TCP端口扫描程序(tcp_connect扫描+tcp_syn扫描)Python

说明

Python2版本
Linux虚拟机（Ubuntu16.04）

tcp_connect扫描

TCPCONNECTSCAN.py文件
用法：IP地址输入格式：点分十进制（如192.168.0.1）
端口输入格式：端口号以逗号分隔，支持输入端口范围（如21,23,100-200），建议端口范围不要太大，会崩的。

# -*- coding: UTF-8 -*-
#Python2.7+Ubuntu
from socket import *
import threading

lock = threading.Lock()
openNum = 0
threads = []

def portScanner(host,port):
    global openNum
    try:
        s = socket(AF_INET,SOCK_STREAM)
        s.connect((host,port))
        lock.acquire()
        openNum+=1
        print('[+] %d open' % port)
        lock.release()
        s.close()
    except:
        pass

def main():
    setdefaulttimeout(1)
    IP=raw_input('Input IP :')
    PORT=raw_input('Input PORT:')
    list = PORT.split(",")
    for i in range(len(list)):
        if list[i].isdigit():
            t = threading.Thread(target=portScanner, args=(IP, int(list[i])))
            threads.append(t)
            t.start()
        else:
            newlist = list[i].split("-")
            startPort = int(newlist[0])
            endPort = int(newlist[1])
            for p in range(startPort, endPort):
                t = threading.Thread(target=portScanner, args=(IP, p))
                threads.append(t)
                t.start()

    for t in threads:
        t.join()

    print('[*] The scan is complete!')
    print('[*] A total of %d open port ' % (openNum))

if __name__ == '__main__':
    main()

运行结果：

tcp_syn扫描

TCPSYNSCAN.py文件
格式如上
需要管理员权限运行
多线程没太明白，所以有点慢（是非常慢），待改进

# -*- coding: UTF-8 -*-
#Python2.7+Ubuntu 
#use root privilege!!!!!
import time
import random
import socket
import sys
from struct import *
import threading

lock = threading.Lock()
openNum=0
threads = []

def checksum(msg):
    ''' Check Summing '''
    s = 0
    for i in range(0,len(msg),2):
        w = (ord(msg[i]) << 8) + (ord(msg[i+1]))
        s = s+w
    s = (s>>16) + (s & 0xffff)
    s = ~s & 0xffff
    return s
def CreateSocket(source_ip,dest_ip):
    ''' create socket connection '''
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP)
    except socket.error as msg:
        print ('Socket create error: ',str(msg[0]),'message: ',msg[1])
        sys.exit()
    ''' Set the IP header manually '''
    s.setsockopt(socket.IPPROTO_IP, socket.IP_HDRINCL, 1)
    
    return s
def CreateIpHeader(source_ip, dest_ip):
    ''' create ip header '''
    # packet = ''
    # ip header option
    headerlen = 5
    version = 4
    tos = 0
    tot_len = 20 + 20
    id = random.randrange(18000,65535,1)
    frag_off = 0
    ttl = 255
    protocol = socket.IPPROTO_TCP
    check = 10
    saddr = socket.inet_aton ( source_ip )
    daddr = socket.inet_aton ( dest_ip )
    hl_version = (version << 4) + headerlen
    ip_header = pack('!BBHHHBBH4s4s', hl_version, tos, tot_len, id, frag_off, ttl, protocol, check, saddr, daddr)
    return ip_header
def create_tcp_syn_header(source_ip, dest_ip, dest_port):
    ''' create tcp syn header function '''
    source = random.randrange(32000,62000,1) # randon select one source_port 
    seq = 0
    ack_seq = 0
    doff = 5
    
    ''' tcp flags '''
    fin = 0
    syn = 1
    rst = 0
    psh = 0
    ack = 0
    urg = 0
    window = socket.htons (8192)    # max windows size
    check = 0
    urg_ptr = 0
    offset_res = (doff << 4) + 0
    tcp_flags = fin + (syn<<1) + (rst<<2) + (psh<<3) + (ack<<4) + (urg<<5)
    tcp_header = pack('!HHLLBBHHH', source, dest_port, seq, ack_seq, offset_res, tcp_flags, window, check, urg_ptr)
    
    ''' headers option '''
    source_address = socket.inet_aton( source_ip )
    dest_address = socket.inet_aton( dest_ip )
    placeholder = 0
    protocol = socket.IPPROTO_TCP
    tcp_length = len(tcp_header)
    psh = pack('!4s4sBBH', source_address, dest_address, placeholder, protocol, tcp_length);
    psh = psh + tcp_header;
    tcp_checksum = checksum(psh)
    ''' Repack the TCP header and fill in the correct checksum '''
    tcp_header = pack('!HHLLBBHHH', source, dest_port, seq, ack_seq, offset_res, tcp_flags, window, tcp_checksum, urg_ptr)
    
    return tcp_header
def get_host_ip():
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        s.connect(('8.8.8.8', 80))
        source_ip = s.getsockname()[0]
    finally:
        s.close()
 
    return source_ip
def syn_scan(source_ip, dest_ip, des_port) :
    global openNum
    lock.acquire()
    s = CreateSocket(source_ip, dest_ip)
    ip_header = CreateIpHeader(source_ip, dest_ip)
    tcp_header = create_tcp_syn_header(source_ip, dest_ip, des_port)
    packet = ip_header + tcp_header
    s.sendto(packet, (dest_ip, 0))
    data = s.recvfrom(1024) [0][0:]
    ip_header_len = (ord(data[0]) & 0x0f) * 4
    ip_header_ret = data[0: ip_header_len - 1]
    tcp_header_len = (ord(data[32]) & 0xf0)>>2
    tcp_header_ret = data[ip_header_len:ip_header_len+tcp_header_len - 1]#SYN/ACK flags 
    if(ord(tcp_header_ret[13]) == 0x12):
	
	openNum+=1
        print  ("[+] %d open" % des_port)
	
    lock.release()   
    
def main():  
    #setdefaulttimeout(1)  
    source_ip=get_host_ip() #get my ip
    dest_ip=raw_input('Input dest_ip :')
    dest_port=raw_input('Input dest_port:')
    list = dest_port.split(",")
    for i in range(len(list)):
	 if list[i].isdigit():
	 	t = threading.Thread(target=syn_scan, args=(source_ip, dest_ip,int(list[i])))
            	threads.append(t)
            	t.start()
   	 else:
	 	newlist = list[i].split("-")
		startPort = int(newlist[0])
            	endPort = int(newlist[1])
		for i in range(startPort,endPort):
			t = threading.Thread(target=syn_scan, args=(source_ip, dest_ip,i))
            		threads.append(t)
            		t.start()
    for t in threads:
	t.join()
    print('[*] The scan is complete!')
    print('[*] A total of %d open port ' % (openNum))

if __name__=="__main__":
	main()   

运行结果：

主程序

scan.py文件

# -*- coding: UTF-8 -*-
#Python2.7+Ubuntu


#use root privilege to run!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
import TCPCONNECTSCAN
import TCPSYNSCAN
def gui():
	print("*************************************************")
	print("*Command Usage:					*")
	print("*            1:TCP_SYN_SCAN			*")
	print("*            2:TCP_CONNECT_SCAN			*")
	print("*	     3:Quit				*")
	print("*************************************************")
gui()
choice=int(raw_input("Command:"))
while(choice!=3):
	if(choice==1):
		TCPSYNSCAN.main()
	elif(choice==2):
		TCPCONNECTSCAN.main()
	elif(choice==3):
		exit(0)
	else:
		print("Command Error")
		gui()
		choice=int(raw_input("Command:"))
	gui()
	choice=int(raw_input("Command:"))

把两个功能放一块了，heyhey