 0, 1)">'</span>], tmp[<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">scan</span><span style="color: rgba(128, 0, 0, 1)">'</span>][host][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">status</span><span style="color: rgba(128, 0, 0, 1)">'</span>][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">state</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(0, 0, 0, 1)">]) </span><span style="color: rgba(0, 0, 255, 1)">try</span><span style="color: rgba(0, 0, 0, 1)">: ports </span>= tmp[<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">scan</span><span style="color: rgba(128, 0, 0, 1)">'</span>][host][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">tcp</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(0, 0, 0, 1)">].keys() </span><span style="color: rgba(0, 0, 255, 1)">for</span> port <span style="color: rgba(0, 0, 255, 1)">in</span><span style="color: rgba(0, 0, 0, 1)"> ports: info </span>= <span style="color: rgba(128, 0, 0, 1)">''</span> <span style="color: rgba(0, 0, 255, 1)">if</span> port <span style="color: rgba(0, 0, 255, 1)">not</span> <span style="color: rgba(0, 0, 255, 1)">in</span><span style="color: rgba(0, 0, 0, 1)"> whitelist: info </span>= <span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)"><strong><font color=red>Alert:非预期端口</font><strong>&nbsp;&nbsp;</span><span style="color: rgba(128, 0, 0, 1)">'</span> <span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)">: info </span>= <span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)"><strong><font color=green>Info:正常开放端口</font><strong>&nbsp;&nbsp;</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(0, 0, 0, 1)"> portinfo </span>= <span style="color: rgba(128, 0, 0, 1)">"</span><span style="color: rgba(128, 0, 0, 1)">%s <strong>port</strong> : %s &nbsp;&nbsp;<strong>state</strong> : %s &nbsp;&nbsp;<strong>product<strong/> : %s <br></span><span style="color: rgba(128, 0, 0, 1)">"</span> %<span style="color: rgba(0, 0, 0, 1)"> ( info, port, tmp[</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">scan</span><span style="color: rgba(128, 0, 0, 1)">'</span>][host][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">tcp</span><span style="color: rgba(128, 0, 0, 1)">'</span>][port][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">state</span><span style="color: rgba(128, 0, 0, 1)">'</span>], tmp[<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">scan</span><span style="color: rgba(128, 0, 0, 1)">'</span>][host][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">tcp</span><span style="color: rgba(128, 0, 0, 1)">'</span>][port][<span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">product</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(0, 0, 0, 1)">]) result </span>= result +<span style="color: rgba(0, 0, 0, 1)"> portinfo </span><span style="color: rgba(0, 0, 255, 1)">except</span><span style="color: rgba(0, 0, 0, 1)"> KeyError, e: </span><span style="color: rgba(0, 0, 255, 1)">if</span><span style="color: rgba(0, 0, 0, 1)"> whitelist: whitestr </span>= <span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(128, 0, 0, 1)">,</span><span style="color: rgba(128, 0, 0, 1)">'</span><span style="color: rgba(0, 0, 0, 1)">.join(whitelist) result </span>= result + <span style="color: rgba(128, 0, 0, 1)">"</span><span style="color: rgba(128, 0, 0, 1)">未扫到开放端口!请检查%s端口对应的服务状态</span><span style="color: rgba(128, 0, 0, 1)">"</span> %<span style="color: rgba(0, 0, 0, 1)"> whitestr </span><span style="color: rgba(0, 0, 255, 1)">else</span><span style="color: rgba(0, 0, 0, 1)">: result </span>= result + <span style="color: rgba(128, 0, 0, 1)">"</span><span style="color: rgba(128, 0, 0, 1)">扫描结果正常，无暴漏端口</span><span style="color: rgba(128, 0, 0, 1)">"</span> <span style="color: rgba(0, 0, 255, 1)">return</span><span style="color: rgba(0, 0, 0, 1)"> resultdef help():
print "Usage: nmScan(['127.0.0.1',],'0-65535')"
return Noneif name == "main":
hostlist = ['10.10.10.10', '10.10.10.11']
portrange = '0-65535'
whitelist = [80, 443]
l = nmScan(hostlist, portrange, whitelist)
sender = '75501664@qq.com'
receiver = ['zhangyanlin8851@163.com', '877986976@qq.com']
subject = '服务器端口扫描'
smtpserver = 'smtp.exmail.qq.com'
smtpuser = 'zhangyanlin8851@163.cn'
smtppass = 'linuxidc163'
mailcontent = ''
for i in range(len(l)):
mailcontent = mailcontent + l[i][1<span style="color: rgba(0, 0, 0, 1)">]
tool.sendemail(sender, receiver, subject, mailcontent, smtpserver, smtpuser, smtppass)