端口扫描思路和代码实现

查看本机端口信息

Windows:

netstat -aon|findstr 3306

Linux:

netstat -an|grep 3306

远程机器端口

例如：
nc -vz {ip}

telnet 192.168.142.137 80
wget 192.168.142.137 80
nc -vz 192.168.142.137 44

代码实现

import socket, threading

def TCP_connect(ip, port_number, delay, output):
    TCPsock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    TCPsock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    TCPsock.settimeout(delay)
    try:
        TCPsock.connect((ip, port_number))
        output[port_number] = 'Listening'
    except:
        output[port_number] = ''

def scan_ports(host_ip, delay):

    threads = []        # To run TCP_connect concurrently
    output = {}         # For printing purposes

    # Spawning threads to scan ports
    # 先扫10000个端口
    for i in range(10000):
        t = threading.Thread(target=TCP_connect, args=(host_ip, i, delay, output))
        threads.append(t)

    # Starting threads
    for i in range(10000):
        threads[i].start()

    # Locking the script until all threads complete
    for i in range(10000):
        threads[i].join()

    # Printing listening ports from small to large
    for i in range(10000):
        if output[i] == 'Listening':
            print(str(i) + ': ' + output[i])

def main():
    host_ip = input("Please enter host IP: ")
    # 超时抛出异常
    delay = int(input("How many seconds the socket is going to wait until timeout: "))   
    scan_ports(host_ip, delay)
    input("Press Any Key to Exit")

if __name__ == "__main__":
    main()

端口扫描工具

Nmap（Network Mapper）
https://nmap.org/
1）扫描主机(Host Discovery)
2）扫描端口(Port Scanning)
3）探测操作系统、软件版本 (Operating System Detection、Version Detection)

参数类型

nmap --help

TARGET SPECIFICATION:目标，对什么进行扫描，比如是域名、IP或者网络
HOST DISCOVERY:主机发现，怎么对主机进行扫描，比如简单扫描，还是全部扫一遍，或者用相应的协议扫
SCAN TECHNIQUES:扫描技术，协议的设置
PORT SPECIFICATION AND SCAN ORDER:端口和扫描顺序设置
SERVICE/VERSION DETECTION:服务和版本识别
SCRIPT SCAN:使用脚本，nmap本身内置了大量的lua脚本，而且还可以自己编写脚本
OS DETECTION:操作系统识别
TIMING AND PERFORMANCE:时间和性能设置，比如扫描频率、重试次数等等
FIREWALL/IDS EVASION AND SPOOFING:防火墙绕过和欺骗，比如使用代理，假IP等
OUTPUT:把扫描接出输出到文件
MISC: 启用IPv6等等配置

脚本

nmap本身内置了大量的lua脚本，而且还可以自己编写脚本
ls /usr/share/nmap/scripts/ | wc -l
全部清单：https://nmap.org/nsedoc/index.html
例如：
nmap 192.168.142.137 --script http-enum 列举HTTP服
务
nmap --script=auth 绕过鉴权
nmap --script=brute 暴力破解
nmap --script=vuln 扫描漏

常用参数

简单扫描

 nmap -sP 192.168.142.137

指定端口或范围扫描：

nmap -p0-65535 192.168.142.137

探测操作系统：

nmap -O 192.168.142.137

只进行主机发现，不进行端口扫描

nmap -sn 192.168.40.195/2

目录CONTENT

【网络渗透】信息收集——端口扫描