Nmap 操作手册

#!/bin/bash
TARGET=$1
if [ -z "$TARGET" ]; then
    echo "Usage: $0 <target>"
    exit 1
fi

echo "[*] Discovering live hosts..."
nmap -sn $TARGET -oG ping.gnmap > /dev/null
grep Up ping.gnmap | cut -d' ' -f2 > live_hosts.txt

for host in $(cat live_hosts.txt); do
    echo "[*] Scanning $host..."
    sudo nmap -sS -sV -O --script=default -oA "scan_$host" $host
done

import nmap

nm = nmap.PortScanner()
target = '192.168.1.0/24'
nm.scan(hosts=target, arguments='-sn')
for host in nm.all_hosts():
    print(f'Host: {host} ({nm[host].state()})')
    nm.scan(hosts=host, arguments='-sV -p 1-1000')
    for proto in nm[host].all_protocols():
        ports = nm[host][proto].keys()
        for port in ports:
            service = nm[host][proto][port]
            print(f'  {port}/{proto}: {service["state"]} {service["name"]} {service.get("version", "")}')

local shortport = require "shortport"
local stdnse = require "stdnse"
local http = require "http"

description = [[
自定义脚本描述
]]
author = "Your Name"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"discovery", "safe"}

portrule = shortport.http

action = function(host, port)
    local response = http.get(host, port, "/")
    if response.status == 200 then
        -- 自定义处理逻辑
        return stdnse.format_output(true, "Found something")
    end
end

nmap -sV -oN version.txt <目标>
grep -E "([0-9]+\.[0-9]+)" version.txt | while read line; do
    service=$(echo $line | awk '{print $3}')
    version=$(echo $line | awk '{print $4}')
    searchsploit "$service $version"
done