TCP Port Scan (Ruby版)

一般來講,許多的滲透測試專家大多會用nmap這一類的Port scan 工具,但是往往忽略了,使用該工具所產生的“噪音”（測試的封包量太大,且帶有特定的資訊）,會讓防火牆與IDS容易偵測到,並且遭到阻絕或產生錯誤的偵測資訊.

因此,介紹另一個工具“Hping”給各位參考

hping 官方網頁：

hping is a command-line oriented TCP/IP packet assembler/analyzer. The interface is inspired to the ping(8) unix command, but hping isn't only able to send ICMP echo requests. It supports TCP, UDP, ICMP and RAW-IP protocols, has a traceroute mode, the ability to send files between a covered channel, and many other features.

該工具好處,可以自定封包大小,測試次數...等,
例如:
要測試10.0.0.1  的 80 port是否開啟？
指令： sudo hping3 -S -c 1 10.0.0.1 -p 80


下面自己寫了一個Ruby的多線程版本

Scan.rb

#!/usr/bin/ruby

require 'target_gen.rb'

ip=gets()

scan_result=[]

threads = []

t=Time.now

xx=t.strftime("%Y%m%d-%H%M%S.txt")

myfile=File.new(xx, "w")

start_time=Time.new

my_hscan=Target_gen.new(ip,[23,25,80,110,143,443,1433,3306,3389,5800,5900,8080])

my_hscan.gethosts

my_hscan.getports

my_hscan.targets

(my_hscan.targets.size).times{|i|

  threads << Thread.new(i) { |j|

    scan_result[i] = `#{my_hscan.targets[i]}`

  }

}

threads.each { |aThread|  aThread.join }

print"==============================================================\n"

print"==                    Hping Scan Report                     ==\n"

print"==                      Written by james  Lai       Ver 0.12   ==\n"

print"==============================================================\n"

print "Targets: "+ip.chomp+".1/24\n"

puts "Targets_number: "+my_hscan.gethosts.length.to_s()

puts "Targets_ports: "+my_hscan.getports.length.to_s()

puts "Times:"+my_hscan.targets.length.to_s()

print"==============================================================\n"

myfile.puts("==============================================================\n")

myfile.puts("=========================    Scan Report   ===================\n")

myfile.puts("==============================================================\n")

myfile.puts( "Targets: "+ip.chomp+".1/24\n")

myfile.puts( "Targets_number: "+my_hscan.gethosts.length.to_s())

myfile.puts("Targets_ports: "+my_hscan.getports.length.to_s())

myfile.puts( "Times:"+my_hscan.targets.length.to_s())

myfile.puts("==============================================================\n")

(scan_result.size).times{|i|

if (scan_result[i].match("flags=SA") != nil) and(scan_result[i].match("id=0") == nil)

result=(scan_result[i].gsub("DF","")

ss=result.split(" ")

result = ss[13]+" "+ss[14]+" "+ss[15]+" "+ss[16]+" "+ss[17]+" "+ss[18]+" "+ss[19]

myfile.puts(result.to_s())

end

}

print"==============================================================\n"

puts "Start: "+ start_time.to_s()

stop_time=Time.now

puts "Stop : "+ stop_time.to_s()

puts "Scantime: "+(stop_time-start_time).to_s()+"sec"

print"==============================================================\n"

myfile.puts("==============================================================\n")

myfile.puts("Start: "+ start_time.to_s())

myfile.puts( "Stop : "+ stop_time.to_s())

myfile.puts( "Scantime: "+(stop_time-start_time).to_s()+"sec")

myfile.puts("==============================================================\n")

myfile.close

target_gen.rb

class Target_gen

  def initialize(hosts, ports)

    @a_hosts = hosts

    @a_ports = ports

    @scan_ip=[]

    @scan_str=[]

  end

  

  def getports

  @a_ports.each_index{|i|

j = rand(i+1)

@a_ports[i], @a_ports[j] = @a_ports [j] , @a_ports [i]

}

    return @a_ports 

  end

  def gethosts

@scan_ip = (1..255).to_a

@scan_ip.each_index{|i|

j = rand(i+1)

@scan_ip[i], @scan_ip[j] = @scan_ip [j] , @scan_ip [i]

}

(@scan_ip.size).times{|i|

@scan_ip[i] = @a_hosts.chomp+"."+@scan_ip[i].to_s()

}

    return @scan_ip 

  end 

  

  def targets

nums=0 

(@a_ports.size).times{|i|

(@scan_ip.size).times{|j|

@scan_str[nums] = "sudo hping3 -S -c 1 "+@scan_ip[j].to_s()+" -p "+@a_ports[i].to_s()

nums=nums+1

}

}

return @scan_str

  end

  

end