python3-端口掃描(TCP_ACK掃描，NULL掃描，windows掃描，xmas掃描)

接上文

• 掃描方式4：TCP_ACK掃描

from scapy.layers.inet import IP, TCP
from scapy.sendrecv import sr, sr1

'''
只能測試linux機器
通過設置flags位為ACK,不回復表示端口關閉或被過濾，如果回復的數據包TTL小於等於64表示端口開放，大於64端口關閉(windows)
'''

def fin_scan(ip, port):
    p = IP(dst=ip) / TCP(dport=int(port), flags="A")
    ans = sr1(p, timeout=1, verbose=1)
    print(ans)
    if ans == None:
        print(ip, "port", port, "is close.")
    else:
        if ans != None and ans.ttl <= 64:
            print(ip, "port", port, "is open.")
        elif ans != None and ans.ttl > 64:
            print(ip, "port", port, "is closed.")

if __name__ == '__main__':
    ip = '192.168.0.110'
    port = 445
    fin_scan(ip, port)

 

• 掃描方式5：NULL掃描

from scapy.layers.inet import IP, TCP
from scapy.sendrecv import sr, sr1

'''
適用於Linux設備
通過設置flags位為空,不回復則表示端口開啟，回復並且回復的標志位為RS表示端口關閉
'''
def fin_scan(ip, port):
    p = IP(dst=ip) / TCP(dport=int(port), flags="")
    ans = sr1(p, timeout=1, verbose=1)
    print(ans)
    if ans == None:
        print(ip, "port", port, "is open.")
    elif ans != None and ans[TCP].flags == 'RA':
        ans.display()
        print(ip, "port", port, "is closed.")

if __name__ == '__main__':
    ip = '192.168.0.110'
    port = 55
    print()
    fin_scan(ip,port)

 

• 掃描方式6：windows掃描

from scapy.layers.inet import IP, TCP
from scapy.sendrecv import sr, sr1

'''
只能測試linux機器
通過設置flags位為ACK,不回復表示端口關閉或被過濾，如果回復的數據包TTL小於等於64表示端口開放，大於64端口關閉(windows)
'''

def windowScan(target,ports):
    print("tcp window掃描 %s with ports %s" % (target, ports))
    window_scan_resp = sr1(IP(dst=target)/TCP(dport=ports,flags="A"),timeout=5)
    print(str(type(window_scan_resp)))
    if (str(type(window_scan_resp))=="<class 'NoneType'>"):
        print(ports,"close")
    elif(window_scan_resp.haslayer(TCP)):
        if(window_scan_resp.getlayer(TCP).window == 0):
            print(ports,"close")
        elif(window_scan_resp.getlayer(TCP).window > 0):
            print(ports,"open")
    else:
        print(ports,"close")

if __name__ == '__main__':
    ip = '192.168.0.110'
    port = 445

    windowScan(ip, port)

 

• 掃描方式7：xmas掃描

from scapy.layers.inet import IP, TCP, ICMP
from scapy.sendrecv import sr, sr1

'''
適用於Linux設備
通過設置flag位FPU
    如果未回復表示端口開啟，
    如果回復RA表示端口關閉
    如果返回ICMP狀態包，數據類型3，狀態碼1，2，3，9，10，13表示端口已被過濾
'''

def fin_scan(ip, port):
    p = IP(dst=ip) / TCP(dport=int(port), flags="FPU")
    ans = sr1(p, timeout=1, verbose=1)
    print(ans)
    if ans == None:
        print(ip, "port", port, "is open.")
    elif ans != None and ans[TCP].flags == 'RA':
        ans.display()
        print(ip, "port", port, "is closed.")
    elif (ans.haslayer(ICMP)):
        if (int(ans.getlayer(ICMP).type) == 3
                and int(ans.getlayer(ICMP).code) in [1, 2, 3, 9, 10, 13]):
            print(port, "過濾")


if __name__ == '__main__':
    ip = '192.168.142.129'
    port = 445
    fin_scan(ip, port)