TARGET SPECIFICATION: #目标规格
Can pass hostnames, IP addresses, networks, etc. #选取主机名，IP，或者网络
Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
-iL : Input from list of hosts/networks #导入列表中的目标
-iR : Choose random targets #（利用列表中的主机编号）导出任意目标
--exclude : Exclude hosts/networks
--excludefile : Exclude list from file
HOST DISCOVERY: #活跃主机发掘策略
-sL: List Scan - simply list targets to scan #简单列表扫描策略
-sn: Ping Scan - disable port scan #仅使用ping命令扫描，不进行端口扫描
-Pn: Treat all hosts as online -- skip host discovery #仅扫描出在线主机
#不对主机进一#步扫描
-PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
#使用SYSN/ACK/UDP/SCTP技术挖掘端口
-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
#使用ICMP echo .timestamp,netmask 请求作为探针
-PO[protocol list]: IP Protocol Ping #使用ip协议ping指令扫描
-n/-R: Never do DNS resolution/Always resolve [default: sometimes] #选择是否使用DNS解析
--dns-servers : Specify custom DNS servers
--system-dns: Use OS's DNS resolver
--traceroute: Trace hop path to each host #对路由路径进行跟踪
SCAN TECHNIQUES: #扫描策略
-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
-sU: UDP Scan
-sN/sF/sX: TCP Null, FIN, and Xmas scans
--scanflags : Customize TCP scan flags
-sI : Idle scan #使用僵尸主机地址进行扫描
-sY/sZ: SCTP INIT/COOKIE-ECHO scans 、
-sO: IP protocol scan
-b : FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER: #端口扫描策略
-p : Only scan specified ports #扫描特定端口
Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
--exclude-ports : Exclude the specified ports from scanning
-F: Fast mode - Scan fewer ports than the default scan #快速扫描
-r: Scan ports consecutively - don't randomize #连续端口扫描
--top-ports : Scan most common ports
--port-ratio : Scan ports more common than
SERVICE/VERSION DETECTION:
-sV: Probe open ports to determine service/version info #判断版本信息
--version-intensity : Set from 0 (light) to 9 (try all probes)
--version-light: Limit to most likely probes (intensity 2)
--version-all: Try every single probe (intensity 9)
--version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN: #脚本扫描策略
-sC: equivalent to --script=default
--script=: is a comma separated list of
directories, script-files or script-categories
--script-args=: provide arguments to scripts
--script-args-file=filename: provide NSE script args in a file
--script-trace: Show all data sent and received
--script-updatedb: Update the script database.
--script-help=: Show help about scripts.
is a comma-separated list of script-files or
script-categories.
OS DETECTION: #对系统进行判断
-O: Enable OS detection
--osscan-limit: Limit OS detection to promising targets
--osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE: 对扫描间歇时间进行设定
Options which take
