IP 검색으로 상세 정보 가져오기 (nmap)

IP 검색으로 상세 정보 가져오기 (nmap)

 

앞서 포스트에서 nmap을 설치하는 방법(https://scribblinganything.tistory.com/235), nmap으로 동일네트워크에 살아있는 ip 주소 검색하는 방법(https://scribblinganything.tistory.com/272)와 검색에 걸리지 않으면서 ip주소 검색하는 방법과 와이어 샤크에서 확인하는 내용(https://scribblinganything.tistory.com/273)에 대해 알아 보았다.

 

이번에는 상대방 ip주소를 알고 있을 경우 상대방이 네트워크에 연결되어 있다면 어떤 포트가 열려있는지 어떤 OS(운영체제)를 사용하는지 등 상세 정보를 가져오는 방법에 대한 nmap 기능을 사용해 보겠다.

 

---

IP 주소로 운영체제 정보 가져오기 예제 

 

구현하기>>

C:\Users\forgo>nmap -O 192.168.0.111
Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-30 17:37 
Nmap scan report for 192.168.0.111
Host is up (0.00028s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds
3003/tcp open  cgms
3306/tcp open  mysql
5357/tcp open  wsdapi
Device type: general purpose
Running: Microsoft Windows 10
OS CPE: cpe:/o:microsoft:windows_10
OS details: Microsoft Windows 10 1809 - 1909
Network Distance: 0 hops

OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 1.76 seconds

 

nmap -O 192.168.0.111

 

-O는 OS 정보를 가져오겠다는 의미이다. 우선 Ping을 보내서 Host is up 인지 아닌지부터 확인하고 아래와 같이 TCP로 살아있는 포트와 OS 정보를 가져온다.

 

 

C:\Users\forgo>nmap -A 192.168.0.111
Starting Nmap 7.91 ( https://nmap.org ) at 2021-08-30 17:45 
Nmap scan report for 192.168.0.111
Host is up (0.000036s latency).
Not shown: 994 closed ports
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
3003/tcp open  cgms?
3306/tcp open  mysql         MySQL 8.0.25
| mysql-info:
|   Protocol: 10
|   Version: 8.0.25
|   Thread ID: 9
|   Capabilities flags: 65535
|   Some Capabilities: IgnoreSigpipes, DontAllowDatabaseTableColumn, Speaks41ProtocolOld, SwitchToSSLAfterHandshake, SupportsLoadDataLocal, LongPassword, SupportsTransactions, SupportsCompression, Support41Auth, ConnectWithDatabase, Speaks41ProtocolNew, FoundRows, InteractiveClient, IgnoreSpaceBeforeParenthesis, ODBCClient, LongColumnFlag, SupportsMultipleStatments, SupportsMultipleResults, SupportsAuthPlugins
|   Status: Autocommit
|   Salt: 9k?**********************18\x13
|_  Auth Plugin Name: caching_sha2_password
| ssl-cert: Subject: commonName=MySQL_Server_8.0.25_Auto_Generated_Server_Certificate
| Not valid before: 2021-06-02T09:31:09
|_Not valid after:  2031-05-31T09:31:09
|_ssl-date: TLS randomness does not represent time
5357/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Service Unavailable
Device type: general purpose
Running: Microsoft Windows 10
OS CPE: cpe:/o:microsoft:windows_10
OS details: Microsoft Windows 10 1809 - 1909
Network Distance: 0 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   2.02:
|_    Message signing enabled but not required
| smb2-time:
|   date: 2021-08-30T08:45:41
|_  start_date: N/A

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 27.36 seconds

 

nmap -A 192.168.0.111 

 

-A는 상세 정보를 가져올때 사용된다.