0x01 About

 

大家都比较熟悉nmap，nmap是一个网络连接端扫描软件，用来扫描网上电脑开放的网络连接端。确定哪些服务运行在哪些连接端，并且推断计算机运行哪个操作系统（这是亦称 fingerprinting）。它是网络管理员必用的软件之一，以及用以评估网络系统安全。

今天分享一下python-nmap，是python的一个模块库，使用这个模块可以让python很方便的操作nmap扫描器来工作，它可以帮助管理员完成自动扫描任务和生成报告的工具，它还支持nmap的脚步输出。

python-nmap只提供了nmap中的端口扫描，但输出方式会让人便于信息整理。

前提：使用python-nmap你得先装有nmap该软件

Install from PIP

pip install python-nmap

2345截图20160127212007

0x02 Usage

#!/usr/bin/env python
 import nmap                         # import nmap.py module
 nm = nmap.PortScanner()             # instantiate nmap.PortScanner object
 nm.scan('127.0.0.1', '22-443')      # scan host 127.0.0.1, ports from 22 to 443
 nm.command_line()                   # get command line used for the scan : nmap -oX - -p 22-443 127.0.0.1
 nm.scaninfo()                       # get nmap scan informations {'tcp': {'services': '22-443', 'method': 'connect'}}
 nm.all_hosts()                      # get all hosts that were scanned
 nm['127.0.0.1'].hostname()          # get one hostname for host 127.0.0.1, usualy the user record
 nm['127.0.0.1'].hostnames()         # get list of hostnames for host 127.0.0.1 as a list of dict
                                     # [{'name':'hostname1', 'type':'PTR'}, {'name':'hostname2', 'type':'user'}]
 nm['127.0.0.1'].hostname()          # get hostname for host 127.0.0.1
 nm['127.0.0.1'].state()             # get state of host 127.0.0.1 (up|down|unknown|skipped)
 nm['127.0.0.1'].all_protocols()     # get all scanned protocols ['tcp', 'udp'] in (ip|tcp|udp|sctp)
 nm['127.0.0.1']['tcp'].keys()       # get all ports for tcp protocol
 nm['127.0.0.1'].all_tcp()           # get all ports for tcp protocol (sorted version)
 nm['127.0.0.1'].all_udp()           # get all ports for udp protocol (sorted version)
 nm['127.0.0.1'].all_ip()            # get all ports for ip protocol (sorted version)
 nm['127.0.0.1'].all_sctp()          # get all ports for sctp protocol (sorted version)
 nm['127.0.0.1'].has_tcp(22)         # is there any information for port 22/tcp on host 127.0.0.1
 nm['127.0.0.1']['tcp'][22]          # get infos about port 22 in tcp on host 127.0.0.1
 nm['127.0.0.1'].tcp(22)             # get infos about port 22 in tcp on host 127.0.0.1
 nm['127.0.0.1']['tcp'][22]['state'] # get state of port 22/tcp on host 127.0.0.1 (open

 # a more usefull example :
 for host in nm.all_hosts():
     print('----------------------------------------------------')
     print('Host : %s (%s)' % (host, nm[host].hostname()))
     print('State : %s' % nm[host].state())

     for proto in nm[host].all_protocols():
         print('----------')
         print('Protocol : %s' % proto)

         lport = nm[host][proto].keys()
         lport.sort()
         for port in lport:
             print('port : %s\tstate : %s' % (port, nm[host][proto][port]['state']))

 print('----------------------------------------------------')
 # print result as CSV
 print(nm.csv())


 print('----------------------------------------------------')
 # If you want to do a pingsweep on network 192.168.1.0/24:
 nm.scan(hosts='192.168.1.0/24', arguments='-n -sP -PE -PA21,23,80,3389')
 hosts_list = [(x, nm[x]['status']['state']) for x in nm.all_hosts()]
 for host, status in hosts_list:
     print('{0}:{1}'.format(host, status))


print '----------------------------------------------------'
# Asynchronous usage of PortScannerAsync
nma = nmap.PortScannerAsync()
def callback_result(host, scan_result):
    print '------------------'
    print host, scan_result
nma.scan(hosts='192.168.1.0/30', arguments='-sP', callback=callback_result)
while nma.still_scanning():
    print("Waiting ...")
    nma.wait(2)   # you can do whatever you want but I choose to wait after the end of the scan

 

创建PortScanner,扫描本机22-443端口，输出简单信息

>>> import nmap
>>> nm = nmap.PortScanner()
>>> nm.scan('127.0.0.1', '22-443')
>>> nm.command_line()
'nmap -oX - -p 22-443 -sV 127.0.0.1'
>>> nm.scaninfo()
{'tcp': {'services': '22-443', 'method': 'connect'}}

查看host/协议

>>> nm.all_hosts()
['127.0.0.1']
>>> nm['127.0.0.1'].hostname()
'localhost'
>>> nm['127.0.0.1'].state()
'up'
>>> nm['127.0.0.1'].all_protocols()
['tcp']
>>> nm['127.0.0.1']['tcp'].keys()
[80, 25, 443, 22, 111]
>>> nm['127.0.0.1'].has_tcp(22)
True
>>> nm['127.0.0.1'].has_tcp(23)
False
>>> nm['127.0.0.1']['tcp'][22]
{'state': 'open', 'reason': 'syn-ack', 'name': 'ssh'}
>>> nm['127.0.0.1'].tcp(22)
{'state': 'open', 'reason': 'syn-ack', 'name': 'ssh'}
>>> nm['127.0.0.1']['tcp'][22]['state']
'open'

 

python-nmap官网：http://xael.org/pages/python-nmap-en.html