文章作者：starnight_cyber

文章来源：

https://www.cnblogs.com/Hi-blog/

github：

https://github.com/starnightcyber/

# nmap -sU --script nbstat.nse -p137 172.16.80.0/21 -T4

msf5 > use auxiliary/scanner/netbios/nbname

nbtscan-1.0.35.exe -m 172.16.80.0/24

for /l %i in (1,1,255) do @ ping 172.16.80.%i -w 1 -n 1|find /i "ttl="

E:\Tools>@for /l %i in (1,1,255) do @ping -n 1 -w 40 172.16.80.%i & if errorlevel 1 (echo 172.16.80.%i>>./a.txt) else (echo 172.16.80.%i >>./b.txt)

# nmap -sn -PE -T4 172.16.80.0/24    # 扫描# nmap -sn -PE -T4 172.16.80.0/24 | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'  # 提取ip地址

nmap -sU -T5 -sV --max-retries 1 -p 137 172.16.80.0/24

msf5 > use auxiliary/scanner/discovery/udp_probemsf5 > use auxiliary/scanner/discovery/udp_sweep

msf5 > use auxiliary/scanner/smb/smb_version

auxiliary/scanner/discovery/arp_sweep    #基于arp协议发现内网存活主机，这不能通过代理使用auxiliary/scanner/portscan/ack           #基于tcp的ack回复进行端口扫描，默认扫描1-10000端口auxiliary/scanner/portscan/tcp           #基于tcp进行端口扫描，默认扫描1-10000端口auxiliary/scanner/discovery/udp_sweep    #基于udp协议发现内网存活主机auxiliary/scanner/discovery/udp_probe    #基于udp协议发现内网存活主机auxiliary/scanner/netbios/nbname         #基于netbios协议发现内网存活主机 auxiliary/scanner/ftp/ftp_version        #发现内网ftp服务，基于默认21端口auxiliary/scanner/ssh/ssh_version        #发现内网ssh服务，基于默认22端口auxiliary/scanner/telnet/telnet_version  #发现内网telnet服务，基于默认23端口auxiliary/scanner/dns/dns_amp            #发现dns服务，基于默认53端口auxiliary/scanner/http/http_version      #发现内网http服务，基于默认80端口auxiliary/scanner/http/title             #探测内网http服务的标题auxiliary/scanner/smb/smb_version        #发现内网smb服务，基于默认的445端口   auxiliary/scanner/mssql/mssql_schemadump  #发现内网SQLServer服务,基于默认的1433端口auxiliary/scanner/oracle/oracle_hashdump  #发现内网oracle服务,基于默认的1521端口 auxiliary/scanner/mysql/mysql_version    #发现内网mysql服务，基于默认3306端口auxiliary/scanner/rdp/rdp_scanner        #发现内网RDP服务，基于默认3389端口auxiliary/scanner/redis/redis_server     #发现内网Redis服务，基于默认6379端口auxiliary/scanner/db2/db2_version        #探测内网的db2服务，基于默认的50000端口auxiliary/scanner/netbios/nbname         #探测内网主机的netbios名