{"id":1299,"date":"2016-06-12T16:14:20","date_gmt":"2016-06-12T15:14:20","guid":{"rendered":"http:\/\/www.phillips321.co.uk\/?p=1299"},"modified":"2016-06-12T23:00:41","modified_gmt":"2016-06-12T22:00:41","slug":"php-nmap-scan-page","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2016\/06\/12\/php-nmap-scan-page\/","title":{"rendered":"PHP NMAP Scan Page"},"content":{"rendered":"

So I got thinking this weekend that I wanted a simple service to allow me to port scan myself from a remote location. I decided I could SSH on to a box but then i’d need to transmit creds etc… as such I quickly coded up some PHP to allow me to scan what ever IP address my request is coming from. I’ve used a server side variable for this to prevent any client abuse \ud83d\ude09<\/p>\n

The code was pretty simple to write in PHP, however, it was a nightmare trying to ensure the PHP buffer would allow the page to dynamically update.<\/p>\n

Here’s the code:<\/p>\n

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
<\/div><\/td>
<?php<\/span>
\nini_set<\/span><\/a>(<\/span>'zlib.output_compression'<\/span>,<\/span> false<\/span>)<\/span>;<\/span>\/\/ Turn off PHP output compression<\/span>
\nwhile<\/span> (<\/span>@<\/span>ob_end_flush<\/span><\/a>(<\/span>)<\/span>)<\/span>;<\/span>\/\/Flush (send) the output buffer and turn off output buffering<\/span>
\nini_set<\/span><\/a>(<\/span>'implicit_flush'<\/span>,<\/span> true<\/span>)<\/span>;<\/span>\/\/ Implicitly flush the buffer(s)<\/span>
\nob_implicit_flush<\/span><\/a>(<\/span>true<\/span>)<\/span>;<\/span>\/\/ Implicitly flush the buffer(s)<\/span>
\nset_time_limit<\/span><\/a>(<\/span>0<\/span>)<\/span>;<\/span>\/\/Set this so PHP doesn't timeout during a long stream <\/span>
\nheader<\/span><\/a>(<\/span>"Cache-Control: no-cache"<\/span>)<\/span>;<\/span> \/\/set http headers to prevent caching<\/span>
\nheader<\/span><\/a>(<\/span>"Pragma: no-cache"<\/span>)<\/span>;<\/span>\/\/set http headers to prevent caching<\/span>
\nfunction<\/span> scan_target(<\/span>)<\/span>{<\/span>
\n    \/\/ Get the client ip address and ports<\/span>
\n    $ipaddress<\/span> =<\/span> $_SERVER<\/span>[<\/span>'REMOTE_ADDR'<\/span>]<\/span>;<\/span>
\n    if<\/span> (<\/span>filter_var<\/span><\/a>(<\/span>$ipaddress<\/span>,<\/span> FILTER_VALIDATE_IP)<\/span> ===<\/span> false<\/span>)<\/span> {<\/span>echo<\/span> "<pre>Target is not a valid IP<\/pre>"<\/span>;<\/span>exit<\/span><\/a>(<\/span>0<\/span>)<\/span>;<\/span>}<\/span>
\n    $target<\/span> =<\/span> escapeshellarg<\/span><\/a>(<\/span>preg_replace<\/span><\/a>(<\/span>'\/[^0-9.\\']\/'<\/span>,<\/span> ''<\/span>,<\/span> $ipaddress<\/span>)<\/span>)<\/span>;<\/span>
\n    $ports<\/span> =<\/span> escapeshellarg<\/span><\/a>(<\/span>preg_replace<\/span><\/a>(<\/span>'\/[^0-9,\\-\\']\/'<\/span>,<\/span> ''<\/span>,<\/span> htmlspecialchars<\/span><\/a>(<\/span>$_GET<\/span>[<\/span>"ports"<\/span>]<\/span>)<\/span>)<\/span>)<\/span>;<\/span>
\n   
\n    \/\/checks if ports is set to 0 and then forces to top 100 ports<\/span>
\n    if<\/span> (<\/span> $ports<\/span> ==<\/span> "'0'"<\/span>)<\/span> {<\/span>$cmd<\/span> =<\/span> escapeshellcmd<\/span><\/a>(<\/span>"nmap -T4 --stats-every 5 -r -n -Pn --top-ports 100 $target<\/span>"<\/span>)<\/span>;<\/span>
\n    }<\/span> else<\/span> {<\/span>$cmd<\/span> =<\/span> escapeshellcmd<\/span><\/a>(<\/span>"nmap -T4 --stats-every 5 -r -n -Pn -p$ports<\/span> $target<\/span>"<\/span>)<\/span>;<\/span>}<\/span>
\n   
\n    echo<\/span> '<pre>'<\/span>;<\/span>
\n    $a<\/span> =<\/span> popen<\/span><\/a>(<\/span>$cmd<\/span>,<\/span> 'r'<\/span>)<\/span>;<\/span>
\n    while<\/span>(<\/span>$b<\/span> =<\/span> fgets<\/span><\/a>(<\/span>$a<\/span>,<\/span> 4096<\/span>)<\/span>)<\/span> {<\/span>
\n        echo<\/span> $b<\/span>;<\/span>
\n        flush<\/span><\/a>(<\/span>)<\/span>;<\/span>
\n    }<\/span>
\n    pclose<\/span><\/a>(<\/span>$a<\/span>)<\/span>;<\/span>
\n    echo<\/span> '<\/pre>'<\/span>;<\/span>
\n}<\/span>
\n?><\/span>
\n<html><head><title>Port Scan Me<\/title><\/head><body>
\n<form action="" method="get">Custom Ports: (e.g. 53,80,137-139,443,445) <input type="text" name="ports"><input type="submit"><\/form>
\n<form action="" method="get">Default Ports: <select name="ports">
\n    <option value="0">Top 100<\/option>
\n    <option value="21">FTP 21<\/option>
\n    <option value="22">SSH 22<\/option>
\n    <option value="23">Telnet 23<\/option>
\n    <option value="53">DNS 53<\/option>
\n    <option value="80">HTTP 80<\/option>
\n    <option value="139">NetBIOS 139<\/option>
\n    <option value="443">HTTPS 443<\/option>
\n    <option value="445">SMB 445<\/option>
\n    <option value="1433">MSSQL 1433<\/option>
\n    <option value="3306">MySQL 3306<\/option>
\n    <option value="3389">RDP 3389<\/option>
\n    <option value="5632">PCAnywhere 5632<\/option>
\n    <option value="5900">VNC 5900<\/option>
\n<\/select><input type="submit"><\/form>  
\n<?php<\/span>
\nif<\/span>(<\/span>isset<\/span><\/a>(<\/span>$_GET<\/span>[<\/span>"ports"<\/span>]<\/span>)<\/span>)<\/span>{<\/span>
\n    scan_target(<\/span>)<\/span>;<\/span>
\n}<\/span>
\n?><\/span>
\n<\/body><\/html><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n

And a link to the code should you wish to have a go. https:\/\/www.phillips321.co.uk\/downloads\/portscan.php.txt<\/a><\/p>\n

\"Screen<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

So I got thinking this weekend that I wanted a simple service to allow me to port scan myself from a remote location. I decided I could SSH on to a box but then i’d need to transmit creds etc… as such I quickly coded up some PHP to allow me to scan what ever […]<\/p>\n","protected":false},"author":1,"featured_media":1300,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[44,258,417,267,424,453],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1299"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=1299"}],"version-history":[{"count":5,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1299\/revisions"}],"predecessor-version":[{"id":1305,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/1299\/revisions\/1305"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media\/1300"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=1299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=1299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=1299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}