為什么nmap掃描端口給出的結(jié)果與Python不同？

為什么nmap掃描端口給出的結(jié)果與Python不同？我非常喜歡用Python版本來(lái)補(bǔ)充任務(wù)。

我有一個(gè)易受攻擊的框與IP 192.168.41.2和端口掃描與nmap導(dǎo)致：

nmap -T4 -p- 192.168.41.2
Starting Nmap 7.91 ( https://nmap.org ) at 2021-07-27 15:13 EDT
Nmap scan report for 192.168.41.2
Host is up (0.00024s latency).
All 65535 scanned ports on 192.168.41.2 are closed
MAC Address: 00:50:56:EA:44:EB (VMware)

Nmap done: 1 IP address (1 host up) scanned in 2.72 seconds

告訴我沒(méi)有開(kāi)放的端口。然后，我用Python腳本檢查結(jié)果：

from scapy.all import *
import argparse

parser = argparse.ArgumentParser()
parser.add_argument('ip')
args = parser.parse_args()
ip = args.ip

ports = [i for i in range(65535)]

def synScan(host):
    resp, _ = sr(IP(dst=host)/TCP(sport=5555, dport=ports, flags='S'), timeout=2, verbose=0)
    print(f'Open ports on {host}:\n')
    for s, r in resp:
        if s[TCP].dport == r[TCP].sport:
            print(f'TCP Port {s[TCP].dport} is open.')


synScan(ip)

通過(guò)運(yùn)行執(zhí)行腳本，導(dǎo)致：python3 port_scanner.py 192.168.41.2

Open ports on host 192.168.41.2:
TCP Port 0 is open.
TCP Port 1 is open.
TCP Port 2 is open.
TCP Port 3 is open.
TCP Port 4 is open.
TCP Port 5 is open.
TCP Port 6 is open.
TCP Port 7 is open.
TCP Port 8 is open.
TCP Port 9 is open.
TCP Port 10 is open.
TCP Port 11 is open.
TCP Port 12 is open.
TCP Port 13 is open.
TCP Port 14 is open.
TCP Port 15 is open.
TCP Port 16 is open.
TCP Port 17 is open.
TCP Port 18 is open.
TCP Port 19 is open.
TCP Port 20 is open.
TCP Port 21 is open.
TCP Port 22 is open.
TCP Port 23 is open.
TCP Port 24 is open.
...
...

我的問(wèn)題是我應(yīng)該更信任哪種掃描？Nmap 是非常流行的網(wǎng)絡(luò)掃描儀和替罪羊是相當(dāng)受歡迎的， 但在這里你看到的結(jié)果。

解答

如果您收到了對(duì)SYN包的應(yīng)答，那么該端口將被認(rèn)定為打開(kāi)的。這是錯(cuò)誤的。例如，如果是RST報(bào)文，則關(guān)閉該端口。這個(gè)腳本告訴我們端口是否被過(guò)濾了。

因此，如果您想使用scapy，還必須檢查應(yīng)答包是否也設(shè)置了SYN包。