{"id":1211,"date":"2014-08-12T15:26:27","date_gmt":"2014-08-12T14:26:27","guid":{"rendered":"http:\/\/www.phillips321.co.uk\/?p=1211"},"modified":"2015-05-05T12:36:30","modified_gmt":"2015-05-05T11:36:30","slug":"python-port-scanner-nmap-py","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2014\/08\/12\/python-port-scanner-nmap-py\/","title":{"rendered":"Python Port Scanner – nmap.py"},"content":{"rendered":"

So I decided to write a simple python port scanner but I wanted it to support to TCP, UDP, port ranges (22,23,135-139,443,445,3389 etc) and IP ranges(192.168.0.1\/24, 192.168.10-20, example.com)<\/p>\n

I also wanted to limit the libraries I used for use on locked down systems, thus, we only use socket, sys and argparse.<\/p>\n

The first thing to do was get the code working for a single host and then slowly add bits to it in order to get it working. This is alpha, so your mileage may vary but here it is. Credit to Brandon Sterne<\/a> as I ripped apart his code for a python CIDR converter<\/a>.<\/p>\n

1
2
3
4
5
6
7
8
9
10
11
12
13
<\/div><\/td>
usage: nmap.py [-h] [-v] [-sS] [-sU] [-p PORTS] [-t TARGETS]
\n
\nnmap.py - Replicates limited nmap functionality in python
\n
\noptional arguments:
\n  -h, --help            show this help message and exit
\n  -v, --verbose         Enable this for full output
\n  -sS, --tcpscan        Enable this for TCP scans
\n  -sU, --udpscan        Enable this for UDP scans
\n  -p PORTS, --ports PORTS
\n                        The ports you want to scan (21,22,80,135-139,443,445)
\n  -t TARGETS, --targets TARGETS
\n                        The target(s) you want to scan (192.168.0.1)<\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

And then the code: (but better to download from github<\/a>)<\/p>\n

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
<\/div><\/td>
#-------------------------------------------------------------------------------<\/span>
\n# Name:         nmap.py<\/span>
\n# Purpose:      Replicates limited nmap functionality using python<\/span>
\n# Author:       phillipsme<\/span>
\n# Created:      12\/08\/2014<\/span>
\n# Copyright:    (c) phillipsme 2014<\/span>
\n# Licence:      Free to use, free to have fun!<\/span>
\n# Version:      alpha!!! (0.1)<\/span>
\n# ToDo:         verbose,dont do reverse lookup<\/span>
\n#-------------------------------------------------------------------------------<\/span>
\nimport<\/span> socket<\/span>
\nimport<\/span> argparse
\nimport<\/span> sys<\/span>
\n
\ndef<\/span> main(<\/span>)<\/span>:
\n    parser<\/span> =<\/span> argparse.ArgumentParser<\/span>(<\/span>description=<\/span>'nmap.py - Replicates limited nmap functionality in python'<\/span>)<\/span>
\n    parser<\/span>.add_argument<\/span>(<\/span>'-v'<\/span>,<\/span> '--verbose'<\/span>,<\/span> action=<\/span>'store_true'<\/span>,<\/span> help<\/span>=<\/span>'Enable this for full output'<\/span>)<\/span>
\n    parser<\/span>.add_argument<\/span>(<\/span>'-sS'<\/span>,<\/span> '--tcpscan'<\/span>,<\/span> action=<\/span>'store_true'<\/span>,<\/span> help<\/span>=<\/span>'Enable this for TCP scans'<\/span>)<\/span>
\n    parser<\/span>.add_argument<\/span>(<\/span>'-sU'<\/span>,<\/span> '--udpscan'<\/span>,<\/span> action=<\/span>'store_true'<\/span>,<\/span> help<\/span>=<\/span>'Enable this for UDP scans'<\/span>)<\/span>
\n    parser<\/span>.add_argument<\/span>(<\/span>'-p'<\/span>,<\/span> '--ports'<\/span>,<\/span> default=<\/span>'1-1024'<\/span>,<\/span> help<\/span>=<\/span>'The ports you want to scan (21,22,80,135-139,443,445)'<\/span>)<\/span>
\n    parser<\/span>.add_argument<\/span>(<\/span>'-t'<\/span>,<\/span> '--targets'<\/span>,<\/span> help<\/span>=<\/span>'The target(s) you want to scan (192.168.0.1)'<\/span>)<\/span>
\n    if<\/span> len<\/span>(<\/span>sys<\/span>.argv<\/span>)<\/span>==<\/span>1<\/span>: parser<\/span>.print_help<\/span>(<\/span>)<\/span>;<\/span> sys<\/span>.exit<\/span>(<\/span>0<\/span>)<\/span>
\n    args =<\/span> parser<\/span>.parse_args<\/span>(<\/span>)<\/span>
\n
\n    # Set target (and convert for FQDN)<\/span>
\n    targets=<\/span>[<\/span>]<\/span>
\n    if<\/span> args.targets<\/span>:
\n        if<\/span> '\/'<\/span> in<\/span> args.targets<\/span>: #found cidr target<\/span>
\n            targets =<\/span> returnCIDR(<\/span>args.targets<\/span>)<\/span>
\n        elif<\/span> '-'<\/span> in<\/span> args.targets<\/span>:
\n            targets =<\/span> iprange(<\/span>args.targets<\/span>)<\/span>
\n        else<\/span>:
\n            try<\/span>: targets.append<\/span>(<\/span>socket<\/span>.gethostbyname<\/span>(<\/span>args.targets<\/span>)<\/span>)<\/span> # get IP from FQDN<\/span>
\n            except<\/span>: errormsg(<\/span>"Failed to translate hostname to IP address"<\/span>)<\/span>
\n    else<\/span>: parser<\/span>.print_help<\/span>(<\/span>)<\/span>;<\/span> errormsg(<\/span>"You need to set a hostname"<\/span>)<\/span>
\n
\n    # Set ports<\/span>
\n    if<\/span> args.ports<\/span> ==<\/span> '-'<\/span>: args.ports<\/span> =<\/span> '1-65535'<\/span>
\n    ranges =<\/span> (<\/span>x.split<\/span>(<\/span>"-"<\/span>)<\/span> for<\/span> x in<\/span> args.ports<\/span>.split<\/span>(<\/span>","<\/span>)<\/span>)<\/span>
\n    ports =<\/span> [<\/span>i for<\/span> r in<\/span> ranges for<\/span> i in<\/span> range<\/span>(<\/span>int<\/span>(<\/span>r[<\/span>0<\/span>]<\/span>)<\/span>,<\/span> int<\/span>(<\/span>r[<\/span>-1<\/span>]<\/span>)<\/span> + 1<\/span>)<\/span>]<\/span>
\n
\n    # Output command line args to screen<\/span>
\n    if<\/span> args.verbose<\/span>: printmsg(<\/span>"Arguments used:"<\/span>)<\/span>;<\/span> print<\/span> args ;<\/span>
\n
\n    # Start Scanning<\/span>
\n    for<\/span> target in<\/span> targets:
\n        tcpports,<\/span> udpports =<\/span> portscan(<\/span>target,<\/span>ports,<\/span>args.tcpscan<\/span>,<\/span>args.udpscan<\/span>,<\/span>args.verbose<\/span>)<\/span>
\n
\ndef<\/span> portscan(<\/span>target,<\/span>ports,<\/span>tcp,<\/span>udp,<\/span>verbose)<\/span>:
\n    #target=IPaddr,ports=list of ports,tcp=true\/false,udp=true\/false,verbose=true\/false<\/span>
\n    printmsg(<\/span>(<\/span>"Now scanning %s"<\/span> % (<\/span>target)<\/span>)<\/span>)<\/span>
\n    tcpports=<\/span>[<\/span>]<\/span>
\n    udpports=<\/span>[<\/span>]<\/span>
\n    if<\/span> tcp:
\n        for<\/span> portnum in<\/span> ports:
\n            try<\/span>:
\n                s =<\/span> socket<\/span>.socket<\/span>(<\/span>socket<\/span>.AF_INET<\/span>,<\/span> socket<\/span>.SOCK_STREAM<\/span>)<\/span>
\n                s.settimeout<\/span>(<\/span>0.01<\/span>)<\/span>
\n                s.connect<\/span>(<\/span>(<\/span>target,<\/span> portnum)<\/span>)<\/span>
\n            except<\/span> Exception<\/span>:
\n                failvar =<\/span> 0<\/span>
\n                if<\/span> verbose: print<\/span> "%d\/tcp \\t<\/span>closed"<\/span> % (<\/span>portnum)<\/span>
\n            else<\/span>:
\n                print<\/span> "%d\/tcp \\t<\/span>open"<\/span>% (<\/span>portnum)<\/span>
\n                tcpports.append<\/span>(<\/span>portnum)<\/span>
\n            s.close<\/span>(<\/span>)<\/span>
\n    if<\/span> udp:
\n        for<\/span> portnum in<\/span> ports:
\n            try<\/span>:
\n                s =<\/span> socket<\/span>.socket<\/span>(<\/span>socket<\/span>.AF_INET<\/span>,<\/span> socket<\/span>.SOCK_DGRAM<\/span>)<\/span>
\n                s.settimeout<\/span>(<\/span>0.1<\/span>)<\/span>
\n                s.sendto<\/span>(<\/span>"--TEST LINE--"<\/span>,<\/span> (<\/span>target,<\/span> portnum)<\/span>)<\/span>
\n                recv,<\/span> svr =<\/span> s.recvfrom<\/span>(<\/span>255<\/span>)<\/span>
\n            except<\/span> Exception<\/span>,<\/span> e:
\n                try<\/span>: errno<\/span>,<\/span> errtxt =<\/span> e
\n                except<\/span> ValueError<\/span>:
\n                    print<\/span> "%d\/udp \\t<\/span>open"<\/span>% (<\/span>portnum)<\/span>
\n                    udpports.append<\/span>(<\/span>portnum)<\/span>
\n                else<\/span>:
\n                    if<\/span> verbose: print<\/span> "%d\/udp \\t<\/span>closed"<\/span> % (<\/span>portnum)<\/span>
\n            s.close<\/span>(<\/span>)<\/span>
\n    printmsg(<\/span>(<\/span>"%i open TCP ports, %i open UDP ports of %i ports scanned"<\/span> % (<\/span>len<\/span>(<\/span>tcpports)<\/span>,<\/span>len<\/span>(<\/span>udpports)<\/span>,<\/span>len<\/span>(<\/span>ports)<\/span>)<\/span>)<\/span>)<\/span>
\n    return<\/span> tcpports,<\/span> udpports
\n
\ndef<\/span> errormsg(<\/span>msg)<\/span>: print<\/span> "[!] Error: %s"<\/span> % (<\/span>msg)<\/span> ;<\/span> sys<\/span>.exit<\/span>(<\/span>1<\/span>)<\/span>
\ndef<\/span> printmsg(<\/span>msg)<\/span>: print<\/span> "[+] nmap.py: %s"<\/span> % (<\/span>msg)<\/span>
\n
\ndef<\/span> iprange(<\/span>addressrange)<\/span>: # converts a ip range into a list<\/span>
\n    list<\/span>=<\/span>[<\/span>]<\/span>
\n    first3octets =<\/span> '.'<\/span>.join<\/span>(<\/span>addressrange.split<\/span>(<\/span>'-'<\/span>)<\/span>[<\/span>0<\/span>]<\/span>.split<\/span>(<\/span>'.'<\/span>)<\/span>[<\/span>:3<\/span>]<\/span>)<\/span> + '.'<\/span>
\n    for<\/span> i in<\/span> range<\/span>(<\/span>int<\/span>(<\/span>addressrange.split<\/span>(<\/span>'-'<\/span>)<\/span>[<\/span>0<\/span>]<\/span>.split<\/span>(<\/span>'.'<\/span>)<\/span>[<\/span>3<\/span>]<\/span>)<\/span>,<\/span>int<\/span>(<\/span>addressrange.split<\/span>(<\/span>'-'<\/span>)<\/span>[<\/span>1<\/span>]<\/span>)<\/span>+1<\/span>)<\/span>:
\n        list<\/span>.append<\/span>(<\/span>first3octets+str<\/span>(<\/span>i)<\/span>)<\/span>
\n    return<\/span> list<\/span>
\n
\ndef<\/span> ip2bin(<\/span>ip)<\/span>:
\n    b =<\/span> ""<\/span>
\n    inQuads =<\/span> ip.split<\/span>(<\/span>"."<\/span>)<\/span>
\n    outQuads =<\/span> 4<\/span>
\n    for<\/span> q in<\/span> inQuads:
\n        if<\/span> q !=<\/span> ""<\/span>: b +=<\/span> dec2bin(<\/span>int<\/span>(<\/span>q)<\/span>,<\/span>8<\/span>)<\/span>;<\/span> outQuads -=<\/span> 1<\/span>
\n    while<\/span> outQuads ><\/span> 0<\/span>: b +=<\/span> "00000000"<\/span>;<\/span> outQuads -=<\/span> 1<\/span>
\n    return<\/span> b
\n
\ndef<\/span> dec2bin(<\/span>n,<\/span>d=<\/span>None<\/span>)<\/span>:
\n    s =<\/span> ""<\/span>
\n    while<\/span> n><\/span>0<\/span>:
\n        if<\/span> n&1<\/span>: s =<\/span> "1"<\/span>+s
\n        else<\/span>: s =<\/span> "0"<\/span>+s
\n        n >>=<\/span> 1<\/span>
\n    if<\/span> d is<\/span> not<\/span> None<\/span>:
\n        while<\/span> len<\/span>(<\/span>s)<\/span><<\/span>d: s =<\/span> "0"<\/span>+s
\n    if<\/span> s ==<\/span> ""<\/span>: s =<\/span> "0"<\/span>
\n    return<\/span> s
\n
\ndef<\/span> bin2ip(<\/span>b)<\/span>:
\n    ip =<\/span> ""<\/span>
\n    for<\/span> i in<\/span> range<\/span>(<\/span>0<\/span>,<\/span>len<\/span>(<\/span>b)<\/span>,<\/span>8<\/span>)<\/span>:
\n        ip +=<\/span> str<\/span>(<\/span>int<\/span>(<\/span>b[<\/span>i:i+8<\/span>]<\/span>,<\/span>2<\/span>)<\/span>)<\/span>+"."<\/span>
\n    return<\/span> ip[<\/span>:-1<\/span>]<\/span>
\n
\ndef<\/span> returnCIDR(<\/span>c)<\/span>:
\n    parts =<\/span> c.split<\/span>(<\/span>"\/"<\/span>)<\/span>
\n    baseIP =<\/span> ip2bin(<\/span>parts[<\/span>0<\/span>]<\/span>)<\/span>
\n    subnet =<\/span> int<\/span>(<\/span>parts[<\/span>1<\/span>]<\/span>)<\/span>
\n    ips=<\/span>[<\/span>]<\/span>
\n    if<\/span> subnet ==<\/span> 32<\/span>: return<\/span> bin2ip(<\/span>baseIP)<\/span>
\n    else<\/span>:
\n        ipPrefix =<\/span> baseIP[<\/span>:-(<\/span>32<\/span>-subnet)<\/span>]<\/span>
\n        for<\/span> i in<\/span> range<\/span>(<\/span>2<\/span>**(<\/span>32<\/span>-subnet)<\/span>)<\/span>: ips.append<\/span>(<\/span>bin2ip(<\/span>ipPrefix+dec2bin(<\/span>i,<\/span> (<\/span>32<\/span>-subnet)<\/span>)<\/span>)<\/span>)<\/span>
\n        return<\/span> ips
\n
\nif<\/span> __name__ ==<\/span> '__main__'<\/span>:
\n    main(<\/span>)<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

And for the sample output:<\/p>\n

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
<\/div><\/td>
C:\\Users\\phillipsme\\Documents>python nmap.py -sS -sU -p 22,23,80,123,135-139,427,443,445,3389,8081-8082 -t 127.0.0.1\/30
\n[+] nmap.py: Now scanning 127.0.0.0
\n22\/udp  open
\n23\/udp  open
\n80\/udp  open
\n123\/udp         open
\n135\/udp         open
\n136\/udp         open
\n137\/udp         open
\n138\/udp         open
\n139\/udp         open
\n427\/udp         open
\n443\/udp         open
\n445\/udp         open
\n3389\/udp        open
\n8081\/udp        open
\n8082\/udp        open
\n[+] nmap.py: 0 open TCP ports, 15 open UDP ports of 15 ports scanned
\n[+] nmap.py: Now scanning 127.0.0.1
\n135\/tcp         open
\n445\/tcp         open
\n3389\/tcp        open
\n8081\/tcp        open
\n123\/udp         open
\n427\/udp         open
\n3389\/udp        open
\n8081\/udp        open
\n8082\/udp        open
\n[+] nmap.py: 4 open TCP ports, 5 open UDP ports of 15 ports scanned
\n[+] nmap.py: Now scanning 127.0.0.2
\n135\/tcp         open
\n445\/tcp         open
\n3389\/tcp        open
\n8081\/tcp        open
\n123\/udp         open
\n427\/udp         open
\n3389\/udp        open
\n8081\/udp        open
\n8082\/udp        open
\n[+] nmap.py: 4 open TCP ports, 5 open UDP ports of 15 ports scanned
\n[+] nmap.py: Now scanning 127.0.0.3
\n135\/tcp         open
\n445\/tcp         open
\n3389\/tcp        open
\n8081\/tcp        open
\n123\/udp         open
\n427\/udp         open
\n3389\/udp        open
\n8081\/udp        open
\n8082\/udp        open
\n[+] nmap.py: 4 open TCP ports, 5 open UDP ports of 15 ports scanned
\n
\nC:\\Users\\phillipsme\\Documents><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n","protected":false},"excerpt":{"rendered":"

So I decided to write a simple python port scanner but I wanted it to support to TCP, UDP, port ranges (22,23,135-139,443,445,3389 etc) and IP ranges(192.168.0.1\/24, 192.168.10-20, example.com) I also wanted to limit the libraries I used for use on locked down systems, thus, we only use socket, sys and argparse. The first thing to […]<\/p>\n","protected":false},"author":1,"featured_media":1213,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[258,424,111,425,268],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1211"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=1211"}],"version-history":[{"count":3,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1211\/revisions"}],"predecessor-version":[{"id":1229,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1211\/revisions\/1229"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media\/1213"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=1211"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=1211"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=1211"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}