在介紹完 Nmap 的各種功能後，今天就用我自己打靶機或練習時常用的指令來做一個簡單的分享，順便把 Nmap 的教學做個收尾。

由於目前為止都是我自己自學來的內容，也許指令有更好的優化空間也說不定，所以也不一定要全盤參考。

靶機常用指令

關於我如果現在重頭開始打一個靶機的話，我能不能夠 ping 到目標或用主機探測 ( -sn ) 來找找看目標，確認完主機在線上後，我會用 -sS 來掃描最常見的 1000 個 Port ( 也就是預設的掃瞄範圍 )，來快速檢查一次看有沒有開啟的 Port ，之後再針對這些 Port 做 -sVC，來看能不能找出比較簡單的突破口。

大概流程就像上面那樣，找到版本後會再利用 searchsploit 或 msfconsole 來找看有沒有公開漏洞利用。

選項

--stats-every

顯示掃描進度。

nmap [IP位址] --stats-every=30s

• --stats-every=30s : 每30秒顯示一次掃描進度

nmap 192.168.31.131 -sVC --stats-every=30s -p-
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-26 11:28 EDT
Stats: 0:00:33 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 96.67% done; ETC: 11:29 (0:00:01 remaining)
Stats: 0:01:01 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 96.67% done; ETC: 11:29 (0:00:02 remaining)

-v verbose

輸出更詳細 ( 掃描過程與背後細節運作 ) 的資訊。

nmap [IP位址] -v

nmap 192.168.31.131 -sV -p 21 -v
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-26 11:32 EDT
NSE: Loaded 47 scripts for scanning.
Initiating ARP Ping Scan at 11:32
Scanning 192.168.31.131 [1 port]
Completed ARP Ping Scan at 11:32, 0.04s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 11:32
Completed Parallel DNS resolution of 1 host. at 11:32, 0.01s elapsed
Initiating SYN Stealth Scan at 11:32
Scanning 192.168.31.131 [1 port]
Discovered open port 21/tcp on 192.168.31.131
Completed SYN Stealth Scan at 11:32, 0.03s elapsed (1 total ports)
Initiating Service scan at 11:32
Scanning 1 service on 192.168.31.131
Completed Service scan at 11:32, 0.00s elapsed (1 service on 1 host)
NSE: Script scanning 192.168.31.131.
Initiating NSE at 11:32
Completed NSE at 11:32, 0.00s elapsed
Initiating NSE at 11:32
Completed NSE at 11:32, 0.00s elapsed
Nmap scan report for 192.168.31.131
Host is up (0.00035s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 2.3.4
MAC Address: 00:0C:29:37:BF:EF (VMware)
Service Info: OS: Unix

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 0.31 seconds
           Raw packets sent: 2 (72B) | Rcvd: 2 (72B)

檔案輸出

將掃描結果輸出成一個檔案來供報告或整理資訊使用，總共有三種格式，

• -oN <file name> : 一般輸出，輸出成 .nmap 格式。
• -oG <file name> : 可以被 grep 的輸出，輸出成 .gnmap 格式。
• -oX <file name> : XML輸出，輸出成 .xml 格式。
• -oA <file name> : 把上述三種一起輸出出來。

使用指令 :

nmap 192.168.31.131 -sV -p 21 -oA scan

產生的檔案 :

nmap 格式 :

# Nmap 7.95 scan initiated Sat Sep 26 11:34:59 2026 as: /usr/lib/nmap/nmap --privileged -sV -p 21 -oA scan 192.168.31.131
Nmap scan report for 192.168.31.131
Host is up (0.00034s latency).

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 2.3.4
MAC Address: 00:0C:29:37:BF:EF (VMware)
Service Info: OS: Unix

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Sep 26 11:35:00 2026 -- 1 IP address (1 host up) scanned in 0.33 seconds

gnmap 格式 :

# Nmap 7.95 scan initiated Sat Sep 26 11:34:59 2026 as: /usr/lib/nmap/nmap --privileged -sV -p 21 -oA scan 192.168.31.131
Host: 192.168.31.131 () Status: Up
Host: 192.168.31.131 () Ports: 21/open/tcp//ftp//vsftpd 2.3.4/
# Nmap done at Sat Sep 26 11:35:00 2026 -- 1 IP address (1 host up) scanned in 0.33 seconds

xml 格式 :

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE nmaprun>
<?xml-stylesheet href="file:///usr/share/nmap/nmap.xsl" type="text/xsl"?>
<!-- Nmap 7.95 scan initiated Sat Sep 26 11:34:59 2026 as: /usr/lib/nmap/nmap -&#45;privileged -sV -p 21 -oA scan 192.168.31.131 -->
<nmaprun scanner="nmap" args="/usr/lib/nmap/nmap -&#45;privileged -sV -p 21 -oA scan 192.168.31.131" start="1790436899" startstr="Sat Sep 26 11:34:59 2026" version="7.95" xmloutputversion="1.05">
<scaninfo type="syn" protocol="tcp" numservices="1" services="21"/>
<verbose level="0"/>
<debugging level="0"/>
<hosthint><status state="up" reason="arp-response" reason_ttl="0"/>
<address addr="192.168.31.131" addrtype="ipv4"/>
<address addr="00:0C:29:37:BF:EF" addrtype="mac" vendor="VMware"/>
<hostnames>
</hostnames>
</hosthint>
<host starttime="1790436900" endtime="1790436900"><status state="up" reason="arp-response" reason_ttl="0"/>
<address addr="192.168.31.131" addrtype="ipv4"/>
<address addr="00:0C:29:37:BF:EF" addrtype="mac" vendor="VMware"/>
<hostnames>
</hostnames>
<ports><port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="64"/><service name="ftp" product="vsftpd" version="2.3.4" ostype="Unix" method="probed" conf="10"><cpe>cpe:/a:vsftpd:vsftpd:2.3.4</cpe></service></port>
</ports>
<times srtt="338" rttvar="3756" to="100000"/>
</host>
<runstats><finished time="1790436900" timestr="Sat Sep 26 11:35:00 2026" summary="Nmap done at Sat Sep 26 11:35:00 2026; 1 IP address (1 host up) scanned in 0.33 seconds" elapsed="0.33" exit="success"/><hosts up="1" down="0" total="1"/>
</runstats>
</nmaprun>

--packet-trace

封包追蹤，輸出送出與接收的封包資訊 ( TCP flag 等 )

nmap [IP位址] --packet-trace

nmap 192.168.31.131 -sS -p 21 --packet-trace
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-26 11:29 EDT
SENT (0.0464s) ARP who-has 192.168.31.131 tell 192.168.31.129
RCVD (0.0467s) ARP reply 192.168.31.131 is-at 00:0C:29:37:BF:EF
NSOCK INFO [0.1260s] nsock_iod_new2(): nsock_iod_new (IOD #1)
NSOCK INFO [0.1260s] nsock_connect_udp(): UDP connection requested to 192.168.31.2:53 (IOD #1) EID 8
NSOCK INFO [0.1260s] nsock_read(): Read request from IOD #1 [192.168.31.2:53] (timeout: -1ms) EID 18
NSOCK INFO [0.1260s] nsock_iod_new2(): nsock_iod_new (IOD #2)
NSOCK INFO [0.1260s] nsock_connect_udp(): UDP connection requested to 10.25.0.1:53 (IOD #2) EID 24
NSOCK INFO [0.1260s] nsock_read(): Read request from IOD #2 [10.25.0.1:53] (timeout: -1ms) EID 34
NSOCK INFO [0.1260s] nsock_write(): Write request for 45 bytes to IOD #1 EID 43 [192.168.31.2:53]
NSOCK INFO [0.1260s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [192.168.31.2:53]
NSOCK INFO [0.1260s] nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 43 [192.168.31.2:53]
NSOCK INFO [0.1260s] nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 24 [10.25.0.1:53]
NSOCK INFO [0.1390s] nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 18 [192.168.31.2:53] (89 bytes)
NSOCK INFO [0.1390s] nsock_read(): Read request from IOD #1 [192.168.31.2:53] (timeout: -1ms) EID 50
NSOCK INFO [0.1390s] nsock_iod_delete(): nsock_iod_delete (IOD #1)
NSOCK INFO [0.1390s] nevent_delete(): nevent_delete on event #50 (type READ)
NSOCK INFO [0.1390s] nsock_iod_delete(): nsock_iod_delete (IOD #2)
NSOCK INFO [0.1390s] nevent_delete(): nevent_delete on event #34 (type READ)
SENT (0.1540s) TCP 192.168.31.129:47923 > 192.168.31.131:21 S ttl=43 id=64117 iplen=44  seq=3400101056 win=1024 <mss 1460>
RCVD (0.1542s) TCP 192.168.31.131:21 > 192.168.31.129:47923 SA ttl=64 id=0 iplen=44  seq=2692404022 win=5840 <mss 1460>
Nmap scan report for 192.168.31.131
Host is up (0.00032s latency).

PORT   STATE SERVICE
21/tcp open  ftp
MAC Address: 00:0C:29:37:BF:EF (VMware)

Nmap done: 1 IP address (1 host up) scanned in 0.19 seconds

--reason

顯示掃描結果的判斷依據。

nmap [IP位址] --reason  

nmap 192.168.31.131 -sn --reason  
Starting Nmap 7.95 ( https://nmap.org ) at 2026-09-26 11:31 EDT
Nmap scan report for 192.168.31.131
Host is up, received arp-response (0.00030s latency).
MAC Address: 00:0C:29:37:BF:EF (VMware)
Nmap done: 1 IP address (1 host up) scanned in 0.09 seconds

總結

今天是 Nmap 的最後一篇文章，不知道有沒有讀者是看了我的文章學到了新東西又或者是複習到就用法，不管怎麼都希望這系列的文章可以帶給大家一點收穫，今天原本打算多寫 Nmap 這幾天文章的回顧，但後面想了想等到最後一天再來一起回顧可能會更有感覺，再加上加今天剛好是中秋家裡在忙 ( 好像有點藉口 )，於是今天的內容就看起來很水。

明天預計會進入到 Web proxy 的章節，這個部分也是我第一次接觸希望能夠順利。