端口扫描-socket模块

本机地址：192.168.142.131

方法1：

root@kali:~/code/chap4/4.2.4# python3 scaner-port.py -i 192.168.142.1 -p 1-100
[80] OPEN

scaner-port.py

#!/usr/bin/python3
# -*- coding:utf-8 -*-

import sys
import socket
import optparse
import threading
import queue


# 端口扫描类,继承threading.Thread
class PortScaner(threading.Thread):
    # 需要传入 端口队列 目标IP 探测超时时间
    def __init__(self, portqueue, ip, timeout=3):
        threading.Thread.__init__(self)
        self._portqueue = portqueue
        self._ip = ip
        self._timeout = timeout

    def run(self):
        while True:
            # 判断端口队列是否为空
            if self._portqueue.empty():
                # 端口队列为空说明已经扫描完毕，跳出循环
                break
            # 从端口队列中取出端口，超时时间为1s
            port = self._portqueue.get(timeout=0.5)
            try:
                s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                s.settimeout(self._timeout)
                result_code = s.connect_ex((self._ip, port))
                # sys.stdout.write("[%d]Scan\n" % port)
                # 若端口开放则会返回0
                if result_code == 0:
                    sys.stdout.write("[%d] OPEN\n" % port)
            except Exception as e:
                print(e)
            finally:
                s.close()

def StartScan(targetip, port, threadNum):
    # 端口列表
    portList = []
    portNumb = port
    # 判断是单个端口还是端口范围
    if '-' in port:
        for i in range(int(port.split('-')[0]), int(port.split('-')[1])+1):
            portList.append(i)
    else:
        portList.append(int(port))
    # 目标IP地址
    ip = targetip
    # 线程列表
    threads = []
    # 线程数量
    threadNumber = threadNum
    # 端口队列
    portQueue = queue.Queue()
    # 生成端口，加入到端口队列
    for port in portList:
        portQueue.put(port)
    for t in range(threadNumber):
        threads.append(PortScaner(portQueue, ip, timeout=3))
    # 启动线程
    for thread in threads:
        thread.start()
    # 阻塞线程
    for thread in threads:
        thread.join()


if __name__ == '__main__':
    parser = optparse.OptionParser('Example: python %prog -i 127.0.0.1 -p 80 \n      python %prog -i 127.0.0.1 -p 1-100\n')
    # 目标IP参数-i
    parser.add_option('-i', '--ip', dest='targetIP',default='127.0.0.1', type='string',help='target IP')
    # 添加端口参数-p
    parser.add_option('-p', '--port', dest='port', default='80', type='string', help='scann port')
    # 线程数量参数-t
    parser.add_option('-t', '--thread', dest='threadNum', default=100, type='int', help='scann thread number')
    (options, args) = parser.parse_args()
    StartScan(options.targetIP, options.port, options.threadNum)

 方法2：

root@kali:~/code/chap4/4.2.4# python3 portScanBanner.py -i 192.168.1.1 -p 80
Scan report for 192.168.1.1

[80] open HTTP

Scan finished!....

 

 portScanBanner.py

#!/usr/bin/python3.7
#!coding:utf-8
from optparse import OptionParser
import time
import socket
import os
import re

SIGNS = (
    # 协议 | 版本 | 关键字
    b'FTP|FTP|^220.*FTP',
    b'MySQL|MySQL|mysql_native_password',
    b'oracle-https|^220- ora',
    b'Telnet|Telnet|Telnet',
    b'Telnet|Telnet|^\r\n%connection closed by remote host!\x00$',
    b'VNC|VNC|^RFB',
    b'IMAP|IMAP|^\* OK.*?IMAP',
    b'POP|POP|^\+OK.*?',
    b'SMTP|SMTP|^220.*?SMTP',
    b'Kangle|Kangle|HTTP.*kangle',
    b'SMTP|SMTP|^554 SMTP',
    b'SSH|SSH|^SSH-',
    b'HTTPS|HTTPS|Location: https',
    b'HTTP|HTTP|HTTP/1.1',
    b'HTTP|HTTP|HTTP/1.0',
)
def regex(response, port):
    text = ""
    if re.search(b'<title>502 Bad Gateway', response):
        proto = {"Service failed to access!!"}
    for pattern in SIGNS:
        pattern = pattern.split(b'|')
        if re.search(pattern[-1], response, re.IGNORECASE):
            proto = "["+port+"]" + " open " + pattern[1].decode()
            break
        else:
            proto = "["+port+"]" + " open " + "Unrecognized"
    print(proto)

def request(ip,port):
    response = ''
    PROBE = 'GET / HTTP/1.0\r\n\r\n'
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(10)
    result = sock.connect_ex((ip, int(port)))
    if result == 0:
        try:
            sock.sendall(PROBE.encode())
            response = sock.recv(256)
            if response:
                regex(response, port)
        except ConnectionResetError:
            pass
    else:
        pass
    sock.close()

def main():
    parser = OptionParser("Usage:%prog -i <target host> ")   # 输出帮助信息
    parser.add_option('-i',type='string',dest='IP',help='specify target host')   # 获取ip地址参数
    parser.add_option('-p', type='string', dest='PORT', help='specify target host')  # 获取ip地址参数
    options,args = parser.parse_args()
    ip = options.IP
    port = options.PORT
    print("Scan report for "+ip+"\n")
    for line in port.split(','):
        request(ip,line)
        time.sleep(0.2)
    print("\nScan finished!....\n")

if __name__ == "__main__":
    try:
        main()
    except KeyboardInterrupt:
        print("interrupted by user, killing all threads..."