????SYN???
????????????????????SYN??跽???????????????
????nmap -sS -T4
?????????????
????All 997 ports are filtered
????PORT    STATE  SERVICE
????80/tcp  open   http
????113/tcp closed auth
????507/tcp open   crs
??????????????SYN??????3?????????????997???????????Nmap??????????1000????????????????????????????????????nmap -sS -T4-p-
????FIN???
??????????????FIN??跽????????????FIN??跽???????????????????RST??????????????????????open??filtered????
????nmap -sF -T4
?????????????
????PORT      STATE         SERVICE
????7/tcp     open|filtered echo
????9/tcp     open|filtered discard
????11/tcp    open|filtered systat
????13/tcp    open|filtered daytime
????23/tcp    open|filtered telnet
????25/tcp    open|filtered smtp
????37/tcp    open|filtered time
????79/tcp    open|filtered finger
????80/tcp    open|filtered http
?????????????????
????ACK???
???????????ACK????ж??????????????ACK??????δ?????????????????????????RST????
????nmap -sA -T4
????Not shown: 997 unfiltered ports
????PORT      STATE    SERVICE
????135/tcp   filtered msrpc
????1434/tcp  filtered ms-sql-m
????32777/tcp filtered sometimes-rpc17
????????????997???????δ????????unfiltered??????3????135/1434/32777??????????????????ACK??FIN?????????????????????????????????????7?????FIN?еó???????:open??filtered????ACK?еó???????unfiltered??????????????open???
????Window???
????????????????Window??跽????ó??Щ????????????????????????????????Window??跽?????ЩTCPIPЭ???????Ч??
????window????????ACK?????????ACK?????????????????RST???е?Window size???н????????ЩTCPIPЭ???????У?????????RST?л?Window size?????0????????????Window size???ó??0?????
????nmap -sW -p- -T4 docsrv.caldera.com
????????????
????PORT      STATE    SERVICE
????7/tcp     open     echo
????9/tcp     open     discard
????11/tcp    open     systat
????13/tcp    open     daytime
?????????????????
??????????????????????????????????????????ó?????汾???OS???
????????????????
????3     ???·????
????Nmap????????????????豸???????nmap-os-db??????????????????????豸????????????????????????·?????豸??
????3.1  ??????·????
????nmap -p1-25??80??512-515??2001??4001??6001??9001 10.20.0.1/16
???????·????????????????????????????????о????????????????????????λ??·?????豸?????IP????????????
????3.2  ???·????TFTP
????nmap –sU –p69 –nvv target
???????????·?????????TFTPЭ?饗?????????Э?飩????Э?鳣??????????·?????????????????????UDP 69????????????????????????·?????????TFTP??
????3.3  ???·??????????
?????????PC??跽?????????-O??????·?????????????-F?????????????????100??????????????????????????OS??????????
????nmap -O -F -n 192.168.1.1

????4     ??軥????
????Nmap??????????????????????赥????????С????????????????????????????????з?????????????????????????????????????????????????????????
????4.1  ???????????web??????
????nmap -iR 100000 -sS -PS80 -p 80 -oG nmap.txt
????????????10???IP?????????80????????衣?????????greppable??????grep?????????????????nmap.txt?????
???????????grep???????????????????????????
????4.2  ????????????????????
????Nmap??????Fyodor??2008???Black Hat????????????????????????Nmap????軥??????Nmap: Scanning the Internet????????????http://nmap.org/presentations/BHDC08/??
????Fyodor???л?????????????????????羭?????????????Nmap??????????磬????????????????????????????賣(mài)??????????????????
???????????IP???
????????100????????IP?????????????浽????У???????????????????????
????nmap -iR 1200000 -sL -n | grep "not scanned" | awk '{print $2}' | sort -n | uniq >! tp; head -25000000 tp >! tcp-allports-1M-IPs; rm tp
?????????????壺???????1200000??IP?????-iR 120000???????????б???裨-sL???о??IP???????????????????裩????????dns??????????-n??????????????Nmap?б???????????????????δ?????У?grep “not scanned”????????????е??????????awk ‘{print $2}’?????IP?????????????????IP???????????sort -n?????????????IP?????????????浽??????tp????????1000000??IP??????浽tcp-allports-1M-IPs????У????????????
??????????????????1000000?????IP????????tcp-allports-1M-IPs????С?
???????????????
????nmap -sP -PE -PP -PS21??22??23??25??80??113??31339-PA80??113??443??10042 --source-port 53 -T4 -iL tcp-allports-1M-IPs
??????????????????????????ò?????IP?????-iL tcp-allports-1M-IPs???????????????????53??--source-port 53????????DNS????????????????????????????????????????????4??-T4???????????????TCP SYN??????????????21??22??23??25??80??113??31339??????TCP ACK??????????80??113??443??10042?????????????ICMP ECHO/ICMP TIMESTAMP??????????????????????????е?????????????????????????????