1 importargparse2 importre3 importtime4 importthreading5 from scapy.all import *

6

7 importlogging8 logging.getLogger('scapy.runtime').setLevel(logging.ERROR)9

10

11 classDiscovery_Scan(object):12 '''

13 说明:用于发现扫描14 '''

15

16 def __init__(self,args,timeout=0.5,retry=0):17 self.targets =parse_target(args)18 self.timeout =timeout19 self.retry =retry20

21 defarp_scan(self,pdst):22 #ARP发现扫描

23 ans = sr1(ARP(pdst=pdst),timeout=self.timeout,retry=self.retry,verbose=False)24 ifans:25 if ans[ARP].op == 2: #操作码为2是is-at，是ARP响应

26 print '[+]IP: %s => MAC: %s' %(pdst,ans[ARP].hwsrc)27

28 deficmp_scan(self,dst):29 #ICMP发现扫描

30 ans = sr1(IP(dst=dst)/ICMP(),timeout=self.timeout,retry=self.retry,verbose=False)31 ifans:32 if ans[ICMP].type == 0: #ICMP type为0表示是ICMP echo-reply

33 print '[+]IP:主机%s echo-reply.' %dst34

35 tcp_info ={}36 deftcp_scan(self,dst,port):37 #TCP SYN,发送TCP SYN包，有响应表示端口开放

38 ans,unans = sr(IP(dst=dst)/TCP(sport=RandShort(),dport=port,flags='S'),39 timeout=self.timeout,retry=self.retry,verbose=False)40 ifans.res:41 if ans.res[0][0][IP].dst not inDiscovery_Scan.tcp_info:42 Discovery_Scan.tcp_info[ans.res[0][0][IP].dst] =True43

44 udp_info ={}45 defudp_scan(self,dst,port):46 #UDP，发送UDP包，有响应表示端口开放

47 ans,uans = sr(IP(dst=dst)/UDP(sport=RandShort(),dport=port),48 timeout=self.timeout,retry=self.retry,verbose=False)49 ifans.res:50 if ans.res[0][0][IP].dst not inDiscovery_Scan.udp_info:51 Discovery_Scan.udp_info[ans.res[0][0][IP].dst] =True52

53 classPort_Scan(object):54 '''

55 说明:用于进行端口扫描，判断端口是否开放56 '''

57 def __init__(self,args,timeout=0.5,retry=0):58 self.targets =parse_target(args)59 self.timeout =timeout60 self.retry =retry61

62 syn_port_dict ={}63 defsyn_port_scan(self,dst,port):64 #TCP SYN端口扫描，若SYN包返回携带SYN、ACK(即TCP.flags=18)标志的包，则表明此端口打开。

65 ans,uans = sr(IP(dst=dst)/TCP(sport=RandShort(),dport=port,flags='S'),66 timeout=self.timeout,retry=self.retry,verbose=False)67 ifans:68 first_respons_pkt = ans.res[0][1]69 if first_respons_pkt[TCP] and first_respons_pkt[TCP].flags == 18:70 if first_respons_pkt[IP].src not inPort_Scan.syn_port_dict:71 Port_Scan.syn_port_dict[first_respons_pkt[IP].src] =[first_respons_pkt[TCP].sport]72 else:73 Port_Scan.syn_port_dict[first_respons_pkt[IP].src].append(first_respons_pkt[TCP].sport)74

75 udp_port_dict ={}76 defudp_port_scan(self,dst,port):77 #UDP端口扫描，若UDP端口返回ICMP port-unreachable,则表示端口打开。(排除某些主机对任何UDP端口的探测都响应为ICMP port-unrechable)

78 ans,uans = sr(IP(dst=dst)/UDP(sport=RandShort(),dport=port),79 timeout=self.timeout, retry=self.retry, verbose=False)80 if ans.res and ans.res[0][1].haslayer(UDPerror):81 first_respons_pkt = ans.res[0][1]82 if first_respons_pkt[IP].src not inPort_Scan.udp_port_dict:83 Port_Scan.udp_port_dict[first_respons_pkt[IP].src] =[first_respons_pkt[UDPerror].dport]84 else:85 Port_Scan.udp_port_dict[first_respons_pkt[IP].src].append(first_respons_pkt[UDPerror].dport)86

87 defparse_opt():88 '''

89 @说明：通过argparse模块解析程序传入的参数90 @return:args91 '''

92 usage = 'python %(prog)s [-t target] [--port ports]'

93 description = '简单扫描工具，可以进行存活扫描及端口扫描.\n'\94 '存活扫描包括：ARP扫描、ICMP扫描、TCP扫描、UDP扫描.\n'\95 '端口扫描包括：TCP SYN扫描、TCP ACK扫描、TCP FIN扫描.'

96 epilog = '以上做为说明，祝好运！'

97 parser = argparse.ArgumentParser(usage=usage,description=description,epilog=epilog,version='v1.0')98

99 target_group = parser.add_argument_group('target group',description='用于设置IP、PORT参数')100 target_group.add_argument('--target',dest='target',action='store',101 help='target为IP或IP段，如192.168.1.1，192.168.1.x，或192.168.1.1-254')102 target_group.add_argument('--port',dest='port',action='store',103 help='port为待扫描的端口，如21,80,...或21-80')104

105 ping_group = parser.add_argument_group('ping group',description='用于开启存活扫描相关选项')106 ping_group.add_argument('-p',dest='ping',action='store_true',help='开启存活扫描')107 ping_group.add_argument('--ARP',dest='ARP',action='store_true',help='启动ARP扫描')108 ping_group.add_argument('--ICMP',dest='ICMP',action='store_true',help='启动ICMP扫描')109 ping_group.add_argument('--TCP',dest='TCP',action='store_true',help='启动TCP扫描')110 ping_group.add_argument('--UDP',dest='UDP',action='store_true',help='启动UDP扫描')111

112 port_scan_group = parser.add_argument_group('port scan group',description='用于开启端口扫描相关选项')113 port_scan_group.add_argument('-s',dest='scan',action='store_true',help='开启端口扫描')114 port_scan_group.add_argument('--SYN',dest='SYN',action='store_true',help='开启SYN扫描')115 port_scan_group.add_argument('--ACK',dest='ACK',action='store_true',help='开启ACK扫描')116 port_scan_group.add_argument('--FIN',dest='FIN',action='store_true',help='开启FIN扫描')117 port_scan_group.add_argument('--UPORT', dest='UPORT', action='store_true', help='开启UDP端口扫描')118

119 utils_group = parser.add_argument_group('utils group',description='用于开启扫描过程中的一些实用选项')120 utils_group.add_argument('--timeout',dest='timeout',action='store',type=float,help='设置发包超时时间,默认0.5秒')121 utils_group.add_argument('--retry',dest='retry',action='store',type=int,help='设置发包重试次数，默认不重试')122

123 args =parser.parse_args()124 if not args.ping and notargs.scan:125 print '[-]必须通过-p/-s选项开启一种扫描'

126 print '\n'

127 parser.print_help()128 exit(1)129 elif notargs.target:130 print '[-]必须通过--target选项指定扫描的对象'

131 print '\n'

132 parser.print_help()133 exit(1)134 ifargs.ping:135 if not args.ARP and not args.ICMP and not args.TCP and notargs.UDP:136 args.ICMP = True #若没有指定任何ping扫描方式，则默认选择ICMP扫描

137 print '[+]没有指定任何ping扫描方式，默认选择ICMP扫描'

138 ifargs.scan:139 if not args.SYN and not args.ACK and not args.FIN and notargs.UPORT:140 args.SYN = True #若没有指定任何端口扫描方式，则默认选择SYN扫描

141 print '[+]没有指定任何端口扫描方式，默认选择SYN扫描'

142 if notargs.port:143 args.port = '1-1024' #若没有指定任何扫描端口，则默认扫描1-1024

144 print '[+]没有指定任何扫描端口，默认扫描1-1024'

145

146 returnargs147

148 defparse_target(args):149 '''

150 @说明：用于解析如'192.168.1.1，192.168.1.x，...或192.168.1.1-254'格式的IP为单独的IP，用于解析如'21,80,...或21-80'格式的端口为单独的端口151 @param: args,一个namespace对象152 @return: (ip_list,port_list)153 '''

154 pattern1 = r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$'

155 pattern2 = r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}-\d{1,3}$'

156 pattern3 = r'\d{1,5}$'

157 pattern4 = r'\d{1,5}-\d{1,5}$'

158 ip_list,port_list =None,None159 ifargs.target:160 ifre.search(pattern1,args.target):161 ip_list = args.target.split(',')162 elifre.match(pattern2,args.target):163 _split = args.target.split('-')164 first_ip =_split[0]165 ip_split = first_ip.split('.')166 ipdot4 = range(int(ip_split[3]), int(_split[1]) + 1)167 ip_list = [ip_split[0] + '.' + ip_split[1] + '.' + ip_split[2] + '.' + str(p) for p inipdot4]168 else:169 print '[-]target格式输入有误，请查看帮助！'

170 exit(1)171 ifargs.port:172 ifre.match(pattern4,args.port):173 _split = args.port.split('-')174 port_list = range(int(_split[0]),int(_split[1])+1)175 elifre.search(pattern3,args.port):176 port_list = args.port.split(',')177 else:178 print '[-]port格式输入有误，请查看帮助！'

179 exit(1)180 returnip_list,port_list181

182

183 defmain():184 '''

185 @说明：扫描的主程序，首先根据条件创建Ping扫描或端口扫描对象，然后调用相关的扫描方法进行扫描。186 '''

187 args =parse_opt()188 if args.ping: #是否启动Ping扫描

189 if not args.timeout and notargs.retry:190 obj_ping =Discovery_Scan(args)191 elif args.timeout and notargs.retry:192 obj_ping = Discovery_Scan(args,timeout=args.timeout)193 elif not args.timeout andargs.retry:194 obj_ping = Discovery_Scan(args,retry=args.retry)195 else:196 obj_ping =Discovery_Scan(args,args.timeout,args.retry)197 ip_list =obj_ping.targets[0]198 ifip_list:199 #ARP扫描

200 ifargs.ARP:201 for pdst inip_list:202 t = threading.Thread(target=obj_ping.arp_scan,args=(pdst,))203 t.start()204 while threading.activeCount() != 1: #避免线程还没有运行完就提前输出不全的结果

205 time.sleep(1)206 #ICMP扫描

207 elifargs.ICMP:208 for dst inip_list:209 t = threading.Thread(target=obj_ping.icmp_scan,args=(dst,))210 t.start()211 while threading.activeCount() != 1: #避免线程还没有运行完就提前输出不全的结果

212 time.sleep(1)213 #TCP扫描

214 elifargs.TCP:215 port_list = [80,443,21,22,23,25,53,135,139,137,445,1158,1433,1521,3306,3389,7001,8000,8080,9090]216 print '[+]请稍等，时间较长！'

217 for dst inip_list:218 print '[!]扫描...',dst219 for port inport_list:220 t = threading.Thread(target=obj_ping.tcp_scan,args=(dst,port))221 t.start()222

223 print '[+]正在处理扫描信息.'

224 while threading.activeCount() != 1: #避免线程还没有运行完就提前输出不全的结果

225 time.sleep(1)226

227 if notobj_ping.tcp_info:228 print '\n'

229 print '=' * 20

230 print '[+]未发现在线主机.'

231 else:232 print '\n'

233 print '=' * 20

234 for ip_a insorted(obj_ping.tcp_info.keys()):235 print '[+]主机 %s 在线.' %ip_a236 #UDP扫描

237 elifargs.UDP:238 port_list = [7,9.13,15,37,53,67,68,69,135,137,138,139,445,520]239 print '[+]请稍等，时间较长！'

240 for dst inip_list:241 print '[!]扫描...',dst242 for port inport_list:243 t = threading.Thread(target=obj_ping.udp_scan,args=(dst,port))244 t.start()245

246 print '[+]正在处理扫描信息.'

247 while threading.activeCount() != 1: #避免线程还没有运行完就提前输出不全的结果

248 time.sleep(1)249

250 if notobj_ping.udp_info:251 print '\n'

252 print '=' * 20

253 print '[+]未发现在线主机.'

254 else:255 print '\n'

256 print '=' * 20

257 for ip_a insorted(obj_ping.udp_info.keys()):258 print '[+]主机 %s 在线.' %ip_a259 if args.scan: #是否启动端口扫描

260 if not args.timeout and notargs.retry:261 obj_port =Port_Scan(args)262 elif args.timeout and notargs.retry:263 obj_port = Port_Scan(args,timeout=args.timeout)264 elif not args.timeout andargs.retry:265 obj_port = Port_Scan(args,retry=args.retry)266 else:267 obj_port =Port_Scan(args,args.timeout,args.retry)268

269 ip_list,port_list =obj_port.targets270 if ip_list andport_list:271 ifargs.SYN:272 for dst inip_list:273 print '[!]扫描...',dst274 for port inport_list:275 t = threading.Thread(target=obj_port.syn_port_scan,args=(dst,int(port)))276 t.start()277

278 print '[+]正在处理扫描信息.'

279 while threading.activeCount() != 1: #避免线程还没有运行完就提前输出不全的结果

280 time.sleep(1)281

282 if notobj_port.syn_port_dict:283 print '\n'

284 print '=' * 20

285 print '[+]未发现开放TCP端口.'

286 else:287 print '\n'

288 print '=' * 20

289 for k,v inobj_port.syn_port_dict.items():290 print '[+]主机 %s 开放的TCP端口有：%s' %(k,str(v))291 elifargs.ACK:292 pass #基本不能使用

293 elifargs.FIN:294 pass #基本不能使用

295 elifargs.UPORT:296 for dst inip_list:297 print '[!]扫描...',dst298 for port inport_list:299 t = threading.Thread(target=obj_port.udp_port_scan,args=(dst,int(port)))300 t.start()301

302 print '[+]正在处理扫描信息.'

303 while threading.activeCount() != 1: #避免线程还没有运行完就提前输出不全的结果

304 time.sleep(1)305

306 if notobj_port.udp_port_dict:307 print '\n'

308 print '=' * 20

309 print '[+]未发现开放UDP端口.'

310 else:311 print '\n'

312 print '=' * 20

313 for k,v inobj_port.udp_port_dict.items():314 print '[+]主机 %s 开放的UDP端口有：%s' %(k,str(v))315

316 if __name__ == '__main__':317 try:318 start_time =time.time()319 main()320 stop_time =time.time()321 print '[+]总共耗时'+str(stop_time-start_time)+'秒.'

322 exceptException,e:323 print '[-]执行出错，具体错误见下面信息.'

324 print e