From 5c6c5959e31962637353ef6eb7c05fa712ebd001 Mon Sep 17 00:00:00 2001 From: fyodor Date: Wed, 15 Oct 2008 10:39:51 +0000 Subject: [PATCH] regenerate man pages with latest Docbook XSL stylesheets and updated build process (which now generates ncat man pages too) --- docs/nmap.1 | 2530 +++++++++++++++++++++++++++---------------------- docs/zenmap.1 | 258 ++++- 2 files changed, 1598 insertions(+), 1190 deletions(-) diff --git a/docs/nmap.1 b/docs/nmap.1 index 70f74d224..224fdbbd6 100644 --- a/docs/nmap.1 +++ b/docs/nmap.1 @@ -1,120 +1,298 @@ .\" Title: nmap -.\" Author: Gordon \(lqFyodor\(rq Lyon -.\" Generator: DocBook XSL Stylesheets v1.73.2 -.\" Date: 09/12/2008 -.\" Manual: Nmap Network Scanning -.\" Source: Insecure.Org Zero Day +.\" Author: Gordon \(lqFyodor\(rq Insecure.Org Lyon +.\" Generator: DocBook XSL Stylesheets v1.74.0 +.\" Date: 10/15/2008 +.\" Manual: Nmap Reference Guide +.\" Source: Nmap Zero Day +.\" Language: English .\" -.TH "NMAP" "1" "09/12/2008" "Insecure.Org Zero Day" "Nmap Network Scanning" +.TH "NMAP" "1" "10/15/2008" "Nmap Zero Day" "Nmap Reference Guide" +.\" ----------------------------------------------------------------- +.\" * (re)Define some macros +.\" ----------------------------------------------------------------- +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" toupper - uppercase a string (locale-aware) +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.de toupper +.tr aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ +\\$* +.tr aabbccddeeffgghhiijjkkllmmnnooppqqrrssttuuvvwwxxyyzz +.. +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" SH-xref - format a cross-reference to an SH section +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.de SH-xref +.ie n \{\ +.\} +.toupper \\$* +.el \{\ +\\$* +.\} +.. +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" SH - level-one heading that works better for non-TTY output +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.de1 SH +.\" put an extra blank line of space above the head in non-TTY output +.if t \{\ +.sp 1 +.\} +.sp \\n[PD]u +.nr an-level 1 +.set-an-margin +.nr an-prevailing-indent \\n[IN] +.fi +.in \\n[an-margin]u +.ti 0 +.HTML-TAG ".NH \\n[an-level]" +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +\." make the size of the head bigger +.ps +3 +.ft B +.ne (2v + 1u) +.ie n \{\ +.\" if n (TTY output), use uppercase +.toupper \\$* +.\} +.el \{\ +.nr an-break-flag 0 +.\" if not n (not TTY), use normal case (not uppercase) +\\$1 +.in \\n[an-margin]u +.ti 0 +.\" if not n (not TTY), put a border/line under subheading +.sp -.6 +\l'\n(.lu' +.\} +.. +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" SS - level-two heading that works better for non-TTY output +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.de1 SS +.sp \\n[PD]u +.nr an-level 1 +.set-an-margin +.nr an-prevailing-indent \\n[IN] +.fi +.in \\n[IN]u +.ti \\n[SN]u +.it 1 an-trap +.nr an-no-space-flag 1 +.nr an-break-flag 1 +.ps \\n[PS-SS]u +\." make the size of the head bigger +.ps +2 +.ft B +.ne (2v + 1u) +.if \\n[.$] \&\\$* +.. +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" BB/BE - put background/screen (filled box) around block of text +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.de BB +.if t \{\ +.sp -.5 +.br +.in +2n +.ll -2n +.gcolor red +.di BX +.\} +.. +.de EB +.if t \{\ +.if "\\$2"adjust-for-leading-newline" \{\ +.sp -1 +.\} +.br +.di +.in +.ll +.gcolor +.nr BW \\n(.lu-\\n(.i +.nr BH \\n(dn+.5v +.ne \\n(BHu+.5v +.ie "\\$2"adjust-for-leading-newline" \{\ +\M[\\$1]\h'1n'\v'+.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[] +.\} +.el \{\ +\M[\\$1]\h'1n'\v'-.5v'\D'P \\n(BWu 0 0 \\n(BHu -\\n(BWu 0 0 -\\n(BHu'\M[] +.\} +.in 0 +.sp -.5v +.nf +.BX +.in +.sp .5v +.fi +.\} +.. +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.\" BM/EM - put colored marker in margin next to block of text +.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.de BM +.if t \{\ +.br +.ll -2n +.gcolor red +.di BX +.\} +.. +.de EM +.if t \{\ +.br +.di +.ll +.gcolor +.nr BH \\n(dn +.ne \\n(BHu +\M[\\$1]\D'P -.75n 0 0 \\n(BHu -(\\n[.i]u - \\n(INu - .75n) 0 0 -\\n(BHu'\M[] +.in 0 +.nf +.BX +.in +.fi +.\} +.. +.\" ----------------------------------------------------------------- +.\" * set default formatting +.\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l -.SH "NAME" -nmap - Network exploration tool and security / port scanner -.SH "SYNOPSIS" -.HP 5 +.\" ----------------------------------------------------------------- +.\" * MAIN CONTENT STARTS HERE * +.\" ----------------------------------------------------------------- +.SH "Name" +nmap \- Network exploration tool and security / port scanner +.SH "Synopsis" +.fam C +.HP \w'\fBnmap\fR\ 'u \fBnmap\fR [\fIScan\ Type\fR...] [\fIOptions\fR] {\fItarget\ specification\fR} -.SH "DESCRIPTION" +.fam +.SH "Description" +.\" Nmap: description of .PP -Nmap (\(lqNetwork Mapper\(rq) is an open source tool for network exploration and security auditing\. It was designed to rapidly scan large networks, although it works fine against single hosts\. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics\. While Nmap is commonly used for security audits, many systems and network administrators find it useful for routine tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime\. +Nmap (\(lqNetwork Mapper\(rq) is an open source tool for network exploration and security auditing\&. It was designed to rapidly scan large networks, although it works fine against single hosts\&. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics\&. While Nmap is commonly used for security audits, many systems and network administrators find it useful for routine tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime\&. .PP -The output from Nmap is a list of scanned targets, with supplemental information on each depending on the options used\. Key among that information is the -\(lqinteresting ports table\(rq\. -That table lists the port number and protocol, service name, and state\. The state is either -open, -filtered, -closed, or -unfiltered\. -Open -means that an application on the target machine is listening for connections/packets on that port\. -Filtered +The output from Nmap is a list of scanned targets, with supplemental information on each depending on the options used\&. Key among that information is the +\(lqinteresting ports table\(rq\&..\" ports: \(lqinteresting\(rq +That table lists the port number and protocol, service name, and state\&. The state is either +\FCopen\F[], +\FCfiltered\F[], +\FCclosed\F[], or +\FCunfiltered\F[]\&. +\FCOpen\F[].\" open port state +means that an application on the target machine is listening for connections/packets on that port\&. +\FCFiltered\F[].\" filtered port state means that a firewall, filter, or other network obstacle is blocking the port so that Nmap cannot tell whether it is -open +\FCopen\F[] or -closed\. -Closed -ports have no application listening on them, though they could open up at any time\. Ports are classified as -unfiltered -when they are responsive to Nmap\'s probes, but Nmap cannot determine whether they are open or closed\. Nmap reports the state combinations -open|filtered +\FCclosed\F[]\&. +\FCClosed\F[].\" closed port state +ports have no application listening on them, though they could open up at any time\&. Ports are classified as +\FCunfiltered\F[].\" unfiltered port state +when they are responsive to Nmap\'s probes, but Nmap cannot determine whether they are open or closed\&. Nmap reports the state combinations +\FCopen|filtered\F[].\" open|filtered port state and -closed|filtered -when it cannot determine which of the two states describe a port\. The port table may also include software version details when version detection has been requested\. When an IP protocol scan is requested (\fB\-sO\fR), Nmap provides information on supported IP protocols rather than listening ports\. +\FCclosed|filtered\F[].\" closed|filtered port state +when it cannot determine which of the two states describe a port\&. The port table may also include software version details when version detection has been requested\&. When an IP protocol scan is requested (\fB\-sO\fR), Nmap provides information on supported IP protocols rather than listening ports\&. .PP -In addition to the interesting ports table, Nmap can provide further information on targets, including reverse DNS names, operating system guesses, device types, and MAC addresses\. +In addition to the interesting ports table, Nmap can provide further information on targets, including reverse DNS names, operating system guesses, device types, and MAC addresses\&. .PP A typical Nmap scan is shown in -Example\ 15.1\. The only Nmap arguments used in this example are +Example\ \&15.1\&. The only Nmap arguments used in this example are \fB\-A\fR, to enable OS and version detection, script scanning, and traceroute; \fB\-T4\fR -for faster execution; and then the two target hostnames\. +for faster execution; and then the two target hostnames\&. .PP -\fBExample\ 15.1.\ A representative Nmap scan\fR +\fBExample\ \&15.1.\ \&A representative Nmap scan\fR +.\" -A: example of .sp +.if n \{\ .RS 4 +.\} +.fam C +.ps -1 .nf -# nmap \-A \-T4 scanme\.nmap\.org playground +.if t \{\ +.sp -1 +.\} +.BB lightgray adjust-for-leading-newline +.sp -1 -Starting Nmap ( http://nmap\.org ) -Interesting ports on scanme\.nmap\.org (64\.13\.134\.52): -(The 1663 ports scanned but not shown below are in state: filtered) +# nmap \-A \-T4 scanme\&.nmap\&.org + +Starting Nmap ( http://nmap\&.org ) +Interesting ports on scanme\&.nmap\&.org (64\&.13\&.134\&.52): +Not shown: 994 filtered ports PORT STATE SERVICE VERSION -22/tcp open ssh OpenSSH 3\.9p1 (protocol 1\.99) -53/tcp open domain +22/tcp open ssh OpenSSH 4\&.3 (protocol 2\&.0) +25/tcp closed smtp +53/tcp open domain ISC BIND 9\&.3\&.4 70/tcp closed gopher -80/tcp open http Apache httpd 2\.0\.52 ((Fedora)) +80/tcp open http Apache httpd 2\&.2\&.2 ((Fedora)) +|_ HTML title: Go ahead and ScanMe! 113/tcp closed auth Device type: general purpose -Running: Linux 2\.4\.X|2\.5\.X|2\.6\.X -OS details: Linux 2\.4\.7 \- 2\.6\.11, Linux 2\.6\.0 \- 2\.6\.11 +Running: Linux 2\&.6\&.X +OS details: Linux 2\&.6\&.20\-1 (Fedora Core 5) -Interesting ports on playground\.nmap\.org (192\.168\.0\.40): -(The 1659 ports scanned but not shown below are in state: closed) -PORT STATE SERVICE VERSION -135/tcp open msrpc Microsoft Windows RPC -139/tcp open netbios\-ssn -389/tcp open ldap? -445/tcp open microsoft\-ds Microsoft Windows XP microsoft\-ds -1002/tcp open windows\-icfw? -1025/tcp open msrpc Microsoft Windows RPC -1720/tcp open H\.323/Q\.931 CompTek AquaGateKeeper -5800/tcp open vnc\-http RealVNC 4\.0 (Resolution 400x250; VNC port: 5900) -5900/tcp open vnc VNC (protocol 3\.8) -MAC Address: 00:A0:CC:63:85:4B (Lite\-on Communications) -Device type: general purpose -Running: Microsoft Windows NT/2K/XP -OS details: Microsoft Windows XP Pro RC1+ through final release -Service Info: OSs: Windows, Windows XP +TRACEROUTE (using port 80/tcp) +HOP RTT ADDRESS +[Cut first 7 hops for brevity] +8 10\&.59 so\-4\-2\-0\&.mpr3\&.pao1\&.us\&.above\&.net (64\&.125\&.28\&.142) +9 11\&.00 metro0\&.sv\&.svcolo\&.com (208\&.185\&.168\&.173) +10 9\&.93 scanme\&.nmap\&.org (64\&.13\&.134\&.52) -Nmap finished: 2 IP addresses (2 hosts up) scanned in 88\.392 seconds +Nmap done: 1 IP address (1 host up) scanned in 17\&.00 seconds +.EB lightgray adjust-for-leading-newline +.if t \{\ +.sp 1 +.\} .fi +.fam +.ps +1 +.if n \{\ .RE +.\} .PP The newest version of Nmap can be obtained from -\fI\%http://nmap.org\fR\. The newest version of the man page is available at -\fI\%http://nmap.org/book/man.html\fR\. -.SH "OPTIONS SUMMARY" +\m[blue]\fB\%http://nmap.org\fR\m[]\&. The newest version of the man page is available at +\m[blue]\fB\%http://nmap.org/book/man.html\fR\m[]\&. +.SH "Options Summary" .PP This options summary is printed when Nmap is run with no arguments, and the latest version is always available at -\fI\%http://nmap.org/data/nmap.usage.txt\fR\. It helps people remember the most common options, but is no substitute for the in\-depth documentation in the rest of this manual\. Some obscure options aren\'t even included here\. +\m[blue]\fB\%http://nmap.org/data/nmap.usage.txt\fR\m[]\&. It helps people remember the most common options, but is no substitute for the in\-depth documentation in the rest of this manual\&. Some obscure options aren\'t even included here\&. .PP - - - +.\" summary of options +.\" command-line options: of Nmap .sp +.if n \{\ .RS 4 +.\} +.fam C +.ps -1 .nf -Nmap 4\.76 ( http://nmap\.org ) +.if t \{\ +.sp -1 +.\} +.BB lightgray adjust-for-leading-newline +.sp -1 + +Nmap 4\&.76 ( http://nmap\&.org ) Usage: nmap [Scan Type(s)] [Options] {target specification} TARGET SPECIFICATION: - Can pass hostnames, IP addresses, networks, etc\. - Ex: scanme\.nmap\.org, microsoft\.com/24, 192\.168\.0\.1; 10\.0\.0\-255\.1\-254 + Can pass hostnames, IP addresses, networks, etc\&. + Ex: scanme\&.nmap\&.org, microsoft\&.com/24, 192\&.168\&.0\&.1; 10\&.0\&.0\-255\&.1\-254 \-iL : Input from list of hosts/networks \-iR : Choose random targets - \-\-exclude : Exclude hosts/networks + \-\-exclude : Exclude hosts/networks \-\-excludefile : Exclude list from file HOST DISCOVERY: \-sL: List Scan \- simply list targets to scan @@ -124,7 +302,7 @@ HOST DISCOVERY: \-PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes \-PO [protocol list]: IP Protocol Ping \-n/\-R: Never do DNS resolution/Always resolve [default: sometimes] - \-\-dns\-servers : Specify custom DNS servers + \-\-dns\-servers : Specify custom DNS servers \-\-system\-dns: Use OS\'s DNS resolver SCAN TECHNIQUES: \-sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans @@ -153,29 +331,29 @@ SCRIPT SCAN: \-sC: equivalent to \-\-script=default \-\-script=: is a comma separated list of directories, script\-files or script\-categories - \-\-script\-args=: provide arguments to scripts + \-\-script\-args=: provide arguments to scripts \-\-script\-trace: Show all data sent and received - \-\-script\-updatedb: Update the script database\. + \-\-script\-updatedb: Update the script database\&. OS DETECTION: \-O: Enable OS detection \-\-osscan\-limit: Limit OS detection to promising targets \-\-osscan\-guess: Guess OS more aggressively TIMING AND PERFORMANCE: Options which take