我在linux上用Python 2.6做一个项目，我在终端使用nmap来获取这些扫描结果，我在一个字符串中得到了这个。
Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-28 23:15 IDT
Nmap scan report for 10.0.0.5
Host is up (0.010s latency).
Not shown: 999 closed ports
PORT STATE SERVICE
62078/tcp open iphone-sync
MAC Address: 70:3E:AC:22:A0:B0 (Unknown)
Device type: general purpose|media device|phone
Running: Apple Mac OS X 10.7.X|10.9.X|10.8.X, Apple iOS 4.X|5.X|6.X
OS CPE: cpe:/o:apple:mac_os_x:10.7 cpe:/o:apple:mac_os_x:10.9 cpe:/o:apple:mac_os_x:10.8 cpe:/o:apple:iphone_os:4 cpe:/a:apple:apple_tv:4 cpe:/o:apple:iphone_os:5 cpe:/o:apple:iphone_os:6
OS details: Apple Mac OS X 10.7.0 (Lion) - 10.9.2 (Mavericks) or iOS 4.1 - 7.1 (Darwin 10.0.0 - 14.0.0)
Network Distance: 1 hop
Nmap scan report for 10.0.0.16
Host is up (0.011s latency).
Not shown: 998 closed ports
PORT STATE SERVICE
443/tcp open https
1111/tcp open lmsocialserver
MAC Address: 94:EB:CD:2E:39:DC (Research In Motion Limited)
Device type: phone
Running: RIM BlackBerry 10.X
OS CPE: cpe:/o:blackberry:blackberry_os:10.0
OS details: BlackBerry 10
Network Distance: 1 hop
Nmap scan report for 10.0.0.30
Host is up (0.11s latency).
Not shown: 984 closed ports
PORT STATE SERVICE
80/tcp open http
139/tcp open netbios-ssn
443/tcp open https
445/tcp open microsoft-ds
515/tcp open printer
631/tcp open ipp
6839/tcp open unknown
7435/tcp open unknown
8080/tcp open http-proxy
9100/tcp open jetdirect
9101/tcp open jetdirect
9102/tcp open jetdirect
9110/tcp open unknown
9111/tcp open DragonIDSConsole
9220/tcp open unknown
9290/tcp open unknown
MAC Address: EC:9A:74:98:3C:9D (Hewlett Packard)
Device type: printer|VoIP adapter
Running: HP VxWorks, Vocality embedded
OS CPE: cpe:/o:hp:vxworks
OS details: VxWorks: HP printer or Vocality BASICS Four Wire VoIP gateway
Network Distance: 1 hop
Nmap scan report for 10.0.0.4
Host is up (0.000040s latency).
All 1000 scanned ports on 10.0.0.4 are closed
Too many fingerprints match this host to give specific OS details
Network Distance: 0 hops
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 50 IP addresses (4 hosts up) scanned in 56.74 second
我想把它解析成这样的： (第一块的例子)
['10.0.0.5', [['62078/tcp', 'open', 'iphone-sync']], '70:3E:AC:22:A0:B0', 'Apple Mac OS X 10.7.0 (Lion) - 10.9.2 (Mavericks) or iOS 4.1 - 7.1 (Darwin 10.0.0 - 14.0.0)']
这是我想要的模式 [IP, [list of [port, state, service], MAC, OS]有什么简单的方法可以用Python来实现吗？
你有没有看过下面的Python模块？
python-nmap: 这是一个python类，用来使用nmap和访问python3的扫描结果。python-libnmap: Python NMAP库使你能够启动异步nmap任务，解析和比较diff扫描结果。特别是： python-nmap 正是你想做的。
python-nmap 使用例子。
>>> import nmap
>>> nm = nmap.PortScanner()
>>> nm.scan('127.0.0.1', '22-443')
>>> nm.command_line()
'nmap -oX - -p 22-443 -sV 127.0.0.1'
>>> nm.scaninfo()
{'tcp': {'services': '22-443', 'method': 'connect'}}
>>> nm.all_hosts()
['127.0.0.1']
>>> nm['127.0.0.1'].hostname()
'localhost'
>>> nm['127.0.0.1'].state()
'up'
>>> nm['127.0.0.1'].all_protocols()
['tcp']
>>> nm['127.0.0.1']['tcp'].keys()
[80, 25, 443, 22, 111]
>>> nm['127.0.0.1'].has_tcp(22)
True
>>> nm['127.0.0.1'].has_tcp(23)
False
>>> nm['127.0.0.1']['tcp'][22]
{'state': 'open', 'reason': 'syn-ack', 'name': 'ssh'}
>>> nm['127.0.0.1'].tcp(22)
{'state': 'open', 'reason': 'syn-ack', 'name': 'ssh'}
>>> nm['127.0.0.1']['tcp'][22]['state']
'open'
>>> for host in nm.all_hosts():
>>> print('----------------------------------------------------')
>>> print('Host : %s (%s)' % (host, nm[host].hostname()))
>>> print('State : %s' % nm[host].state())
>>> for proto in nm[host].all_protocols():
>>> print('----------')
>>> print('Protocol : %s' % proto)
>>>
>>> lport = nm[host][proto].keys()
>>> lport.sort()
>>> for port in lport:
>>> print ('port : %s\tstate : %s' % (port, nm[host][proto][port]['state']))
----------------------------------------------------
Host : 127.0.0.1 (localhost)
State : up
----------
Protocol : tcp
port : 22 state : open
port : 25 state : open
port : 80 state : open
port : 111 state : open
port : 443 state : open
>>> print(nm.csv())
host;protocol;port;name;state;product;extrainfo;reason;version;conf
127.0.0.1;tcp;22;ssh;open;OpenSSH;protocol 2.0;syn-ack;5.9p1 Debian 5ubuntu1;10
127.0.0.1;tcp;25;smtp;open;Exim smtpd;;syn-ack;4.76;10
127.0.0.1;tcp;53;domain;open;dnsmasq;;syn-ack;2.59;10
127.0.0.1;tcp;80;http;open;Apache httpd;(Ubuntu);syn-ack;2.2.22;10
127.0.0.1;tcp;111;rpcbind;open;;;syn-ack;;10
127.0.0.1;tcp;139;netbios-ssn;open;Samba smbd;workgroup: WORKGROUP;syn-ack;3.X;10
127.0.0.1;tcp;443;;open;;;syn-ack;;
>>> nm.scan(hosts='192.168.1.0/24', arguments='-n -sP -PE -PA21,23,80,3389')
>>> hosts_list = [(x, nm[x]['status']['state']) for x in nm.all_hosts()]
>>> for host, status in hosts_list:
>>> print('{0}:{1}'.host)
192.168.1.0:down
192.168.1.1:up
192.168.1.10:down
192.168.1.100:down
192.168.1.101:down
192.168.1.102:down
192.168.1.103:down
192.168.1.104:down
192.168.1.105:down
[...]
>>> nma = nmap.PortScannerAsync()
>>> def callback_result(host, scan_result):
>>> print '------------------'
>>> print host, scan_result
>>>
>>> nma.scan(hosts='192.168.1.0/30', arguments='-sP', callback=callback_result)
>>> while nma.still_scanning():
>>> print("Waiting >>>")
>>> nma.wait(2) # you can do whatever you want but I choose to wait after the end of the scan
>>>
192.168.1.1 {'nmap': {'scanstats': {'uphosts': '1', 'timestr': 'Mon Jun 7 11:31:11 2010', 'downhosts': '0', 'totalhosts': '1', 'elapsed': '0.43'}, 'scaninfo': {}, 'command_line': 'nmap -oX - -sP 192.168.1.1'}, 'scan': {'192.168.1.1': {'status': {'state': 'up', 'reason': 'arp-response'}, 'hostname': 'neufbox'}}}
------------------
192.168.1.2 {'nmap': {'scanstats': {'uphosts': '0', 'timestr': 'Mon Jun 7 11:31:11 2010', 'downhosts': '1', 'totalhosts': '1', 'elapsed': '0.29'}, 'scaninfo': {}, 'command_line': 'nmap -oX - -sP 192.168.1.2'}, 'scan': {'192.168.1.2': {'status': {'state': 'down', 'reason': 'no-response'}, 'hostname': ''}}}
------------------
192.168.1.3 {'nmap': {'scanstats': {'uphosts': '0', 'timestr': 'Mon Jun 7 11:31:11 2010', 'downhosts': '1', 'totalhosts': '1', 'elapsed': '0.29'}, 'scaninfo': {}, 'command_line': 'nmap -oX - -sP 192.168.1.3'}, 'scan': {'192.168.1.3': {'status': {'state': 'down', 'reason': 'no-response'}, 'hostname': ''}}}
>>> nm = nmap.PortScannerYield()
>>> for progressive_result in nm.scan('127.0.0.1/24', '22-25'): print(progressive_result)
如果你只是想解析 xml 结果，您可以使用 xmltodict:
import xmltodict
import json
with open("nmap_results.xml") as f:
xml = f.read()
d = json.loads(json.dumps(xmltodict.parse(xml)))
# d = xmltodict.parse(xml) # you may also try using xmltodict directly without using json, but I'd some issues doing so, give it a try.
编写： nmap 导致 xml，使用 -oX 争，即：
nmap -oX nmap_results.xml x.x.x.x