PenTest/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-01-02 04:49:02 +00:00
Code Issues Projects Releases Wiki Activity

A couple fixes from Diman

Browse Source
This commit is contained in:
fyodor
2006-07-30 06:42:00 +00:00
parent 8ef3588d95
commit df7b5ba2a1
2 changed files with 20 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
docs/nmap.1
View File

@@ -2,7 +2,7 @@
.\" It was generated using the DocBook XSL Stylesheets (version 1.69.1).
.\" Instead of manually editing it, you probably should edit the DocBook XML
.\" source for it and then use the DocBook XSL Stylesheets to regenerate it.
.TH "NMAP" "1" "07/04/2006" "" "Nmap Reference Guide"
.TH "NMAP" "1" "07/27/2006" "" "Nmap Reference Guide"
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
@@ -47,7 +47,7 @@ Example\ 13.1.\ A representative Nmap scan.sp
.nf
# nmap \-A \-T4 scanme.nmap.org playground
Starting nmap ( http://www.insecure.org/nmap/ )
Starting nmap ( http://insecure.org/nmap/ )
Interesting ports on scanme.nmap.org (205.217.153.62):
(The 1663 ports scanned but not shown below are in state: filtered)
PORT STATE SERVICE VERSION
@@ -83,12 +83,12 @@ Nmap finished: 2 IP addresses (2 hosts up) scanned in 88.392 seconds
.fi
.PP
The newest version of Nmap can be obtained from
\fI\%http://www.insecure.org/nmap/\fR. The newest version of the man page is available from
\fI\%http://www.insecure.org/nmap/man/\fR.
\fI\%http://insecure.org/nmap/\fR. The newest version of the man page is available from
\fI\%http://insecure.org/nmap/man/\fR.
.SH "OPTIONS SUMMARY"
.PP
This options summary is printed when Nmap is run with no arguments, and the latest version is always available at
\fI\%http://www.insecure.org/nmap/data/nmap.usage.txt\fR. It helps people remember the most common options, but is no substitute for the in\-depth documentation in the rest of this manual. Some obscure options aren't even included here.
\fI\%http://insecure.org/nmap/data/nmap.usage.txt\fR. It helps people remember the most common options, but is no substitute for the in\-depth documentation in the rest of this manual. Some obscure options aren't even included here.
.PP
.nf
Usage: nmap [Scan Type(s)] [Options] {target specification}
@@ -577,7 +577,7 @@ open|filtered. Nmap will behave the same way it does for the base scan type, exc
.TP
\fB\-sI <zombie host[:probeport]>\fR (Idlescan)
This advanced scan method allows for a truly blind TCP port scan of the target (meaning no packets are sent to the target from your real IP address). Instead, a unique side\-channel attack exploits predictable IP fragmentation ID sequence generation on the zombie host to glean information about the open ports on the target. IDS systems will display the scan as coming from the zombie machine you specify (which must be up and meet certain criteria). This fascinating scan type is too complex to fully describe in this reference guide, so I wrote and posted an informal paper with full details at
\fI\%http://www.insecure.org/nmap/idlescan.html\fR.
\fI\%http://insecure.org/nmap/idlescan.html\fR.
.sp
Besides being extraordinarily stealthy (due to its blind nature), this scan type permits mapping out IP\-based trust relationships between machines. The port listing shows open ports
\fIfrom the perspective of the zombie host.\fR
@@ -672,7 +672,7 @@ open|filtered
TCP ports are treated the same way. Note that the Nmap
\fB\-A\fR
option enables version detection among other things. A paper documenting the workings, usage, and customization of version detection is available at
\fI\%http://www.insecure.org/nmap/vscan/\fR.
\fI\%http://insecure.org/nmap/vscan/\fR.
.PP
When Nmap receives responses from a service but cannot match them to its database, it prints out a special fingerprint and a URL for you to submit if to if you know for sure what is running on the port. Please take a couple minutes to make the submission so that your find can benefit everyone. Thanks to these submissions, Nmap has about 3,000 pattern matches for more than 350 protocols such as smtp, ftp, http, etc.
.PP
@@ -733,7 +733,7 @@ or
class, which means that they increment the ID field in the IP header for each packet they send. This makes them vulnerable to several advanced information gathering and spoofing attacks.
.PP
A paper documenting the workings, usage, and customization of OS detection is available in more than a dozen languages at
\fI\%http://www.insecure.org/nmap/osdetect/\fR.
\fI\%http://insecure.org/nmap/osdetect/\fR.
.PP
OS detection is enabled and controlled with the following options:
.TP
@@ -1084,7 +1084,7 @@ interactive output.
Requests that
XML output
be directed to the given filename. Nmap includes a document type definition (DTD) which allows XML parsers to validate Nmap XML output. While it is primarily intended for programmatic use, it can also help humans interpret Nmap XML output. The DTD defines the legal elements of the format, and often enumerates the attributes and values they can take on. The latest version is always available from
\fI\%http://www.insecure.org/nmap/data/nmap.dtd\fR.
\fI\%http://insecure.org/nmap/data/nmap.dtd\fR.
.sp
XML offers a stable format that is easily parsed by software. Free XML parsers are available for all major computer languages, including C/C++, Perl, Python, and Java. People have even written bindings for most of these languages to handle Nmap output and execution specifically. Examples are
[6]\&\fINmap::Scanner\fR
@@ -1201,14 +1201,14 @@ where it was initially installed by Nmap (or in the current working directory on
\fInmap.xsl\fR
from the filesystem and use it to render results. If you wish to use a different stylesheet, specify it as the argument to
\fB\-\-stylesheet\fR. You must pass the full pathname or URL. One common invocation is
\fB\-\-stylesheet http://www.insecure.org/nmap/data/nmap.xsl\fR. This tells a browser to load the latest version of the stylesheet from Insecure.Org. The
\fB\-\-stylesheet http://insecure.org/nmap/data/nmap.xsl\fR. This tells a browser to load the latest version of the stylesheet from Insecure.Org. The
\fB\-\-webxml\fR
option does the same thing with less typing and memorization. Loading the XSL from Insecure.Org makes it easier to view results on a machine that doesn't have Nmap (and thus
\fInmap.xsl\fR) installed. So the URL is often more useful, but the local filesystem location of nmap.xsl is used by default for privacy reasons.
.TP
\fB\-\-webxml\fR (Load stylesheet from Insecure.Org)
This convenience option is simply an alias for
\fB\-\-stylesheet http://www.insecure.org/nmap/data/nmap.xsl\fR.
\fB\-\-stylesheet http://insecure.org/nmap/data/nmap.xsl\fR.
.TP
\fB\-\-no_stylesheet\fR (Omit XSL stylesheet declaration from XML)
Specify this option to prevent Nmap from associating any XSL stylesheet with its XML output. The
@@ -1347,22 +1347,22 @@ This scans 4096 IPs for any webservers (without pinging them) and saves the outp
.SH "BUGS"
.PP
Like its author, Nmap isn't perfect. But you can help make it better by sending bug reports or even writing patches. If Nmap doesn't behave the way you expect, first upgrade to the latest version available from
\fI\%http://www.insecure.org/nmap/\fR. If the problem persists, do some research to determine whether it has already been discovered and addressed. Try Googling the error message or browsing the Nmap\-dev archives at
\fI\%http://insecure.org/nmap/\fR. If the problem persists, do some research to determine whether it has already been discovered and addressed. Try Googling the error message or browsing the Nmap\-dev archives at
\fI\%http://seclists.org/\fR. Read this full munaual page as well. If nothing comes of this, mail a bug report to
<nmap\-dev@insecure.org>. Please include everything you have learned about the problem, as well as what version of Nmap you are running and what operating system version it is running on. Problem reports and Nmap usage questions sent to nmap\-dev@insecure.org are far more likely to be answered than those sent to Fyodor directly.
.PP
Code patches to fix bugs are even better than bug reports. Basic instructions for creating patch files with your changes are available at
\fI\%http://www.insecure.org/nmap/data/HACKING\fR. Patches may be sent to nmap\-dev (recommended) or to Fyodor directly.
\fI\%http://insecure.org/nmap/data/HACKING\fR. Patches may be sent to nmap\-dev (recommended) or to Fyodor directly.
.SH "AUTHOR"
.PP
Fyodor
<fyodor@insecure.org>
(\fI\%http://www.insecure.org\fR)
(\fI\%http://insecure.org\fR)
.PP
Hundreds of people have made valuable contributions to Nmap over the years. These are detailed in the
\fICHANGELOG\fR
file which is distributed with Nmap and also available from
\fI\%http://www.insecure.org/nmap/changelog.html\fR.
\fI\%http://insecure.org/nmap/changelog.html\fR.
.SH "LEGAL NOTICES"
.SS "Nmap Copyright and Licensing"
.PP
@@ -1395,7 +1395,7 @@ Links to a library or executes a program that does any of the above.
The term
\(lqNmap\(rq
should be taken to also include any portions or derived works of Nmap. This list is not exclusive, but is just meant to clarify our interpretation of derived works with some common examples. These restrictions only apply when you actually redistribute Nmap. For example, nothing stops you from writing and selling a proprietary front\-end to Nmap. Just distribute it by itself, and point people to
\fI\%http://www.insecure.org/nmap/\fR
\fI\%http://insecure.org/nmap/\fR
to download Nmap.
.PP
We don't consider these to be added restrictions on top of the GPL, but just a clarification of how we interpret