INB COMPUTERS "Honestidad, calidad y profesionalismo"
POSTED ON: 3 enero, 2020. ACTUALIZADO EN: 17 mayo, 2026.
TIPO: Linux
LICENCIA: Free
TEST DE PUERTOS: NMAP
DESCARGA: https://nmap.org/download.html
INSTALACIÓN: https://nmap.org/book/install.html
Nmap es una herramienta para realizar descubrimiento de redes y auditorias de seguridad. Nmap utiliza paquetes IP en bruto de maneras peculiares para determinar cuales hosts están disponibles en la red, cuales servicios ofrecen estos hosts, cuales sistemas operativos ejecutan, cual tipo de filtro de paquetes o firewall utilizan, y docenas de otras características. Nmap está diseñado para escanear rápidamente grandes redes, pero también funciona bien con pocos hosts. Es una herramienta indispensable para realizar pruebas de penetración y hacking ético.
Este programa a parte de ser un eficaz buscador de vulnerabilidades en la seguridad ha salido en numerosas películas como "Matrix Reloaded".
Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).
Nmap was named “Security Product of the Year” by Linux Journal, Info World, LinuxQuestions.Org, and Codetalker Digest. It was even featured in twelve movies, including The Matrix Reloaded, Die Hard 4, Girl With the Dragon Tattoo, and The Bourne Ultimatum.
Nmap is ...
Flexible: Supports dozens of advanced techniques for mapping out networks filled with IP filters, firewalls, routers, and other obstacles. This includes many port scanning mechanisms (both TCP & UDP), OS detection, version detection, ping sweeps, and more. See the documentation page.
Powerful: Nmap has been used to scan huge networks of literally hundreds of thousands of machines.
Portable: Most operating systems are supported, including Linux, Microsoft Windows, FreeBSD, OpenBSD, Solaris, IRIX, Mac OS X, HP-UX, NetBSD, Sun OS, Amiga, and more.
Easy: While Nmap offers a rich set of advanced features for power users, you can start out as simply as "nmap -v -A targethost". Both traditional command line and graphical (GUI) versions are available to suit your preference. Binaries are available for those who do not wish to compile Nmap from source.
Free: The primary goals of the Nmap Project is to help make the Internet a little more secure and to provide administrators/auditors/hackers with an advanced tool for exploring their networks. Nmap is available for free download, and also comes with full source code that you may modify and redistribute under the terms of the license.
Well Documented: Significant effort has been put into comprehensive and up-to-date man pages, whitepapers, tutorials, and even a whole book! Find them in multiple languages here.
Supported: While Nmap comes with no warranty, it is well supported by a vibrant community of developers and users. Most of this interaction occurs on the Nmap mailing lists. Most bug reports and questions should be sent to the nmap-dev list, but only after you read the guidelines. We recommend that all users subscribe to the low-traffic nmap-hackers announcement list. You can also find Nmap on Facebook and Twitter. For real-time chat, join the #nmap channel on Freenode or EFNet.
Acclaimed: Nmap has won numerous awards, including "Information Security Product of the Year" by Linux Journal, Info World and Codetalker Digest. It has been featured in hundreds of magazine articles, several movies, dozens of books, and one comic book series. Visit the press page for further details.
Popular: Thousands of people download Nmap every day, and it is included with many operating systems (Redhat Linux, Debian Linux, Gentoo, FreeBSD, OpenBSD, etc). It is among the top ten (out of 30,000) programs at the Freshmeat.Net repository. This is important because it lends Nmap its vibrant development and user support communities.
1.1 Descubrimiento de hosts activos
nmap -sn 192.168.1.0/24
Detectar qué hosts están activos en la red. No realiza escaneo de puertos.
1.2 Escaneo de puertos por defecto
nmap 192.168.1.101
Escanea los 1000 puertos por TCP por defecto más comunes
1.3 Escaneo de puertos específicos
nmap -p 22,80,443 192.168.1.101
Permite especificar puertos de interés. Ideal para análisis dirigido cuando se conocen vectores potenciales.
1.4 Escaneo de rango de puertos
nmap -p 1-1000 192.168.1.101
Escanea un rango más amplio, útil para detectar servicios menos comunes u ocultos.
2.1 Detección de servicios y versiones
nmap -sV 192.168.1.101
Nmap intenta identificar el software y versión que está corriendo en cada puerto abierto. Fundamental para análisis de vulnerabilidades.
2.2 Detección del sistema operativo
nmap -O 192.168.1.101
Realiza fingerprinting del sistema operativo mediante técnicas pasivas y activas. Apoya en la planificación de exploits.
3.1 Escaneo combinado y detallado
nmap -A 192.168.1.101
Combina detección de sistema operativo, versiones, traceroute y scripts de detección. Muy útil en fases avanzadas de reconocimiento, aunque más invasivo.
3.2 Escaneo con mayor sigilo (Stealth scan)
nmap -sS 192.168.1.101
Escaneo SYN (half-open), diseñado para evitar ser detectado fácilmente por firewalls o IDS.
4.1 Escaneo y descarga a un archivo XML
sudo nmap -A -T4 -v -Pn -oX <output_file>.xml <target>
por ejemplo:
sudo nmap -A -T4 -v -Pn -oX /root/output.xml 192.168.1.0/24
4.1.1 Directorio con el comando
pwd
4.1.2 Identificación de vulnerabilidades a través del script en Nmap
sudo nmap -A -T4 -v -Pn --script=vuln -oX <output_file>.xml <target>
4.2 Abrir una terminal o consola de Metasploit.
db_import <output_file>.xml
Por ejemplo
db_import output.xml
4.3 Verificar la base de datos en Metasploit
hosts
4.4 Verificar la base de datos en Metasploit
services <target>
vulns
vulns <target>
Por ejemplo>
services 192.168.1.101
Nmap Fundamentals
Listing open ports on a remote host nmap [target]
Exclude a host from scan nmap --exclude [excluded ip] [target]
Use custom DNS Server nmap --dns-servers [DNS1],[DNS2] [target]
Scan - no ping targets nmap -PN [target]
Scan - no DNS resolve nmap -n [target]
Scan specific port nmap -p80 [target]
Scan an IPv6 target nmap -6 [target]
Scanning Port Ranges
Scan specific port list nmap -p 80,443,23 [target]
Scan specific port range nmap -p 1-100 [target]
Scan all ports nmap -p- [target]
Scan specific ports by protocol nmap -p T:25,U:53 [target]
Scan by Service name nmap -p smtp [target]
Scan Service name wildcards nmap -p smtp* [target]
Scan only port registered in Nmap services nmap -p [1- 65535] [target]
By RomelSan (RomelSan) (13 marzo, 2017). https://cheatography.com/romelsan/cheat-sheets/nmap-basics/pdf/
Select Interface to make scans
nmap -e [INTERFACE] [target]
Save as text file (export)
nmap -oN [filename] [target]
Save as xml (export)
nmap -oX [filename] [target]
Save as all supported file types
nmap -oA [filename] [target]
Periodically display statistics
nmap –stats-every [time] [target]
Escaneo de puertos:
Detección de sistemas:
Detección de servicios:
Mapeo de redes:
Pruebas de seguridad:
Monitorización:
Open: Puertos abiertos TCP o UDP.
Closed: Puerto cerrado pero es accesible porque responde a Nmap, para el pentesting es importante anotarlo por si mas tarde ponen un servicio.
Filtered: Detrás de un firewall
Open| Filtered: Nos ayuda si este puerto está detrás de un firewall.
Closed | Filtered: No se sabe si esta cerrado o filtrado. Solo se usa en el IP Idle Scan. https://nmap.org/book/idlescan.html
Curso Free nmap
Nmap es una herramienta para realizar descubrimiento de redes y auditorias de seguridad. Nmap utiliza paquetes IP en bruto de maneras peculiares para determinar cuales hosts están disponibles en la red, cuales servicios ofrecen estos hosts, cuales sistemas operativos ejecutan, cual tipo de filtro de paquetes o firewall utilizan, y docenas de otras características. Nmap está diseñado para escanear rápidamente grandes redes, pero también funciona bien con pocos hosts. Es una herramienta indispensable para realizar pruebas de penetración y hacking ético.
Video teórico respecto a NMAP, Zenamp interfaz GUI.
Sitio oficial de nmap: https://nmap.org/ Enlace para NSE: https://nmap.org/book/nse.html Enlace para Firewalk: https://nmap.org/nsedoc/scripts/firew...