1.telnet命令
telnet是windows标准服务，可以直接用；如果是linux机器，需要安装telnet
telnet ip 端口
通的结果
[root@164-161A164 ~]# telnet 10.97.164.160 22Trying 10.97.164.160...Connected to 10.97.164.160.Escape character is '^]'.SSH-2.0-OpenSSH_7.4
不通的结果
[root@164-161A164 ~]# telnet 10.221.10.50 22
Trying 10.221.10.50...
telnet: connect to address 10.221.10.50: No route to host
2.ssh 命令
ssh -p 端口 ip
-v 调试模式(会打印日志).
-p 指定端口
通的结果
[root@164-161A164 ~]# ssh -p 22 10.97.164.160
root@10.97.164.160's password:
[root@164-161A164 ~]# ssh -p 22 -v 10.97.164.160
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug1: Connecting to 10.97.164.160 [10.97.164.160] port 22.
debug1: Connection established.
debug1: permanently_set_uid: 0/0
debug1: identity file /root/.ssh/id_rsa type 1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /root/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version OpenSSH_7.4
debug1: match: OpenSSH_7.4 pat OpenSSH* compat 0x04000000
debug1: Authenticating to 10.97.164.160:22 as 'root'
不通的结果
[root@164-161A164 ~]# ssh -p 55555 10.97.164.160
ssh: connect to host 10.97.164.160 port 55555: Connection refused
3.wget命令
wget是linux下的下载工具，需要先安装.
用法: wget ip:port
通的结果
[root@164-161A164 ~]# wget 10.97.164.160 22
--2020-08-26 16:27:43-- http://10.97.164.160/
Connecting to 10.97.164.160:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 13890 (14K) [text/html]
Saving to: ‘index.html.2’
100%[==============================================================================================================================================================================>] 13,890 --.-K/s in 0s
2020-08-26 16:27:43 (475 MB/s) - ‘index.html.2’ saved [13890/13890]
--2020-08-26 16:27:43-- http://22/
Resolving 22 (22)... 0.0.0.22
Connecting to 22 (22)|0.0.0.22|:80... failed: Invalid argument.
FINISHED --2020-08-26 16:27:43--
Total wall clock time: 0.001s
Downloaded: 1 files, 14K in 0s (475 MB/s)
不通的结果
[root@164-161A164 ~]# wget 10.221.10.50 55555
--2020-08-26 16:28:35-- http://10.221.10.50/
Connecting to 10.221.10.50:80... #就卡在这个位置上面
4.nmap命令
nmap 需要进行安装
nmap默认发送一个ARP的PING数据包，来探测目标主机1-10000范围内所开放的所有端口
nmap ip 查看端口开放情况
[root@164-161A164 ~]# nmap 10.97.164.160
Starting Nmap 6.40 ( http://nmap.org ) at 2020-08-26 16:30 CST
Nmap scan report for 10.97.164.160
Host is up (0.000010s latency).
Not shown: 993 closed ports
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open https
2002/tcp open globe
8010/tcp open xmpp
8888/tcp open sun-answerbook
9000/tcp open cslistener
MAC Address: A6:81:3A:16:CB:7B (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 0.16 seconds
nmap -p 端口 ip
[root@164-161A164 ~]# nmap -p 22 10.97.164.160
Starting Nmap 6.40 ( http://nmap.org ) at 2020-08-26 16:32 CST
Nmap scan report for 10.97.164.160
Host is up (0.000081s latency).
PORT STATE SERVICE
22/tcp open ssh
MAC Address: A6:81:3A:16:CB:7B (Unknown)
Nmap done: 1 IP address (1 host up) scanned in 0.16 seconds
open 就是通的
Open：端口处于开放状态，例如：当nmap使用TCP SYN对目标主机某一范围的端口进行扫描时，我们知道 TCP SYN报文是TCP建立连接的第一步，所以，如果目标主机返回SYN+ACK的报文，我们就认为此端口开放了并且使用了TCP服务。
Closed：端口处于关闭状态。例如：TCP SYN类型的扫描，如果返回RST类型的报文，则端口处于管理状态。这里我们值得注意的是关闭的端口也是可访问的，只是没有上层的服务在监听这个端口，而且，只是在我们扫描的这个时刻为关闭，当我们在另一个时间段进行扫描的时候，这些关闭的端口可能会处于open的状态。
Filtered（过滤的）：由于报文无法到达指定的端口，nmap不能够决定端口的开放状态，这主要是由于网络或者主机安装了一些防火墙所导致的。当nmap收到icmp报文主机不可达报文（例如：type为3，code为13（communication administratively prohibit）报文）或者目标主机无应答，常常会将目标主机的状态设置为filtered。
Unfiltered（未被过滤的），当nmap不能确定端口是否开放的时候所打上的状态，这种状态和filtered的区别在于：unfiltered的端口能被nmap访问，但是nmap根据返回的报文无法确定端口的开放状态，而filtered的端口直接就没就没能够被nmap访问。端口被定义为Unfilterd只会发生在TCP ack扫描类型时当返回RST的报文。而端口被定义为filtered 状态的原因是是报文被防火墙设备，路由器规则，或者防火墙软件拦截，无法送达到端口，这通常表现为发送NMAP的主机收到ICMP报错报文，如：TYPE为3，code为13的报文（通信被认为的禁止 communication administratively prohibited），或者主机通过多次重复发送没有收到任何回应）。
Open|filtered状态，这种状态主要是nmap无法区别端口处于open状态还是filtered状态。这种状态只会出现在open端口对报文不做回应的扫描类型中，如：udp，ip protocol ，TCP null，fin，和xmas扫描类型。
Closed|filtered状态，这种状态主要出现在nmap无法区分端口处于closed还是filtered时。此状态只会出现在IP ID idle scan（这个类型我现在也不太理解，过段时间进行总结一些）中。
若有收获，就点个赞吧
0 人点赞
