diff --git a/docs/refguide.xml b/docs/refguide.xml index 53cf7d43a..da4c720b4 100644 --- a/docs/refguide.xml +++ b/docs/refguide.xml @@ -149,8 +149,7 @@ option argument) is treated as a target host specification. The simplest case is to specify a target IP address or hostname for scanning. Sometimes you wish to scan a whole network of adjacent hosts. -For this, Nmap supports CIDR-style addressing. You can append -CIDR addressing +For this, Nmap supports CIDR-style addressing. You can appendCIDR addressing /numbits to an IP address or hostname and Nmap will scan every IP address for which the first numbits are the same as for the reference @@ -372,9 +371,7 @@ you would expect. (Ping Scan) - This option tells Nmap to only - -sP - ping scan + This option tells Nmap to only-sPping scan perform a ping scan (host discovery), then print out the available hosts that responded to the scan. No further testing (such as port scanning or OS detection) is performed. This is one @@ -700,13 +697,23 @@ Traceroute works by sending packets with a low TTL (time-to-live) in an attempt (Host and port state reasons) - --reason - Host and port state reasons + --reason + Host and port state reasons -Shows the reason each port is set to a specific state and the reason each host is up or down. This option displays the type of the packet that determined a port or hosts state. For example, A RST packet from a closed port or an echo reply from an alive host. The information nmap can provide is determined by the type of scan or ping. The SYN scan and SYN ping (\fB\-sS and -PT\fR) are very detailed. Whilst the TCP connect scan and ping (\fB\-sT\fR) are limited by the implementation of connect(). This feature is automatically enabled by the debug flag (\fB\-d\fR) and the results are stored in XML log files even if this option is not specified. +Shows the reason each port is set to a specific state and the reason +each host is up or down. This option displays the type of the packet +that determined a port or hosts state. For example, A RST packet from +a closed port or an echo reply from an alive host. The information +Nmap can provide is determined by the type of scan or ping. The SYN +scan and SYN ping ( and ) are very detailed, but the +TCP connect scan and ping () are limited by the +implementation of the connect system call. This feature is automatically enabled by +the debug option () and the results are stored in XML log files +even if this option is not specified. + @@ -1432,13 +1439,13 @@ way. port is referred to in the nmap-services. You can even use the wildcards * and ? with the names. For example, to scan FTP and all ports whose names begin with http, use . - Be careful about shell expansions and quote the argument to -p if unsure. + Be careful about shell expansions and quote the argument to if unsure. Ranges of ports can be surrounded by square brackets to indicate ports inside that range that appear in nmap-services. For example, the following will scan all ports in nmap-services equal to or below 1024: . Be careful with shell - expansions and quote the argument to -p if unsure. + expansions and quote the argument to if unsure. @@ -1511,7 +1518,7 @@ way. for querying various services and match expressions to recognize and parse responses. Nmap tries to determine the service protocol (e.g. FTP, SSH, telnet, http), the application name (e.g. ISC - Bind, Apache httpd, Solaris telnetd), the version number, + BIND, Apache httpd, Solaris telnetd), the version number, hostname, device type (e.g. printer, router), the OS family (e.g. Windows, Linux) and sometimes miscellaneous details like whether an X server is open to connections, the SSH protocol @@ -1907,7 +1914,7 @@ way. with the distributed scripts. Therefore, if you, for example, want to see if a machine is infected by any worm Nmap provides a script for you can simply run nmap --script=malware target-ip and check the output - afterwards. The version-scripts are always run + afterwards. The version scripts are always run implicitely when a script-scan is requested. The script.db is a Lua-script itself and can be updated through the option. @@ -1942,7 +1949,7 @@ way. performs a script scan using the default set of scripts. it is - equivalent to --script=safe,intrusive + equivalent to @@ -2325,16 +2332,19 @@ worth the extra time. -While the fine grained timing controls discussed in the previous +While the fine-grained timing controls discussed in the previous section are powerful and effective, some people find them confusing. Moreover, choosing the appropriate values can sometimes take more time than the scan you are trying to optimize. So Nmap offers a simpler approach, with six timing templates. You can specify them with the option and their number (0–5) or their name. -The template names are paranoid (0), sneaky (1), polite (2), normal -(3), aggressive (4), and insane (5). The first two are for IDS -evasion. Polite mode slows down the scan to use less bandwidth and -target machine resources. Normal mode is the default and so +The template names are (), + (), +(), (), + (), and + (). The first two are for +IDS evasion. Polite mode slows down the scan to use less bandwidth +and target machine resources. Normal mode is the default and so does nothing. Aggressive mode speeds scans up by making the assumption that you are on a reasonably fast and reliable network. Finally insane mode assumes that you are on an @@ -2343,16 +2353,16 @@ for speed. These templates allow the user to specify how aggressive they wish to be, while leaving Nmap to pick the exact timing values. The -templates also make some minor speed adjustments for which fine -grained control options do not currently exist. For example, +templates also make some minor speed adjustments for which +fine-grained control options do not currently exist. For example, prohibits the dynamic scan delay from exceeding 10ms for TCP ports and caps that value at 5 -milliseconds. Templates can be used in combination with fine grained +milliseconds. Templates can be used in combination with fine-grained controls, and the fine-grained controls will you specify will take precedence over the timing template default for that parameter. I recommend using when scanning reasonably modern -and reliable networks. Keep that option even when you add fine -grained controls so that you benefit from those extra minor +and reliable networks. Keep that option even when you add +fine-grained controls so that you benefit from those extra minor optimizations that it enables. If you are on a decent broadband or ethernet connection, I would @@ -3102,7 +3112,7 @@ overwhelming requests. Specify to only see (List interfaces and routes) --iflist - + Prints the interface list and system routes as detected by Nmap. This is useful for debugging routing problems or device mischaracterization (such as Nmap treating a PPP @@ -3218,7 +3228,7 @@ overwhelming requests. Specify to only see a machine that doesn't have Nmap (and thus nmap.xsl) installed. So the URL is often more useful, but the local filesystem location of - nmap.xsl is used by default for privacy reasons. + nmap.xsl is used by default for privacy reasons. @@ -3604,13 +3614,13 @@ overwhelming requests. Specify to only see do not currently exist. - nmap -v scanme.nmap.org + nmap -v scanme.nmap.org This option scans all reserved TCP ports on the machine scanme.nmap.org . The option enables verbose mode. - nmap -sS -O scanme.nmap.org/24 + nmap -sS -O scanme.nmap.org/24 Launches a stealth SYN scan against each machine that is up out of the 255 machines on class C network where @@ -3619,8 +3629,8 @@ overwhelming requests. Specify to only see running. This requires root privileges because of the SYN scan and OS detection. - nmap -sV -p 22,53,110,143,4564 - 198.116.0-255.1-127 + nmap -sV -p 22,53,110,143,4564 + 198.116.0-255.1-127 Launches host enumeration and a TCP scan at the first half @@ -3631,7 +3641,7 @@ overwhelming requests. Specify to only see what application is running. - nmap -v -iR 100000 -P0 -p 80 + nmap -v -iR 100000 -P0 -p 80 Asks Nmap to choose 100,000 hosts at random and scan them @@ -3641,8 +3651,8 @@ overwhelming requests. Specify to only see probing one port on each target host anyway. - nmap -P0 -p80 -oX logs/pb-port80scan.xml -oG - logs/pb-port80scan.gnmap 216.163.128.20/20 + nmap -P0 -p80 -oX logs/pb-port80scan.xml -oG + logs/pb-port80scan.gnmap 216.163.128.20/20 This scans 4096 IPs for any webservers (without pinging them) and saves the output in grepable and XML formats.