Python扫描器-端口扫描

17bdw

结合渗透测试最常见就是单个域名扫指纹，自动子域名查找、获取所有子域名的IP，自动C段IP查找相同子域名，利用有效IP扫端口。

常见端口库扫描


service_list = {
21:"FTP",
22:"ssh",
25:"SMTP",
80:"web",
139:"Samba",
143:"IMAP",
161:"SNMP",
389:"Ldap目录访问协议",
443:"https",
445:"Microsoft SMB",
465:"SMTP SSL",
513:"rlogin",
546:"DHCP failover",
873:"rsync",
993:"IMAPS",
1080:"socks proxy",
1194:"OpenVPN",
1352:"Lotus domino",
1433:"MSSQL",
1521:"Oracle default",
2049:"Nfs",
2181:"ZooKeeper",
2375:"Docker",
3306:"MySQL",
3389:"Remote Desktop",
4440:"rundeck",
4848:"GlassFish控制台",
5000:"SysBase/DB2",
5432:"PostgreSQL",
5632:"pcanywhere",
5900:"vnc",
5984:"Apache CouchDB",
6082:"varnish",
6984:"Apache CouchDB SSL",
6379:"Redis",
7001:"weblogic_Server isten port",
7002:"Server Listen SSL Port",
8069:"zabbix",
8080:"web,jboss,tomcat etc..",
8089:"Jboss/Tomcat/Resin",
8083:"influxDB Web admin",
8086:"influxdb HTTP API",
8095:"Atlassian Crowd",
8161:"activemq",
8888:"Jupyter Notebook",
8983:"solr",
9000:"fastcgi",
9043:"VMware ESXI vsphere",
9080:"websphere http",
9083:"Hive default",
9090:"websphere admin",
9200:"Elsaticsearch http",
9300:"Elsaticsearch Node1",
10000:"HiveServer2",
11211:"memcached",
27017:"MongoDB",
50000:"SAP command excute",
50060:"hadoop web",
50070:"hadoop default",
60000:"HBase Master",
60010:"hbase.master.info.bindAddress",
}

利用文章

在线端口扫描服务

python自带库端口扫描

考虑CDN

国外的公有云厂商IP地址公开列表：

利用Python原始库完成一个端口扫描的功能


import socket
 
def get_ip_status(ip,port):
    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        server.connect((ip,port))
        print(\'{0} port {1} is open\'.format(ip, port))
    except Exception as err:
        print(\'{0} port {1} is not open\'.format(ip,port))
    finally:
        server.close()


get_ip_status("192.168.221.133",22)

多线程端口扫描封装

#!/usr/bin/env python
# -*- coding:utf-8 -*-

import threadpool
import socket

service_list = {
21:"FTP",
22:"ssh",
25:"SMTP",
80:"web",
139:"Samba",
143:"IMAP",
161:"SNMP",
389:"Ldap目录访问协议",
443:"https",
445:"Microsoft SMB",
465:"SMTP SSL",
513:"rlogin",
546:"DHCP failover",
873:"rsync",
993:"IMAPS",
1080:"socks proxy",
1194:"OpenVPN",
1352:"Lotus domino",
1433:"MSSQL",
1521:"Oracle default",
2049:"Nfs",
2181:"ZooKeeper",
2375:"Docker",
3306:"MySQL",
3389:"Remote Desktop",
4440:"rundeck",
4848:"GlassFish控制台",
5000:"SysBase/DB2",
5432:"PostgreSQL",
5632:"pcanywhere",
5900:"vnc",
5984:"Apache CouchDB",
6082:"varnish",
6984:"Apache CouchDB SSL",
6379:"Redis",
7001:"weblogic_Server isten port",
7002:"Server Listen SSL Port",
8069:"zabbix",
8080:"web,jboss,tomcat etc..",
8089:"Jboss/Tomcat/Resin",
8083:"influxDB Web admin",
8086:"influxdb HTTP API",
8095:"Atlassian Crowd",
8161:"activemq",
8888:"Jupyter Notebook",
8983:"solr",
9000:"fastcgi",
9043:"VMware ESXI vsphere",
9080:"websphere http",
9083:"Hive default",
9090:"websphere admin",
9200:"Elsaticsearch http",
9300:"Elsaticsearch Node1",
10000:"HiveServer2",
11211:"memcached",
27017:"MongoDB",
50000:"SAP command excute",
50060:"hadoop web",
50070:"hadoop default",
60000:"HBase Master",
60010:"hbase.master.info.bindAddress",
}

class Port(object):
    """docstring for Port"""
    def __init__(self, ip):
        self.state = \'unscan\' #未扫描
        self.ip = ip
        self.report = \'\'

    # 主要执行函数
    def main(self):
        global g_list
        g_list = []
        portlist = []
        for port in service_list:
            portlist.append(port)                          #  保存url的列表
        self.thread_requestor(portlist)                    # 线程池函数

        for q in g_list:  # 保存线程回调函数的值到vulurl.txt中
           print("sucess:",q)

    # 线程池函数
    def thread_requestor(self,portlist):
        pool =  threadpool.ThreadPool(200)                                      # 线程池数量
        # reqs =  threadpool.makeRequests(getScan,urllist,res_printer)          # 使用线程池
        reqs = threadpool.makeRequests(self.get_ip_status, portlist,self.res_printer)  # 使用线程池
        [pool.putRequest(req) for req in reqs]                                         # 简写 for req in reqs pool.putRequest(req)
        pool.wait()
    # 回调函数的结果保存到g_list数组中
    def res_printer(self,res1,res2):
        if res2:
            #print (\'"线程返回的地址 = " %s \')% res2
            g_list.append(res2)
        else:
            pass
    # 获取IP端口
    def get_ip_status(self,port):

        server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        try:
            server.connect((self.ip, port))
            print(\'{0} port {1} is open\'.format(self.ip, port))
            return port
        except Exception as e:
            print(\'{0} port {1} is not open\'.format(self.ip, port))
        finally:
            server.close()

if __name__ == "__main__":
    Port("www.baidu.com").main()

python-nmap

把nmap指令参数封装起来，然后调用nmap，格式化nmap输出的结果。

模块常用方法说明

这里我们主要接受python-nmap模块的两个常用类，一个是PortScanner()类，实现一个nmap工具的端口扫描功能封装;另一个为PortScannerHostDict()类，实现存储与访问主机扫描结果

1、PortScanner()类常用方法

1-1、scan()方法

scan(self, hosts=\'127.0.0.1\', ports=None, arguments=\'-sV\')

方法，实现指定主机、端口、namp命令行参数的扫描。参数hosts为字符串类型，表示扫描的主机地址，格式可以用"scanme.nmap.org"、"192.116.0-255.1-127"、"216.163.128.20/20"表示; 参数ports为字符串类型，表示扫描的端口,可以用"22,53,110,143-4564"表示;参数namp命令行参数，格式为"-sU -sX -sC"，例如：

nm = nmap.PortScanner()
nm.scan(\'192.168.209.121-122\', \'22,80\')

1-2、command_line()方法
command_line(self)方法,返回的扫描方法映射到具体的nmap命令行，如：

>>> nm.command_line()
u\'nmap -oX - -p 22,80 -sV 192.168.209.121-122\'

1-3、scaninfo()方法
scaninfo(self)方法，返回nmap扫描信息，格式为字典类型，如：

>>>nm.scanninfo()
{\'tcp\':{\'services\':\'22,80\', \'method\':\'syn\'}}

1-4、all_hosts()方法
all_hosts(self)方法，返回nmap扫描的主机清单，格式为列表类型，例如：

[\'192.168.209.121\', \'192.168.209.122\']

2、PortScannerHostDict()类常用方法
2-1、hostname()方法
hostname(self)方法，返回扫描对象的主机名，如：

>>> nm[\'192.168.209.121\'].hostname()
\'liuyazhuang\'

2-2、state()方法
state(self)方法,返回扫描对象的状态，包括4中状态(up、down、unknown、skipped)，如：

>>> nm[\'192.168.209.121\'].state()

\'up\'

2-3、all_protocols()方法
all_protocols(self)方法，返回扫描的协议，如:

>>> nm[\'192.168.209.121\'].all_protocols()
[\'tcp\']

2-4、all_tcp()方法
all_tcp(self)方法，返回TCP协议扫描的端口，如：

>>> nm[\'192.168.209.121\'].all_tcp()

[22,80]

2-5、tcp()方法
tcp(self, port)方法，返回扫描TCP协议port(端口)的信息,如:

>>> nm[\'192.168.209.121\'].tcp(22)
{\'state\':\'open\', \'reason\':\'syn-ack\', \'name\':\'ssh\'}

python操作nmap

1.简单的小案例

创建PortScanner实例，然后扫描159.239.210.26这个IP的20-443端口。

import nmap

nm = nmap.PortScanner()
ret = nm.scan(\'115.239.210.26\',\'20\')
print ret

返回格式如下:

{\'nmap\': {\'scanstats\': 
{\'uphosts\': \'1\', \'timestr\': \'Tue Oct 25 11:30:47 2016\', \'downhosts\': \'0\', \'totalhosts\': \'1\', \'elapsed\': \'1.11\'},
 \'scaninfo\': {\'tcp\': {\'services\': \'20\', \'method\': \'connect\'}}, \'command_line\': \'nmap -oX - -p 20 -sV 115.239.210.26\'},
 \'scan\': {\'115.239.210.26\': {\'status\': {\'state\': \'up\', \'reason\': \'syn-ack\'}, \'hostnames\': [{\'type\': \'\', \'name\': \'\'}],
 \'vendor\': {}, \'addresses\': {\'ipv4\': \'115.239.210.26\'},
 \'tcp\': {20: {\'product\': \'\', \'state\': \'filtered\', \'version\': \'\', \'name\': \'ftp-data\', \'conf\': \'3\', \'extrainfo\': \'\', 
\'reason\': \'no-response\', \'cpe\': \'\'}
}
}
}
}

2.内置方法：

还可以打印出简单的信息

import nmap  
nm = nmap.PortScanner() 
print nm.scaninfo()
# {u\'tcp\': {\'services\': u\'20-443\', \'method\': u\'syn\'}}
print nm.command_line() 
# u\'nmap -oX - -p 20-443 -sV 115.239.210.26\'

查看有多少个host

print nm.all_hosts()
# [u\'115.239.210.26\']

查看该host的详细信息

nm[\'115.239.210.26\']

查看该host包含的所有协议

nm[\'115.239.210.26\'].all_protocols()

查看该host的哪些端口提供了tcp协议

nm[\'115.239.210.26\'][\'tcp\']

nm[\'115.239.210.26\'][\'tcp\'].keys()

查看该端口是否提供了tcp协议

nm[\'115.239.210.26\'].has_tcp(21)

还可以像这样设置nmap执行的参数

nm.scan(hosts=\'192.168.1.0/24\', arguments=\'-n -sP -PE -PA21,23,80,3389\')

更多操作请进官网http://xael.org/pages/python-nmap-en.html

分类：

技术点：

相关文章：

猜你喜欢
相关资源
相似解决方案
热门标签
Java Python linux javascript Mysql C# Docker 算法 前端 SpringBoot Redis Vue spring 设计模式 .net core .net kubernetes c++ 数据库 数据结构 大数据 js 机器学习 微服务 Android Go 程序员 面试 JVM ASP.net core 云原生 人工智能 后端 PHP git CSS golang k8s Nginx Django mybatis 深度学习 多线程 React 架构 devops 爬虫 云计算 Spring Boot LeetCode