如何在CentOS/RHEL或基于Red Hat Enterprise Linux的系统下安装nmap命令来测试自己网络的安全性？

nmap命令行实用程序用于端口扫描和找出计算机与网络上其他计算机通信的所有方式。
您可以在服务器或计算机上找到打开的端口，并找到正在使用这些端口的服务。
它甚至可以确定服务器上正在运行什么操作系统等等。

安装nmap

要在基于RHEL的Linux发行版上安装nmap，请执行以下yum命令：

# yum install nmap

输出示例：

Loaded plugins: protectbase, rhnplugin, security
0 packages excluded due to repository protections
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package nmap.x86_64 2:5.51-2.el6 will be installed
--> Finished Dependency Resolution
 
Dependencies Resolved
 
================================================================================
Package    Arch         Version               Repository                  Size
================================================================================
Installing:
nmap       x86_64       2:5.51-2.el6          rhel-x86_64-server-6       2.8 M
 
Transaction Summary
================================================================================
Install       1 Package(s)
 
Total download size: 2.8 M
Installed size: 0  
Is this ok [y/N]: y
Downloading Packages:
nmap-5.51-2.el6.x86_64.rpm                               | 2.8 MB     00:00     
Running rpm_check_debug
Running Transaction Test
Transaction Test Succeeded
Running Transaction
  Installing : 2:nmap-5.51-2.el6.x86_64                                     1/1 
  Verifying  : 2:nmap-5.51-2.el6.x86_64                                     1/1 
 
Installed:
  nmap.x86_64 2:5.51-2.el6                                                      
 
Complete!

如何使用nmap命令？

要查找nmap版本，请运行：

# nmap --version

输出示例：

Nmap version 5.51 ( http://nmap.org )

要扫描IP地址或主机名(FQDN)，请运行：

# nmap 1.2.3.4
# nmap localhost
# nmap 192.168.1.1

从远程系统中获取更多信息

-v选项强制输出详细信息，-A optipn在单个命令中启用操作系统检测和版本检测，脚本扫描和跟踪路由：

# nmap -v -A scanme.nmap.org
# nmap -v -A 192.168.1.1

输出示例：

Starting Nmap 5.00 ( http://nmap.org ) at 2012-11-19 16:38 IST
NSE: Loaded 30 scripts for scanning.
Initiating ARP Ping Scan at 16:38
Scanning 192.168.1.1 [1 port]
Completed ARP Ping Scan at 16:38, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 16:38
Completed Parallel DNS resolution of 1 host. at 16:38, 0.00s elapsed
Initiating SYN Stealth Scan at 16:38
Scanning 192.168.1.1 [1000 ports]
Discovered open port 80/tcp on 192.168.1.1
Discovered open port 22/tcp on 192.168.1.1
Completed SYN Stealth Scan at 16:38, 0.27s elapsed (1000 total ports)
Initiating Service scan at 16:38
Retrying OS detection (try #4) against 192.168.1.1
Retrying OS detection (try #5) against 192.168.1.1
NSE: Script scanning 192.168.1.1.
NSE: Starting runlevel 1 scan
Initiating NSE at 16:40
Completed NSE at 16:40, 0.88s elapsed
NSE: Script Scanning completed.
Host 192.168.1.1 is up (0.00050s latency).
Interesting ports on 192.168.1.1:
Not shown: 998 closed ports
PORT   STATE SERVICE VERSION
22/tcp open  ssh     Dropbear sshd 0.52 (protocol 2.0)
|  ssh-hostkey: 1024 15:b6:b5:68:dc:36:97:76:19:72:4d:74:63:d6:18:35 (DSA)
|_ 1040 d2:75:67:8e:51:4d:4b:f6:25:f0:46:e3:a8:9e:8f:42 (RSA)
80/tcp open  http?
|_ html-title: Error
|  http-auth: HTTP Service requires authentication
|_   Auth type: Basic, realm = tswitch
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
OS:%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=
OS:40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=
OS:G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
 
Network Distance: 1 hop
 
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 83.27 seconds
           Raw packets sent: 1266 (62.072KB) | Rcvd: 1036 (44.320KB)

扫描IP地址范围

# nmap 192.168.1.1-50

扫描整个子网

# nmap 192.168.1.0/24

仅扫描

# nmap -sP 192.168.1.1

TCP SYN扫描

# nmap -sS 192.168.1.1

UDP扫描

# nmap -sU 192.168.1.1

IP协议扫描

# nmap -sO 192.168.1.1

扫描端口80、25、443和110

# nmap -p 80,25,443,110 192.168.1.1

扫描端口范围1024-2048

# nmap -p 1024-2048 192.168.1.1

操作系统检测

# nmap -O --osscan-guess 192.168.1.1