A python 3 library which helps in using nmap port scanner.

Last update: Dec 19, 2022

Overview

python3-nmap

A python 3 library which helps in using nmap port scanner. The way this tools works is by defining each nmap command into a python function making it very easy to use sophisticated nmap commands in other python scripts. Nmap is a complicated piece of software used for reconnaissance on target networks, over the years new features have been added making it more sophisticated.

With this python3-nmap we make using nmap in python very easy and painless

For example in nmap if you want to scan for common ports you would to something like this

$ nmap your-host.com --top-ports 10

But in this python3-nmap script you would do something like this

import nmap3
nmap = nmap3.Nmap()
results = nmap.scan_top_ports("your-host.com")
# And you would get your results in json

You will notice each nmap command is defined as a python function/method. this make it easy to remember this in python and easily use them.

Again in nmap if you want to use the famous dns-brute script you would do something like this

$ nmap your-host.com  --script dns-brute.nse

But in this python3 script again it's very easy you just do something like this

import nmap3
nmap = nmap3.Nmap()
results = nmap.nmap_dns_brute_script("your-host.com")

# And you would get your results in json
[
    {
        "address": "mail.your-host.com",
        "hostname": "68.65.122.10"
    },
    {
        "address": "www.your-host.com",
        "hostname": "5.189.129.43"
    }
]

How to use python3-nmap

Using this scripts is very easy, though it assumes you have nmap already installed, as it is the primary dependence required. Also this tools supports both windows and linux, it's cross platform so to say.

Installation

$ git clone https://github.com/wangoloj/python3-nmap.git

$ pip3 install -r requirements.txt

# Install nmap online

$ apt-get install nmap

# That's all is needed to get started

In nmap some commands require root privileges for example the command to identify OS requires root privileges;

$ nmap -O your-host.com

TCP/IP fingerprinting (for OS scan) requires root privileges.
QUITTING!
# Until you sudo

$ sudo nmap -O your-host.com

The same applies to the script to be able to run the os identifier you have to be a super user.

How to use the script to identify OS

import nmap3
nmap = nmap3.Nmap()
os_results = nmap.nmap_os_detection("192.168.178.2") # MOST BE ROOT

[
    {
        "accuracy": "100",
        "cpe": "cpe:/o:linux:linux_kernel:2.6",
        "line": "45249",
        "name": "Linux 2.6.14 - 2.6.34",
        "osclass": {
            "accuracy": "100",
            "osfamily": "Linux",
            "osgen": "2.6.X",
            "type": "general purpose",
            "vendor": "Linux"
        }
    },
    {
        "accuracy": "100",
        "cpe": "cpe:/o:linux:linux_kernel:2.6.17",
        "line": "45775",
        "name": "Linux 2.6.17",
        "osclass": {
            "accuracy": "100",
            "osfamily": "Linux",
            "osgen": "2.6.X",
            "type": "general purpose",
            "vendor": "Linux"
        }
    },
    {
        "accuracy": "100",
        "cpe": "cpe:/o:linux:linux_kernel:2.6.17",
        "line": "45811",
        "name": "Linux 2.6.17 (Mandriva)",
        "osclass": {
            "accuracy": "100",
            "osfamily": "Linux",
            "osgen": "2.6.X",
            "type": "general purpose",
            "vendor": "Linux"
        }
    },
    {
        "accuracy": "100",
        "cpe": "cpe:/o:linux:linux_kernel:3.13",
        "line": "60884",
        "name": "Linux 3.13",
        "osclass": {
            "accuracy": "100",
            "osfamily": "Linux",
            "osgen": "3.X",
            "type": "general purpose",
            "vendor": "Linux"
        }
    }
]

Class components of python3-nmap

The script is made of up the following classes, each holding different nmap abilities and scan types.

Nmap
NmapHostDiscovery
NmapScanTechniques

Identifying service version

In nmap if you want to identify versions you would run this kind of command

$ nmap 192.168.178.1  -sV

In this python script you would do something like this

import nmap3
nmap = nmap3.Nmap()
version_result = nmap.nmap_version_detection("your-host.com")

[
    {
        "cpe": [
            {
                "cpe": "cpe:/o:linux:linux_kernel"
            }
        ],
        "port": "80",
        "protocol": "tcp",
        "service": {
            "conf": "10",
            "extrainfo": "Ubuntu",
            "method": "probed",
            "name": "http",
            "ostype": "Linux",
            "product": "nginx",
            "version": "1.14.0"
        }
    },
    {
        "cpe": [
            {
                "cpe": "cpe:/o:linux:linux_kernel"
            }
        ],
        "port": "443",
        "protocol": "tcp",
        "service": {
            "conf": "10",
            "extrainfo": "Ubuntu",
            "method": "probed",
            "name": "http",
            "ostype": "Linux",
            "product": "nginx",
            "tunnel": "ssl",
            "version": "1.14.0"
        }
    },
    {
        "cpe": [
            {
                "cpe": "cpe:/o:linux:linux_kernel"
            }
        ],
        "port": "2000",
        "protocol": "tcp",
        "service": {
            "conf": "10",
            "extrainfo": "Ubuntu Linux; protocol 2.0",
            "method": "probed",
            "name": "ssh",
            "ostype": "Linux",
            "product": "OpenSSH",
            "version": "7.6p1 Ubuntu 4ubuntu0.3"
        }
    }
]

Nmap commands available

The following nmaps commands have been added to the following scripts

get Nmap version details

import nmap3
nmap = nmap3.Nmap()
results = nmap.nmap_version()

Nmap top port scan

import nmap3
nmap = nmap3.Nmap()
results = nmap.scan_top_ports("your-host")

Nmap Dns-brute-script( to get subdomains )

   import nmap3
   nmap = nmap3.Nmap()
   results = nmap.nmap_dns_brute_script("domain")

Nmap list scan

   import nmap3
   nmap = nmap3.Nmap()
   results = nmap.nmap_list_scan("your-host")

Nmap Os detection

  import nmap3
  nmap = nmap3.Nmap()
  results = nmap.nmap_os_detection("your-host");

Nmap subnet scan

   import nmap3
   nmap = nmap3.Nmap()
   results = nmap.nmap_subnet_scan("your-host") #Must be root

Nmap version detection

   import nmap3
   nmap = nmap3.Nmap()
   results = nmap.nmap_version_detection("your-host") # Must be root

Nmap Scanning Techniques

The script offers nmap scan techniques also as python function/methods

nmap_fin_scan

import nmap3
nmap = nmap3.NmapScanTechniques()
result = nmap.nmap_fin_scan("192.168.178.1")

nmap_idle_scan

   import nmap3
   nmap = nmap3.NmapScanTechniques()
   result = nmap.nmap_idle_scan("192.168.178.1")

nmap_ping_scan

   import nmap3
   nmap = nmap3.NmapScanTechniques()
   result = nmap.nmap_ping_scan("192.168.178.1")

nmap_syn_scan

   import nmap3
   nmap = nmap3.NmapScanTechniques()
   result = nmap.nmap_syn_scan("192.168.178.1")

nmap_tcp_scan

   import nmap3
   nmap = nmap3.NmapScanTechniques()
   result = nmap.nmap_tcp_scan("192.168.178.1")

nmap_udp_scan

   import nmap3
   nmap = nmap3.NmapScanTechniques()
   result = nmap.nmap_udp_scan("192.168.178.1")

Supporting the nmap host discovery

The script also offers support for map Added Nmap Host discovery techniques still as python function/methods

Only port scan (-Pn)
Only host discover (-sn)
Arp discovery on a local network (-PR)
Disable DNS resolution (-n)

NmapHostDiscovery

def nmap_portscan_only(self, host, args=None)

   import nmap3
   nmap = nmap3.NmapHostDiscovery()
   results = nmap.nmap_portscan_only("your-host")

def nmap_no_portscan(self, host, args=None):

   import nmap3
   nmap = nmap3.NmapHostDiscovery()
   results = nmap.nmap_no_portscan("your-host")

def nmap_arp_discovery(self, host, args=None):

  import nmap3
  nmap = nmap3.NmapHostDiscovery()
  results = nmap.nmap_arp_discovery("your-host")

def nmap_disable_dns(self, host, args=None):

  import nmap3
  nmap = nmap3.NmapHostDiscovery()
  results = nmap.nmap_disable_dns("your-host")

Nmap is a large tool, as you can see python3-nmap provides only things what you could say commonly used nmap features.

Using custom nmap command line arguments.

As we said, the script defines each set of nmap command as python function/methods. You can also pass arguments to those methods/function thus extending your capabilities for example. Let's say we want to scan top ports but also perform version detection .

   import nmap3
   nmap = nmap3.Nmap()
   results = nmap.scan_top_ports("host", args="-sV")

Using the nmap vulners script to identify vulnerabilities (CVE's)

You scan the the target IP using version detection ('-sV') to get the service and, the script performs a lookup in the CVE database. The nmap vulners script is part of the default Nmap installation, so you shouldn't need to install any other packages.

   import nmap3
   nmap = nmap3.Nmap()
   ressults = nmap_version_detection("host", args="--script vulners --script-args mincvss+5.0")

Cross-Selling

Comments

parse_noportscan does not parse mac address

I'm trying to use this package to find the IP, knowing the MAC address, but... This data:

<host><status state="up" reason="arp-response" reason_ttl="0"/>
<address addr="10.11.12.13" addrtype="ipv4"/>
<address addr="00:01:02:03:04:05" addrtype="mac" vendor="Vendor Inc."/>
<hostnames>
<hostname name="00-01-02-03-04-05-dns-inc.com" type="PTR"/>
</hostnames>
<times srtt="1000" rttvar="5000" to="100000"/>
</host>

Is only parsed as:

{'state': 'up', 'reason': 'arp-response', 'reason_ttl': '0', 'addr': '10.11.12.13', 'addrtype': 'ipv4'}

opened by egabrum 16

udp scan under Windows 10 issue

We identified an issue when we did with Administrator rights an udp scan: results = nmapscan.nmap_udp_scan(f'{ip}')

under Windows 10 ver. 21H1

File "C:\Users\mrene\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\nmap3\nmap3.py", line 78, in default_command return self.default_command_privileged() File "C:\Users\mrene\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\nmap3\nmap3.py", line 89, in default_command_privileged return self.default_command() File "C:\Users\mrene\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\nmap3\nmap3.py", line 78, in default_command return self.default_command_privileged() File "C:\Users\mrene\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\nmap3\nmap3.py", line 89, in default_command_privileged return self.default_command() File "C:\Users\mrene\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\nmap3\nmap3.py", line 78, in default_command return self.default_command_privileged() File "C:\Users\mrene\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\nmap3\nmap3.py", line 89, in default_command_privileged return self.default_command() File "C:\Users\mrene\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\nmap3\nmap3.py", line 78, in default_command return self.default_command_privileged() File "C:\Users\mrene\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\nmap3\nmap3.py", line 89, in default_command_privileged return self.default_command() File "C:\Users\mrene\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\nmap3\nmap3.py", line 78, in default_command return self.default_command_privileged() RecursionError: maximum recursion depth exceeded

it works fine with root and normal rights under Linux.

Also tcp scan is running well: results = nmapscan.nmap_tcp_scan(f'{ip}')

on Windows 10 and Linux

created a new ncurses front-end for your python3-nmap:

https://github.com/MrEnergy64/ncurses-IPventur

python-nmap3 version is: 1.4.9

opened by MrEnergy64 11
Docker Compose Issue

I can't seem to get this to work in a docker container. For some reason, Nmap seems to think every IP address is on the network (when it's not). No issues when running outside of the docker container.

This is what I've got so far. https://github.com/charlesomer/network-devices-scanner

I've set network_mode: host in the compose file so I'm not sure. I may have missed something obvious?

opened by charlesomer 8
Ping scan doesn't return mac address

Hello,

When i execute the function nmap.nmap_ping_scan('192.168.1.0/24'), all hosts (50) have a "None" value as their mac address. If i run the command /usr/bin/nmap -oX - -sP 192.168.1.0/24, i get the same results, no mac address. But if i run this same command in sudo, i get the mac address.

Is there a parameter to run this command in sudo ?

Thanks you

opened by 0xN0x 7
wrong handling of xml.etreeElementTree objects
This library has code like this in multiple places:

if (some_xml_element.find('something_else')): do_some_stuff

Under some Python / xml.etree versions this will not work as intended, for example I am getting this output from Nmap().nmap_version_detection() (notice missing information about port state and service exposed on the port):

{'port': '443', 'protocol': 'tcp'}

In the case of Nmap().nmap_version_detection() this happens because <state> and <service> do not have any further sub-elements and as the docs say:

Elements with no subelements will test as False. This behavior will change in future versions. Use specific len(elem) or elem is None test instead.

Changing if(port.find("service")): with if port.find("service") is not None: will restore correct behaviour and give complete results like:

{'port': '443', 'protocol': 'tcp', 'reason': 'syn-ack', 'reason_ttl': '0', 'service': {'conf': '10', 'devicetype': 'security-misc', 'method': 'probed', 'name': 'http', 'product': 'Fortinet security device httpd', 'tunnel': 'ssl'}, 'state': 'open'}]
opened by lesinigo 7
Implement optional argument for more command line options to be used in nmap?
Can you add an argument which allows you to pass selected arguments to the process? For example like this:

import nmap3 nmap = nmap3.NmapScanTechniques() nmap.nmap_tcp_scan(target, args="-Pn") # or nmap.nmap_tcp_scan(target, args=["-Pn"])
opened by ioncodes 7
the function "nmap3.Nmap().nmap_version_detection()" seems that it has a problem

in nmap3\nmapparser.py the function "version_detection()" has not defined the variable "service_version_dict". when I used the "nmap3.Nmap().nmap_version_detection()" to call the "version_detection()", it raised "NameError: name 'service_version_dict' is not defined".

ps: I programmed my code at Win10 OS

opened by bobolike123 6
still recognice issue with os.geteuid() in Windows 10 21H1

We still identify the issue that your python3-nmap is using "os.geteuid()" which is not exist in Windows 10 (21H1) anymore:

File "C:\Users\mrene\Documents\PYTHON\ncurses-IPventur.py", line 389, in scannen results = nmap.nmap_os_detection(f'{ip}') File "C:\Users\mrene\AppData\Local\Packages\PythonSoftwareFoundation.Python.3.9_qbz5n2kfra8p0\LocalCache\local-packages\Python39\site-packages\nmap3\utils.py", line 74, in wrapper if(os.geteuid() == 0): AttributeError: module 'os' has no attribute 'geteuid'

Therefore actual you cannot do these scans under Windows 10:

nmap_detect_firewall nmap_os_detection nmap_stealth_scan nmap.nmap_os_detection

In our python3-nmap front ncurses-IPventur we use this workaround with win32api.GetConsoleTitle(). Or do you have another solution instead of os.getuid? python-nmap3 version is: 1.4.9

os_version = platform.system() if os_version == "Windows": ScreenDel = "cls" import win32api check = win32api.GetConsoleTitle() cmd = "where" if platform.system() == "Windows" else "which" if "Administrator" in check: User = "Administrator" return os_version, User, ScreenDel, cmd else: User = "Normal User - limited scan" return os_version, User, ScreenDel, cmd else: ScreenDel = "clear" cmd = "where" if platform.system() == "Windows" else "which" if os.geteuid()==0: User = "Root User" return os_version, User, ScreenDel, cmd else: User = "Normal User - limited scan" return os_version, User, ScreenDel, cmd

opened by MrEnergy64 5
nmap_dns_brute_script doesn't work properly
When I run nmap.nmap_dns_brute_script("google.com") a few times it will eventually get the hostname and address wrong. Expected:

[{'address': '172.217.168.46', 'hostname': 'admin.google.com'},...

What I get sometimes:

[{'address': 'admin.google.com', 'hostname': '172.217.168.46'},...
opened by ioncodes 5

Version detection not running with Python3.10

Hi,

I am trying to run version detection and vulners script on Python 3.10 but its failing for some reason

import nmap3

nmap = nmap3.Nmap()
result = nmap.nmap_version_detection('8.8.8.8',args="--script vulners --script-args mincvss+5.0" )
print(result)

and the error looks something like

Traceback (most recent call last):
  File "/home/cybersoldier/Documents/nmap.py", line 4, in <module>
    result = nmap.nmap_version_detection('8.8.8.8',args="--script vulners --script-args mincvss+5.0" ) #Add the -p- flag here, removed for testing purposes
  File "/usr/local/lib/python3.10/dist-packages/nmap3/nmap3.py", line 195, in nmap_version_detection
    xml_root = self.scan_command(target=target, arg=arg, args=args, timeout=timeout)
  File "/usr/local/lib/python3.10/dist-packages/nmap3/nmap3.py", line 125, in scan_command
    output = self.run_command(scan_shlex, timeout=timeout)
  File "/usr/local/lib/python3.10/dist-packages/nmap3/nmap3.py", line 264, in run_command
    raise NmapExecutionError('Error during command: "' + ' '.join(cmd) + '"\n\n' + errs.decode('utf8'))
nmap3.exceptions.NmapExecutionError: Error during command: "/usr/bin/nmap -oX - 8.8.8.8 -sV --script vulners --script-args mincvss+5.0"

I have tried running the script both with and without sudo but the error stays the same.

opened by njmulsqb 4

Removed possibility to elevate privileges in code (commit: 3c2246b7dfdd6164dd5b7a0a74cfdc6585ea5a32)

In commit: 3c2246b7dfdd6164dd5b7a0a74cfdc6585ea5a32 the possibility to use this tool as a normal user and only allow the usage of sudo for scanning was removed as part of an IPv6 fix. Any particular reason why this change was included there?

opened by tnyblom 4
License classifier doesn't match LICENSE file

Hello,

I noticed that the license classifier https://github.com/nmmapper/python3-nmap/blob/master/setup.py#L27 doesn't match the license defined in the license file https://github.com/nmmapper/python3-nmap/blob/master/LICENSE

opened by mimi89999 1

Releases(1.5.2)

1.5.2(May 24, 2022)

Added support for Asyncronous calls to some of the methods but not all. Also several bug fixes
Source code(tar.gz)
Source code(zip)
1.5.1(Sep 16, 2021)

Stable release and more improvements.
Source code(tar.gz)
Source code(zip)
1.4.9(Dec 11, 2020)

Major revamp,code cleaning Fixes issue #33 and #30 and #18. Also added support for scritpt parsing and also custom args can be parsed
Source code(tar.gz)
Source code(zip)
v1.4.8(Sep 28, 2020)

This Major release has a few bugfix and some minor improvements and code cleanup. It also has incomplete work for supporting nmap scripting engine parser.
Source code(tar.gz)
Source code(zip)

Owner

Nmmapper

Nmmapper offers Pentest tools from nmap online to subdomain finder, theHarvester, wappalyzer. Discover dns records of domains, detect cms using cmseek & whatweb

GitHub Repository https://www.nmmapper.com/st/networkmapper/nmap/online-port-scanning/

An API for controlling Wi-Fi connections on Balena devices.

Description An API for controlling Wi-Fi connections on Balena devices. It does not contain an interface, instead it provides API endpoints to send re

8 Dec 25, 2022

An improved version of the original AutoDD

AutoDD = Automatically does the "due diligence" for you. If you want to know what stocks people are talking about on reddit, this little program might help you.

169 Oct 05, 2022

Simple self-hosted server to receive files from remote systems

Badtray This is a very simple self-hosted server to receive files from remote systems. This works similar to Bintray (RIP) and primarily designed to d

1 Nov 22, 2021

netpy - more than implementation of netcat 🐍🔥

1 Jan 26, 2022

Script and library to wait for a DNS authority server to get its configuration.

DNSWait dnswait is a small script to wait for the "propagation" of a namserver configuration. Installing It's as easy as: python -m pip install dnswai

14 Jan 17, 2022

Jogo da forca simples com conexão entre cliente e servidor utilizando TCP.

JogoDaForcaTCP Um jogo da forca simples com conexão entre cliente e servidor utilizando o protocólo TCP. Como jogar: Habilite a porta 20000, inicie o

1 Dec 01, 2021

A light-weight open-source project CLI utility for showing services running on ports in a host

Portable Port Scanner (ppscanner) Portable Port Scanner (ppscanner) is a light-weight open-source CLI utility that leverages on nmap to make quick and

1 Oct 30, 2021

Distribute a portion of your yield to other addresses 💙

YSHARE Distribute a portion of your yield to other addresses. How does it work Desposit your yToken or tokens into this contract Set the benificiaries

11 Nov 24, 2021

sshuttle: where transparent proxy meets VPN meets ssh

Transparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin. Works with Linux and MacOS. Supports DNS tunneling.

9.4k Jan 09, 2023

Tool for pretty printing and optimizing Lightning Network channels.

Suez Tool for pretty printing and optimizing Lightning Network channels. Installation Install poetry poetry install poetry run ./suez Channel fee poli

69 Nov 03, 2022

This repository contain sample code of gRPC Communication between Python and GoLang

This repository contain sample code of gRPC Communication between Python and GoLang, the Server is running on GoLang while Python is running the client

2 Nov 29, 2021

Port Traffic/Bandwidth Monitor Script

python-switch-port-traffic-alarm Port Traffic/Bandwidth Monitor Script That's an Switch Port Traffic monitor program is checking the switch uplink por

4 Sep 02, 2021

A simple framwork to streamline the Domain Adaptation training process.

FastDA Introduction This is a simple framework for domain adaptation training. You can use it to build your own training process. It heavily relies on

7 Nov 22, 2022

E4GL3OS1NT - Simple Information Gathering Tool

E4GL30S1NT Features userrecon - username reconnaissance facedumper - dump facebook information mailfinder - find email with specific name godorker - d

195 Dec 21, 2022

This is a Client-Server-System which can send audio from a microphone from the server to client and in the other direction.

Audio-Streaming-Python This is a Client-Server-System which can send audio from a microphone from the server to client and in the other direction. You

0 Jan 05, 2023