Nmap und gesprächige Server

Nmap kann auch Serverdienste Identifizieren, wenn diese nicht auf Standard Ports laufen. Sogar Versionsnummern und das genaue Betriebssystem kommt dabei zum Vorschein.

Beispiel eines Windows Server 2003 Systems:

nmap windows.local -PN -A -T4

Starting Nmap 5.21 ( http://nmap.org ) at 2010-04-28 10:19 CEST
Nmap scan report for windows.local (172.16.1.92)
Host is up (0.0045s latency).
Not shown: 991 closed ports
PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS webserver 6.0
|_html-title: Sie haben nicht die erforderliche Berechtigung, um die Seite a...
| http-auth: HTTP Service requires authentication
|   Auth type: Negotiate
|_  Auth type: NTLM
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn
445/tcp  open  microsoft-ds  Microsoft Windows 2003 or 2008 microsoft-ds
1025/tcp open  msrpc         Microsoft Windows RPC
1311/tcp open  ssl/rxmon?
3306/tcp open  mysql         MySQL 5.1.40-community
| mysql-info: Protocol: 10
| Version: 5.1.40-community
| Thread ID: 3
| Some Capabilities: Long Passwords, Connect with DB, Compress, ODBC,
| Transactions, Secure Connection
| Status: Autocommit
|_Salt: CRR$YubihM,1R(q!L=-f
3389/tcp open  microsoft-rdp Microsoft Terminal Service
8000/tcp open  http-alt?
Service Info: OS: Windows

Host script results:
|_nbstat: NetBIOS name: WINDOWS, NetBIOS user: <unknown>, 
| NetBIOS MAC: 00:0f:1f:fa:4d:b7
|_smbv2-enabled: Server doesn't support SMBv2 protocol
| smb-os-discovery:  
|   OS: Windows Server 2003 R2 3790 Service Pack 2 (Windows Server 2003 R2 5.2)
|   Name: DOMAIN\WINDOWS
|_  System time: 2010-04-28 10:19:54 UTC+2

Service detection performed. Please report any incorrect 
results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 56.29 seconds

Beispiel eines Linux Systems:

nmap localhost -A -T4

Starting Nmap 5.21 ( http://nmap.org ) at 2010-04-28 10:33 CEST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00092s latency).
Hostname localhost resolves to 2 IPs. Only scanned 127.0.0.1
rDNS record for 127.0.0.1: localhost.localdomain
Not shown: 995 closed ports
PORT      STATE SERVICE     VERSION
22/tcp    open  ssh         OpenSSH 5.4 (protocol 2.0)
| ssh-hostkey: 1024 ae:34:4c:ad:00:95:ee:8c:fb:c8:00:44:bc:af:f5:9e (DSA)
|_2048 dc:59:ac:b1:c6:87:28:2b:b5:83:dc:e5:0d:94:b4:9f (RSA)
111/tcp   open  rpcbind
| rpcinfo:  
| 100000  2,3,4    111/udp  rpcbind  
| 100000  2,3,4    111/tcp  rpcbind  
|_391002  2        704/tcp  sgi_fam  
139/tcp   open  netbios-ssn Samba smbd 3.X (workgroup: BLECHNET)
445/tcp   open  netbios-ssn Samba smbd 3.X (workgroup: BLECHNET)
55555/tcp open  http-proxy  Squid webproxy 2.7.STABLE3
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:  GET HEAD

Host script results:
|_nbstat: NetBIOS name: LINUX, NetBIOS user: <unknown>, NetBIOS MAC: <unknown>
|_smbv2-enabled: Server doesn't support SMBv2 protocol
| smb-os-discovery:  
|   OS: Unix (Samba 3.5.2)
|   Name: Unknown\Unknown
|_  System time: 2010-04-28 10:33:29 UTC+2

Service detection performed. Please report any incorrect 
results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.46 seconds

Schon krass was man da so alles über Server heraus finden kann.