Python-nmap 使用文档

绝地灬酷狼 2022-03-11 07:17 442阅读 0赞

### python nmap 使用文档 ###

*   *  前言
     *  安装
     *  用法实例
     *  官方技术文档

## 前言 ##

nmap是一款好用的扫描软件，如果我们想要开发python版本的nmap自动化扫描脚本，python-nmap就可以满足我们的基本需求了

## 安装 ##

pip install python-nmap

注意下面的所有内容均是基于python-nmap，有时候报错比如"AttributeError: module ‘nmap’ has no attribute ‘PortScanner’ Re…" 可能是因为你用的是`pip install nmap`而不是我上面的安装方法，如果是这种情况，可以

pip uninstall nmap
    pip install python-nmap

## 用法实例 ##

>>> import nmap
    >>> nm = nmap.PortScanner()
    >>> nm.scan('127.0.0.1', '22-443')
    >>> nm.command_line()
    'nmap -oX - -p 22-443 -sV 127.0.0.1'
    >>> nm.scaninfo()
    { 'tcp': { 'services': '22-443', 'method': 'connect'}}
    >>> nm.all_hosts()
    ['127.0.0.1']
    >>> nm['127.0.0.1'].hostname()
    'localhost'
    >>> nm['127.0.0.1'].state()
    'up'
    >>> nm['127.0.0.1'].all_protocols()
    ['tcp']
    >>> nm['127.0.0.1']['tcp'].keys()
    [80, 25, 443, 22, 111]
    >>> nm['127.0.0.1'].has_tcp(22)
    True
    >>> nm['127.0.0.1'].has_tcp(23)
    False
    >>> nm['127.0.0.1']['tcp'][22]
    { 'state': 'open', 'reason': 'syn-ack', 'name': 'ssh'}
    >>> nm['127.0.0.1'].tcp(22)
    { 'state': 'open', 'reason': 'syn-ack', 'name': 'ssh'}
    >>> nm['127.0.0.1']['tcp'][22]['state']
    'open'
    
    >>> for host in nm.all_hosts():
    >>>     print('----------------------------------------------------')
    >>>     print('Host : %s (%s)' % (host, nm[host].hostname()))
    >>>     print('State : %s' % nm[host].state())
    >>>     for proto in nm[host].all_protocols():
    >>>         print('----------')
    >>>         print('Protocol : %s' % proto)
    >>> 
    >>>         lport = nm[host][proto].keys()
    >>>         lport.sort()
    >>>         for port in lport:
    >>>             print ('port : %s\tstate : %s' % (port, nm[host][proto][port]['state']))
    ----------------------------------------------------
    Host : 127.0.0.1 (localhost)
    State : up
    ----------
    Protocol : tcp
    port : 22   state : open
    port : 25   state : open
    port : 80   state : open
    port : 111  state : open
    port : 443  state : open
    
    
    >>> print(nm.csv())
    host;protocol;port;name;state;product;extrainfo;reason;version;conf
    127.0.0.1;tcp;22;ssh;open;OpenSSH;protocol 2.0;syn-ack;5.9p1 Debian 5ubuntu1;10
    127.0.0.1;tcp;25;smtp;open;Exim smtpd;;syn-ack;4.76;10
    127.0.0.1;tcp;53;domain;open;dnsmasq;;syn-ack;2.59;10
    127.0.0.1;tcp;80;http;open;Apache httpd;(Ubuntu);syn-ack;2.2.22;10
    127.0.0.1;tcp;111;rpcbind;open;;;syn-ack;;10
    127.0.0.1;tcp;139;netbios-ssn;open;Samba smbd;workgroup: WORKGROUP;syn-ack;3.X;10
    127.0.0.1;tcp;443;;open;;;syn-ack;;
    
    
    >>> nm.scan(hosts='192.168.1.0/24', arguments='-n -sP -PE -PA21,23,80,3389')
    >>> hosts_list = [(x, nm[x]['status']['state']) for x in nm.all_hosts()]
    >>> for host, status in hosts_list:
    >>>     print('{0}:{1}'.host)
    192.168.1.0:down
    192.168.1.1:up
    192.168.1.10:down
    192.168.1.100:down
    192.168.1.101:down
    192.168.1.102:down
    192.168.1.103:down
    192.168.1.104:down
    192.168.1.105:down
    [...]
    
    
    
    >>> nma = nmap.PortScannerAsync()
    >>> def callback_result(host, scan_result):
    >>>     print '------------------'
    >>>     print host, scan_result
    >>> 
    >>> nma.scan(hosts='192.168.1.0/30', arguments='-sP', callback=callback_result)
    >>> while nma.still_scanning():
    >>>     print("Waiting >>>")
    >>>     nma.wait(2)   # you can do whatever you want but I choose to wait after the end of the scan
    >>> 
    192.168.1.1 { 'nmap': { 'scanstats': { 'uphosts': '1', 'timestr': 'Mon Jun 7 11:31:11 2010', 'downhosts': '0', 'totalhosts': '1', 'elapsed': '0.43'}, 'scaninfo': { }, 'command_line': 'nmap -oX - -sP 192.168.1.1'}, 'scan': { '192.168.1.1': { 'status': { 'state': 'up', 'reason': 'arp-response'}, 'hostname': 'neufbox'}}}
    ------------------
    192.168.1.2 { 'nmap': { 'scanstats': { 'uphosts': '0', 'timestr': 'Mon Jun 7 11:31:11 2010', 'downhosts': '1', 'totalhosts': '1', 'elapsed': '0.29'}, 'scaninfo': { }, 'command_line': 'nmap -oX - -sP 192.168.1.2'}, 'scan': { '192.168.1.2': { 'status': { 'state': 'down', 'reason': 'no-response'}, 'hostname': ''}}}
    ------------------
    192.168.1.3 { 'nmap': { 'scanstats': { 'uphosts': '0', 'timestr': 'Mon Jun 7 11:31:11 2010', 'downhosts': '1', 'totalhosts': '1', 'elapsed': '0.29'}, 'scaninfo': { }, 'command_line': 'nmap -oX - -sP 192.168.1.3'}, 'scan': { '192.168.1.3': { 'status': { 'state': 'down', 'reason': 'no-response'}, 'hostname': ''}}}
    
    >>> nm = nmap.PortScannerYield()
    >>> for progressive_result in nm.scan('127.0.0.1/24', '22-25'):
    >>>     print(progressive\_result)

## 官方技术文档 ##

===========
    python-nmap
    ===========
    
    python-nmap is a python library which helps in using nmap port scanner.
    It allows to easilly manipulate nmap scan results and will be a perfect
    tool for systems administrators who want to automatize scanning task
    and reports. It also supports nmap script outputs.
    
    Typical usage looks like::
    
    #!/usr/bin/env python
    import nmap # import nmap.py module
    nm = nmap.PortScanner() # instantiate nmap.PortScanner object
    nm.scan('127.0.0.1', '22-443') # scan host 127.0.0.1, ports from 22 to 443
    nm.command_line() # get command line used for the scan : nmap -oX - -p 22-443 127.0.0.1
    nm.scaninfo() # get nmap scan informations {'tcp': {'services': '22-443', 'method': 'connect'}}
    nm.all_hosts() # get all hosts that were scanned
    nm['127.0.0.1'].hostname() # get one hostname for host 127.0.0.1, usualy the user record
    nm['127.0.0.1'].hostnames() # get list of hostnames for host 127.0.0.1 as a list of dict
    # [{'name':'hostname1', 'type':'PTR'}, {'name':'hostname2', 'type':'user'}]
    nm['127.0.0.1'].hostname() # get hostname for host 127.0.0.1
    nm['127.0.0.1'].state() # get state of host 127.0.0.1 (up|down|unknown|skipped)
    nm['127.0.0.1'].all_protocols() # get all scanned protocols ['tcp', 'udp'] in (ip|tcp|udp|sctp)
    nm['127.0.0.1']['tcp'].keys() # get all ports for tcp protocol
    nm['127.0.0.1'].all_tcp() # get all ports for tcp protocol (sorted version)
    nm['127.0.0.1'].all_udp() # get all ports for udp protocol (sorted version)
    nm['127.0.0.1'].all_ip() # get all ports for ip protocol (sorted version)
    nm['127.0.0.1'].all_sctp() # get all ports for sctp protocol (sorted version)
    nm['127.0.0.1'].has_tcp(22) # is there any information for port 22/tcp on host 127.0.0.1
    nm['127.0.0.1']['tcp'][22] # get infos about port 22 in tcp on host 127.0.0.1
    nm['127.0.0.1'].tcp(22) # get infos about port 22 in tcp on host 127.0.0.1
    nm['127.0.0.1']['tcp'][22]['state'] # get state of port 22/tcp on host 127.0.0.1 (open
    
    
    # a more usefull example :
    for host in nm.all_hosts():
    print('----------------------------------------------------')
    print('Host : %s (%s)' % (host, nm[host].hostname()))
    print('State : %s' % nm[host].state())
    
    for proto in nm[host].all_protocols():
    print('----------')
    print('Protocol : %s' % proto)
    
    lport = nm[host][proto].keys()
    lport.sort()
    for port in lport:
    print('port : %s\tstate : %s' % (port, nm[host][proto][port]['state']))
    
    print('----------------------------------------------------')
    # print result as CSV
    print(nm.csv())
    
    
    print('----------------------------------------------------')
    # If you want to do a pingsweep on network 192.168.1.0/24:
    nm.scan(hosts='192.168.1.0/24', arguments='-n -sP -PE -PA21,23,80,3389')
    hosts_list = [(x, nm[x]['status']['state']) for x in nm.all_hosts()]
    for host, status in hosts_list:
    print('{0}:{1}'.format(host, status))
    
    
    print '----------------------------------------------------'
    # Asynchronous usage of PortScannerAsync
    nma = nmap.PortScannerAsync()
    def callback_result(host, scan_result):
    print '------------------'
    print host, scan_result
    nma.scan(hosts='192.168.1.0/30', arguments='-sP', callback=callback_result)
    while nma.still_scanning():
    print("Waiting ...")
    nma.wait(2) # you can do whatever you want but I choose to wait after the end of the scan
    
    
    Homepage
    ========
    
    http://xael.org/norman/python/python-nmap/