{"id":982,"date":"2023-06-09T17:54:25","date_gmt":"2023-06-09T20:54:25","guid":{"rendered":"https:\/\/www.rdwd.com.br\/blog\/?p=982"},"modified":"2023-06-09T17:54:25","modified_gmt":"2023-06-09T20:54:25","slug":"nmap-30-exemplos-de-comandos-para-administradores-de-rede","status":"publish","type":"post","link":"https:\/\/www.rdwd.com.br\/blog\/nmap-30-exemplos-de-comandos-para-administradores-de-rede\/","title":{"rendered":"Nmap: 30 exemplos de comandos para administradores de rede"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">O que \u00e9 o Nmap?<\/h1>\n\n\n\n<p>\u00c9 uma ferramenta de seguran\u00e7a de c\u00f3digo aberto para explora\u00e7\u00e3o de rede, varredura de seguran\u00e7a e auditoria. No entanto, o nmap \u00a0vem com muitas op\u00e7\u00f5es que podem tornar o utilit\u00e1rio mais robusto e dif\u00edcil de seguir para novos usu\u00e1rios.<\/p>\n\n\n\n<p>O objetivo deste post \u00e9 a introdu\u00e7\u00e3o de um usu\u00e1rio para a ferramenta de linha de comando nmap para escanear um host e\/ou rede, de modo a descobrir os poss\u00edveis pontos vulner\u00e1veis das maquinas. Voc\u00ea tamb\u00e9m vai aprender a usar o Nmap para fins ofensivos e defensivos.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img fetchpriority=\"high\" decoding=\"async\" src=\"https:\/\/www.rdwd.com.br\/blog\/wp-content\/uploads\/2023\/06\/nmap1.webp\" alt=\"\" class=\"wp-image-983\" width=\"837\" height=\"622\" title=\"Nmap Tutorial \/ Examples PDF Download\" srcset=\"https:\/\/www.rdwd.com.br\/blog\/wp-content\/uploads\/2023\/06\/nmap1.webp 593w, https:\/\/www.rdwd.com.br\/blog\/wp-content\/uploads\/2023\/06\/nmap1-300x223.webp 300w\" sizes=\"(max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 984px) 61vw, (max-width: 1362px) 45vw, 600px\" \/><\/figure>\n\n\n\n<p>Configura\u00e7\u00e3o de exemplo (LAB)<\/p>\n\n\n\n<p>Varredura de portas pode ser ilegal em algumas pa\u00edses. Assim \u00e9 mais pratico configurar um laborat\u00f3rio como o exemplo abaixo:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">                              +---------+\n        +---------+           | Network |         +--------+\n        | server1 |-----------+ swtich  +---------|server2 |\n        +---------+           | (sw0)   |         +--------+\n                              +----+----+\n                                   |\n                                   |\n                         +---------+----------+\n                         | wks01 Linux\/OSX    |\n                         +--------------------+<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#1: Scan de um host ou um endere\u00e7o (IPv4)<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">### Scan em um \u00fanico endere\u00e7o ###\nnmap 192.168.1.1\n\n## Scan em um host pelo nome ###\nnmap server1.cyberciti.biz\n\n## Scan em um host pelo nome e obtendo mais informa\u00e7\u00f5es ###\nnmap -v server1.cyberciti.biz<\/pre>\n\n\n\n<p>Exemplos de sa\u00edda:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><a href=\"https:\/\/www.rdwd.com.br\/blog\/wp-content\/uploads\/2023\/06\/NMAP2.webp\"><img decoding=\"async\" src=\"https:\/\/www.rdwd.com.br\/blog\/wp-content\/uploads\/2023\/06\/NMAP2.webp\" alt=\"\" class=\"wp-image-985\" width=\"836\" height=\"249\" srcset=\"https:\/\/www.rdwd.com.br\/blog\/wp-content\/uploads\/2023\/06\/NMAP2.webp 592w, https:\/\/www.rdwd.com.br\/blog\/wp-content\/uploads\/2023\/06\/NMAP2-300x89.webp 300w\" sizes=\"(max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 984px) 61vw, (max-width: 1362px) 45vw, 600px\" \/><\/a><\/figure>\n\n\n\n<p><a href=\"http:\/\/www.cyberciti.biz\/faq\/howto-install-nmap-on-centos-rhel-redhat-enterprise-linux\/\"><\/a>Fig.01: nmap output<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">#2: Scan m\u00faltiplos endere\u00e7os ou sub-redes (IPv4)<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap 192.168.1.1 192.168.1.2 192.168.1.3<\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\">## Scan na mesma sub-rede i.e. 192.168.1.0\/24<\/pre>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap 192.168.1.1,2,3<\/pre>\n\n\n\n<p>Scan no range de endere\u00e7os:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap 192.168.1.1-20<\/pre>\n\n\n\n<p>Scan usando caracteres coringas:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap 192.168.1.*<\/pre>\n\n\n\n<p>Scan em uma sub-rede inteira:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap 192.168.1.0\/24<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#3: Lendo uma lista de redes ou hosts em um arquivo (IPv4)<\/h2>\n\n\n\n<p>\u00c9 poss\u00edvel fazer um scan utilizando uma lista com endere\u00e7os de hosts ou redes, isso \u00e9 ultil quando precisamos scannear uma rede muito grande ou varios hosts, para isso crie um arquivo de acordo com o padr\u00e3o abaixo:<br><code>cat &gt; \/tmp\/test.txt<\/code><\/p>\n\n\n\n<p>Exemplo de sa\u00edda:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">server1.cyberciti.biz\n192.168.1.0\/24\n192.168.1.1\/24\n10.1.2.3\nlocalhost<\/pre>\n\n\n\n<p>Fazendo o scan:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -iL \/tmp\/test.txt<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#4: Excluindo hosts ou sub-redes (IPv4)<\/h2>\n\n\n\n<p>Ao fazer um scan em uma grande sub-rede voc\u00ea pode excluir um ou v\u00e1rios hosts.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap 192.168.1.0\/24 --exclude 192.168.1.5\nnmap 192.168.1.0\/24 --exclude 192.168.1.5,192.168.1.254<\/pre>\n\n\n\n<p>Ou excluir em uma lista \/tmp\/exclude.txt<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -iL \/tmp\/scanlist.txt --excludefile \/tmp\/exclude.txt<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#5: Detectando o vers\u00e3o do sistema operacional (IPv4)<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -A 192.168.1.254\nnmap -v -A 192.168.1.1\nnmap -A -iL \/tmp\/scanlist.txt<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#6: Descubra se o alvo \u00e9 protegido por um firewall<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -sA 192.168.1.254\nnmap -sA server1.cyberciti.biz<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#7: Scan quando o host \u00e9 protegido por um firewall<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -PN 192.168.1.1\nnmap -PN server1.cyberciti.biz<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#8: Scan em rede IPv6<\/h2>\n\n\n\n<p>A op\u00e7\u00e3o -6 ativa a op\u00e7\u00e3o de ipv6 a sua sintaxe \u00e9:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -6 IPv6-Address-Here\nnmap -6 server1.cyberciti.biz\nnmap -6 2607:f0d0:1002:51::4\nnmap -v A -6 2607:f0d0:1002:51::4<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#9: Scan para descobrir quais servidores e dispositivos est\u00e3o funcionando<\/h2>\n\n\n\n<p>nmap -sP 192.168.1.0\/24<\/p>\n\n\n\n<p>Exemplo de sa\u00edda:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Host 192.168.1.1 is up (0.00035s latency).\nMAC Address: BC:AE:C5:C3:16:93 (Unknown)\nHost 192.168.1.2 is up (0.0038s latency).\nMAC Address: 74:44:01:40:57:FB (Unknown)\nHost 192.168.1.5 is up.\nHost nas03 (192.168.1.12) is up (0.0091s latency).\nMAC Address: 00:11:32:11:15:FC (Synology Incorporated)\nNmap done: 256 IP addresses (4 hosts up) scanned in 2.80 second<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#10: Executa uma verifica\u00e7\u00e3o r\u00e1pida<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -F 192.168.1.1<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#11: Mostra a raz\u00e3o da porta estar em determinado estado<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap --reason 192.168.1.1\nnmap --reason server1.cyberciti.biz<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#12: Mostra apenas portas abertas (ou possivelmente abertas)<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap --open 192.168.1.1\nnmap --open server1.cyberciti.biz<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#13: Mostra todos os pacotes enviados e recebidos<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap --packet-trace 192.168.1.1\nnmap --packet-trace server1.cyberciti.biz<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">14#: Mostra interface e rotas dos hosts<\/h2>\n\n\n\n<p>Isso \u00e9 \u00fatil para detec\u00e7\u00e3o de problemas na rede<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap --iflist<\/pre>\n\n\n\n<p>Exemplo de sa\u00edda:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Starting Nmap 5.00 ( http:\/\/nmap.org ) at 2012-11-27 02:01 IST\n************************INTERFACES************************\nDEV    (SHORT)  IP\/MASK          TYPE        UP MAC\nlo     (lo)     127.0.0.1\/8      loopback    up\neth0   (eth0)   192.168.1.5\/24   ethernet    up B8:AC:6F:65:31:E5\nvmnet1 (vmnet1) 192.168.121.1\/24 ethernet    up 00:50:56:C0:00:01\nvmnet8 (vmnet8) 192.168.179.1\/24 ethernet    up 00:50:56:C0:00:08\nppp0   (ppp0)   10.1.19.69\/32    point2point up\n\n**************************ROUTES**************************\nDST\/MASK         DEV    GATEWAY\n10.0.31.178\/32   ppp0\n209.133.67.35\/32 eth0   192.168.1.2\n192.168.1.0\/0    eth0\n192.168.121.0\/0  vmnet1\n192.168.179.0\/0  vmnet8\n169.254.0.0\/0    eth0\n10.0.0.0\/0       ppp0\n0.0.0.0\/0        eth0   192.168.1.2<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#15: Especificar uma porta<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">map -p [port] hostName\n## Scan na porta 80\nnmap -p 80 192.168.1.1\n\n## Scan TCP na porta 80\nnmap -p T:80 192.168.1.1\n\n## Scan UDP na porta 53\nnmap -p U:53 192.168.1.1\n\n## Scan two nas portas ##\nnmap -p 80,443 192.168.1.1\n\n## Scan port ranges ##\nnmap -p 80-200 192.168.1.1\n\n## Combinar v\u00e1rias op\u00e7\u00f5es ##\nnmap -p U:53,111,137,T:21-25,80,139,8080 192.168.1.1\nnmap -p U:53,111,137,T:21-25,80,139,8080 server1.cyberciti.biz\nnmap -v -sU -sT -p U:53,111,137,T:21-25,80,139,8080 192.168.1.254\n\n## Scan todas as portas usando coringas ##\nnmap -p \"*\" 192.168.1.1\n\n## Scan de portas mais comuns ##\nnmap --top-ports 5 192.168.1.1\nnmap --top-ports 10 192.168.1.1<\/pre>\n\n\n\n<p>Exemplo de sa\u00edda:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Starting Nmap 5.00 ( http:\/\/nmap.org ) at 2012-11-27 01:23 IST\nInteresting ports on 192.168.1.1:\nPORT     STATE  SERVICE\n21\/tcp   closed ftp\n22\/tcp   open   ssh\n23\/tcp   closed telnet\n25\/tcp   closed smtp\n80\/tcp   open   http\n110\/tcp  closed pop3\n139\/tcp  closed netbios-ssn\n443\/tcp  closed https\n445\/tcp  closed microsoft-ds\n3389\/tcp closed ms-term-serv\nMAC Address: BC:AE:C5:C3:16:93 (Unknown)\n\nNmap done: 1 IP address (1 host up) scanned in 0.51 seconds<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#16: A maneira mais r\u00e1pida de descobrir todas as portas e computadores em uma rede<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -T5 192.168.1.0\/24<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#17: Detectando um sistema operacional remoto&nbsp;<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -O 192.168.1.1\nnmap -O  --osscan-guess 192.168.1.1\nnmap -v -O --osscan-guess 192.168.1.1<\/pre>\n\n\n\n<p>Exemplo de sa\u00edda:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Starting Nmap 5.00 ( http:\/\/nmap.org ) at 2012-11-27 01:29 IST\nNSE: Loaded 0 scripts for scanning.\nInitiating ARP Ping Scan at 01:29\nScanning 192.168.1.1 [1 port]\nCompleted ARP Ping Scan at 01:29, 0.01s elapsed (1 total hosts)\nInitiating Parallel DNS resolution of 1 host. at 01:29\nCompleted Parallel DNS resolution of 1 host. at 01:29, 0.22s elapsed\nInitiating SYN Stealth Scan at 01:29\nScanning 192.168.1.1 [1000 ports]\nDiscovered open port 80\/tcp on 192.168.1.1\nDiscovered open port 22\/tcp on 192.168.1.1\nCompleted SYN Stealth Scan at 01:29, 0.16s elapsed (1000 total ports)\nInitiating OS detection (try #1) against 192.168.1.1\nRetrying OS detection (try #2) against 192.168.1.1\nRetrying OS detection (try #3) against 192.168.1.1\nRetrying OS detection (try #4) against 192.168.1.1\nRetrying OS detection (try #5) against 192.168.1.1\nHost 192.168.1.1 is up (0.00049s latency).\nInteresting ports on 192.168.1.1:\nNot shown: 998 closed ports\nPORT   STATE SERVICE\n22\/tcp open  ssh\n80\/tcp open  http\nMAC Address: BC:AE:C5:C3:16:93 (Unknown)\nDevice type: WAP|general purpose|router|printer|broadband router\nRunning (JUST GUESSING) : Linksys Linux 2.4.X (95%), Linux 2.4.X|2.6.X (94%), MikroTik RouterOS 3.X (92%), Lexmark embedded (90%), Enterasys embedded (89%), D-Link Linux 2.4.X (89%), Netgear Linux 2.4.X (89%)\nAggressive OS guesses: OpenWrt White Russian 0.9 (Linux 2.4.30) (95%), OpenWrt 0.9 - 7.09 (Linux 2.4.30 - 2.4.34) (94%), OpenWrt Kamikaze 7.09 (Linux 2.6.22) (94%), Linux 2.4.21 - 2.4.31 (likely embedded) (92%), Linux 2.6.15 - 2.6.23 (embedded) (92%), Linux 2.6.15 - 2.6.24 (92%), MikroTik RouterOS 3.0beta5 (92%), MikroTik RouterOS 3.17 (92%), Linux 2.6.24 (91%), Linux 2.6.22 (90%)\nNo exact OS matches for host (If you know what OS is running on it, see http:\/\/nmap.org\/submit\/ ).\nTCP\/IP fingerprint:\nOS:SCAN(V=5.00%D=11\/27%OT=22%CT=1%CU=30609%PV=Y%DS=1%G=Y%M=BCAEC5%TM=50B3CA\nOS:4B%P=x86_64-unknown-linux-gnu)SEQ(SP=C8%GCD=1%ISR=CB%TI=Z%CI=Z%II=I%TS=7\nOS:)OPS(O1=M2300ST11NW2%O2=M2300ST11NW2%O3=M2300NNT11NW2%O4=M2300ST11NW2%O5\nOS:=M2300ST11NW2%O6=M2300ST11)WIN(W1=45E8%W2=45E8%W3=45E8%W4=45E8%W5=45E8%W\nOS:6=45E8)ECN(R=Y%DF=Y%T=40%W=4600%O=M2300NNSNW2%CC=N%Q=)T1(R=Y%DF=Y%T=40%S\nOS:=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%R\nOS:D=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=\nOS:0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=N)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID\nOS:=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)\nUptime guess: 12.990 days (since Wed Nov 14 01:44:40 2012)\nNetwork Distance: 1 hop\nTCP Sequence Prediction: Difficulty=200 (Good luck!)\nIP ID Sequence Generation: All zeros\nRead data files from: \/usr\/share\/nmap\nOS detection performed. Please report any incorrect results at http:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 12.38 seconds\n           Raw packets sent: 1126 (53.832KB) | Rcvd: 1066 (46.100KB)<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#18: Detectando servi\u00e7os remotos e sua vers\u00e3o<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -sV 192.168.1.1<\/pre>\n\n\n\n<p>Exemplo de sa\u00edda:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Starting Nmap 5.00 ( http:\/\/nmap.org ) at 2012-11-27 01:34 IST\nInteresting ports on 192.168.1.1:\nNot shown: 998 closed ports\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     <strong>Dropbear sshd 0.52 (protocol 2.0)<\/strong>\n80\/tcp open  http?\n1 service unrecognized despite returning data.<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#19: Scan de host usando TCP ACK (PA) e TCP Syn (PS) ping<\/h2>\n\n\n\n<p>Caso o firewall esteja bloqueando os pings tente os seguintes comandos:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -PS 192.168.1.1\nnmap -PS 80,21,443 192.168.1.1\nnmap -PA 192.168.1.1\nnmap -PA 80,21,200-512 192.168.1.1<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#20: Scan em host usando ping<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -PO 192.168.1.1<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#21: Scan a host usando UDP ping<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -PU 192.168.1.1\nnmap -PU 2000.2001 192.168.1.1<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#22: Descubra as portas mais utilizadas usando TCP SYN<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">&nbsp;\n### scan ###\nnmap -sS 192.168.1.1\n\n### Portas mais utilizadas utilizando TCP connect\nnmap -sT 192.168.1.1\n\n### Portas mais usadas utilizando TCP ACK\nnmap -sA 192.168.1.1\n\n### Portas mais usadas utilizando TCP window\nnmap -sW 192.168.1.1\n\n### Portas mais usadas utilizando TCP Maimon\nnmap -sM 192.168.1.1<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#23: Scan de host utilizando servi\u00e7os UDP&nbsp;(UDP scan)<\/h2>\n\n\n\n<p>Servi\u00e7os mais comuns utilizando protocolo UDP<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -sU nas03\nnmap -sU 192.168.1.1<\/pre>\n\n\n\n<p>Exemplo de sa\u00edda:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">&nbsp;\nStarting Nmap 5.00 ( http:\/\/nmap.org ) at 2012-11-27 00:52 IST\nStats: 0:05:29 elapsed; 0 hosts completed (1 up), 1 undergoing UDP Scan\nUDP Scan Timing: About 32.49% done; ETC: 01:09 (0:11:26 remaining)\nInteresting ports on nas03 (192.168.1.12):\nNot shown: 995 closed ports\nPORT     STATE         SERVICE\n111\/udp  open|filtered rpcbind\n123\/udp  open|filtered ntp\n161\/udp  open|filtered snmp\n2049\/udp open|filtered nfs\n5353\/udp open|filtered zeroconf\nMAC Address: 00:11:32:11:15:FC (Synology Incorporated)\n\nNmap done: 1 IP address (1 host up) scanned in 1099.55 seconds<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#24: Scan pelo protocolo IP<\/h2>\n\n\n\n<p>Este tipo de scan voc\u00ea pode determinar qual o tipo de protocolo ip deseja (TCP, ICMP, IGMP, etc.)<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -sO 192.168.1.1<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#25: Scan de firewall com falha de seguran\u00e7a<\/h2>\n\n\n\n<p>Os seguintes tipos de verifica\u00e7\u00e3o explorar uma brecha sutil no TCP, \u00e9 bom para testar a seguran\u00e7a de ataques comuns:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">&nbsp;\n## TCP Null engana o firewall para obter uma resposta ##\nnmap -sN 192.168.1.254\n\n## TCP Fin varredura no firewall ##\n\nnmap -sF 192.168.1.254\n\n## TCP Xmas varredura no firewall ##<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#26: Scan de firewall com fragmentos de pacotes<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -f 192.168.1.1\nnmap -f fw2.nixcraft.net.in\nnmap -f 15 fw2.nixcraft.net.in\n## Set your own offset size with the --mtu option ##\nnmap --mtu 32 192.168.1.1<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#27: Scan decoys (camufla o ip)<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap -n -Ddecoy-ip1,decoy-ip2,your-own-ip,decoy-ip3,decoy-ip4 remote-host-ip\nnmap -n -D192.168.1.5,10.5.1.2,172.1.2.4,3.4.2.1 192.168.1.5<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#28: Scan de firewall com MAC spoofing<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">&nbsp;\n### Spoof de MAC address ##\nnmap --spoof-mac MAC-ADDRESS-HERE 192.168.1.1\n\n### Adiciona outras op\u00e7\u00f5es ###\nnmap -v -sT -PN --spoof-mac MAC-ADDRESS-HERE 192.168.1.1\n\n### Use um MAC rand\u00f4mico ###\n### O n\u00famero 0 faz com que o nmap escolha aleatoriamente ###\nnmap -v -sT -PN --spoof-mac 0 192.168.1.1<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#29: Salvando a sa\u00edda em um arquivo de texto<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">nmap 192.168.1.1 &gt; output.txt\nnmap -oN \/path\/to\/filename 192.168.1.1\nnmap -oN output.txt 192.168.1.1<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">#30: Instalando nmap em modo gr\u00e1fico?<\/h2>\n\n\n\n<p>Instalando utilizando o comando apt-get:<\/p>\n\n\n\n<p><code>$ sudo apt-get install zenmap<\/code><\/p>\n\n\n\n<p>Exemplo da sa\u00edda:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">[sudo] password for vivek:\nReading package lists... Done\nBuilding dependency tree\nReading state information... Done\nThe following NEW packages will be installed:\n  zenmap\n0 upgraded, 1 newly installed, 0 to remove and 11 not upgraded.\nNeed to get 616 kB of archives.\nAfter this operation, 1,827 kB of additional disk space will be used.\nGet:1 http:\/\/debian.osuosl.org\/debian\/ squeeze\/main zenmap amd64 5.00-3 [616 kB]\nFetched 616 kB in 3s (199 kB\/s)\nSelecting previously deselected package zenmap.\n(Reading database ... 281105 files and directories currently installed.)\nUnpacking zenmap (from ...\/zenmap_5.00-3_amd64.deb) ...\nProcessing triggers for desktop-file-utils ...\nProcessing triggers for gnome-menus ...\nProcessing triggers for man-db ...\nSetting up zenmap (5.00-3) ...\nProcessing triggers for python-central ...<\/pre>\n\n\n\n<p>Inicializando o nmap em modo gr\u00e1fico:<\/p>\n\n\n\n<p><code>$ sudo zenmap<\/code><\/p>\n\n\n\n<p>Nmap em modo gr\u00e1fico:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/www.rdwd.com.br\/blog\/wp-content\/uploads\/2023\/06\/NMAP3.webp\" alt=\"\" class=\"wp-image-984\" width=\"836\" height=\"904\" title=\"Nmap Command GUI Usage Examples Output From zenmap\" srcset=\"https:\/\/www.rdwd.com.br\/blog\/wp-content\/uploads\/2023\/06\/NMAP3.webp 592w, https:\/\/www.rdwd.com.br\/blog\/wp-content\/uploads\/2023\/06\/NMAP3-278x300.webp 278w\" sizes=\"(max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 984px) 61vw, (max-width: 1362px) 45vw, 600px\" \/><\/figure>\n\n\n\n<p>Artigo original: <a href=\"http:\/\/www.cyberciti.biz\/networking\/nmap-command-examples-tutorials\/\" target=\"_blank\" rel=\"noreferrer noopener\">www.cyberciti.biz<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>O que \u00e9 o Nmap? \u00c9 uma ferramenta de seguran\u00e7a de c\u00f3digo aberto para explora\u00e7\u00e3o de rede, varredura de seguran\u00e7a e auditoria. No entanto, o nmap \u00a0vem com muitas op\u00e7\u00f5es que podem tornar o utilit\u00e1rio mais robusto e dif\u00edcil de seguir para novos usu\u00e1rios. O objetivo deste post \u00e9 a introdu\u00e7\u00e3o de um usu\u00e1rio para &hellip; <a href=\"https:\/\/www.rdwd.com.br\/blog\/nmap-30-exemplos-de-comandos-para-administradores-de-rede\/\" class=\"more-link\">Continue lendo<span class=\"screen-reader-text\"> &#8220;Nmap: 30 exemplos de comandos para administradores de rede&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-982","post","type-post","status-publish","format-standard","hentry","category-blog"],"a3_pvc":{"activated":false,"total_views":0,"today_views":0},"_links":{"self":[{"href":"https:\/\/www.rdwd.com.br\/blog\/wp-json\/wp\/v2\/posts\/982","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rdwd.com.br\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rdwd.com.br\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rdwd.com.br\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rdwd.com.br\/blog\/wp-json\/wp\/v2\/comments?post=982"}],"version-history":[{"count":1,"href":"https:\/\/www.rdwd.com.br\/blog\/wp-json\/wp\/v2\/posts\/982\/revisions"}],"predecessor-version":[{"id":986,"href":"https:\/\/www.rdwd.com.br\/blog\/wp-json\/wp\/v2\/posts\/982\/revisions\/986"}],"wp:attachment":[{"href":"https:\/\/www.rdwd.com.br\/blog\/wp-json\/wp\/v2\/media?parent=982"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rdwd.com.br\/blog\/wp-json\/wp\/v2\/categories?post=982"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rdwd.com.br\/blog\/wp-json\/wp\/v2\/tags?post=982"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}