[ 笔 记 ] 主动信息收集_004 (四层发现)

主动信息收集[3]{
发现_四层发现:
设计目标: IP是否在线, 而非端口是否开放;
优点:
可路由且结果可靠 ;;探测相应的端口, 根据端口的返回结果判断IP是否在线
不太可能被防火墙过滤;
甚至可以发现所有端口都被过滤的主机;
缺点:
基于状态过滤的防火墙可能过滤扫描;
;;;状态检测防火墙在网络层有一个检查引擎截获数据包并抽取出与应用层状态有关的信息，并以此为依据决定对该连接是接受还是拒绝;一般也包括一些代理级的服务，它们提供附加的对特定应用程序数据内容的支持
全端口扫描速度慢;

TCP:
	未经请求的 ACK : RST
	SYN : SYN/ACK , RST
UDP:
	ICMP 端口不可达  ;;端口为开放(ip在线)

scapy:
	i = IP(dst="192.168.31.1")
	t = TCP(flags="A")
	req = (i/t)
	ans = sr1(req)

	ans = (IP(dst="192.168.31.1")/TCP(dport=80,flags="A"),timeout=1)

	;;若ip在线,会返回一个flags="R"的TCP包(存在特例,百度的服务器就不会给出响应,这种情况直接ping来判断即可)

	udp: 选择一个不常用的udp端口!
	;;若主机在线且该udp端口未开放:
	;;返回ICMP type:3 code:3 (端口不可达数据包)
	;;结果似乎不是很可靠

}

tcp扫描Python脚本:
多进程版: #似乎并不快(应该是我在哪里写错了, 目前尚未想明白)

#!/usr/bin/python3
#-*-coding:utf-8-*-

from scapy.all import *
from multiprocessing  import Process,Queue
import optparse

class opt1:
    def __init__(self):
        parser = optparse.OptionParser()
        parser.add_option('-p','--prefix',dest="prefix",help='like 192.168.31.')
        self.options,self.args = parser.parse_args()

class myProcess(Process):
    def __init__(self,q):
        Process.__init__(self)
        self.q = q
    def run(self):
        print("[*] Strating ", self.pid)
        while not self.q.empty():
            pinger(self.q)
        print("[*] Exiting ", self.pid)

def pinger(q):
    ip = q.get(timeout=1)
    try:
        res = sr1(IP(dst=str(ip))/TCP(dport=2222,flags='A'),verbose=False,timeout=1)
        if res[TCP].flags==4:
            print(res[IP].src)
    except:
        pass

def main():
    opt12 = opt1()
    processNames = []
    for i in range(10):
        processNames.append("process" + str(i))
    workQueue = Queue(255)
    iplist = []
    for j in range(255):
        iplist.append(str(opt12.options.prefix.replace(" ","")) + str(j))
    for ips in iplist:
        workQueue.put(ips)
    for i in range(10):
        p = myProcess(workQueue)
        p.daemon = True
        p.start()
        p.join()
    print("[*] Completed!!!")

if __name__ == "__main__":
    main()

多线程版: #速度比串行还是快上很多的

#!/usr/bin/python3
#-*-coding:utf-8-*-

import threading
#import requests
from scapy.all import *
import queue as Queue
import optparse

iplist = []

class opt1:
    def __init__(self):
        parser = optparse.OptionParser()
        parser.add_option('-a','--addr',dest='addr',help='A range of ipaddresses like: 192.168.31.0/24')
#        parser.add_option('')

        self.options,self.args=parser.parse_args()
#        print(self.options, self.args)


class myThread(threading.Thread):
    def __init__(self,name,q):
        threading.Thread.__init__(self)
        self.name = name
        self.q = q
    def run(self):
        print("[*] Starting "+ self.name)
        while True:
            try:
                ping(self.name,self.q)
            except:
                break
        print("[*] Exiting " + self.name)


#fh = open("a13.txt","a+")
def ping(threadName, q):
    ips = q.get(timeout=1)
    try:
#        res = sr1(IP(dst=ips)/ICMP()/"folkqasswecan",timeout=1,verbose=False)
        res = sr1(IP(dst=ips)/TCP(dport=2222,flags='A'),timeout=1,verbose=False)
        if res == None:
            pass
        else:
            print("[+] " +ips + "  is alive!")
    except:
        pass

def main():
    threads = []
    opt123 = opt1()
    ipL = opt123.options.addr.split('.')
#    lenth = len(ipL)
    if len(ipL) != 4:
        print("[-]Error: What's your problem???")
        print("[!] Please use ./threadping.py -h to see the usages!!!")
        exit(1)
    for ipS in ipL:
        po = ipS.find('/')
        if po == -1:
            continue
        else:
            ipSe = ipS.split('/')[1]
            break
    threadList = ["Thread-1","Thread-2","Thread-3","Thread-4","Thread-5","Thread-6","Thread-7","Thread-8","Thread-9","Thread-10","Thread-11","Thread-12","Thread-13","Thread-14"]
    if (int(ipSe) == 24):
        workQueue = Queue.Queue(255)
        for i in range(1,255):
            iplist.append((str(ipL[0]) + '.' + str(ipL[1]) +'.' + str(ipL[2]) + '.' +str(i)))
    for tName in threadList:
        thread = myThread(tName, workQueue)
        thread.start()
        threads.append(thread)
    for ipsss in iplist:
        workQueue.put(ipsss)
    for t in threads:
        t.join()
    print("[*] Exitting...")
#    print(iplist)

if __name__ == "__main__":
    main()

udp扫描脚本(多线程版):

#!/usr/bin/python3
#-*-coding:utf-8-*-

import threading
from scapy.all import *
import queue as Queue

prefix = "192.168.31."

class myThread(threading.Thread):
    def __init__(self,name,q):
        threading.Thread.__init__(self)
        self.name = name
        self.q = q
    def run(self):
        while True:
            try:
                udpscan(self.name,self.q)
            except:
                break

def udpscan(name, q):
    ip = q.get(timeout=1)
    try:
        ans = sr1(IP(dst=ip)/UDP(dport=38438),verbose=False,timeout=1)
#        if ans == None:
#            pass
        if ans[IP].proto == 1:  #ip上层是icmp协议的情况
            print("[+] " + ip + " is alive (scanned by udp)")
        else:
            pass
    except:
        pass

def main():
    threads = []
    threadList = []
    workQueue = Queue.Queue(255)
    for i in range(16):
        threadList.append(str(i))
    for tName in threadList:
        thread = myThread(tName, workQueue)
        thread.start()
        threads.append(thread)
    for j in range(255):
        workQueue.put(prefix + str(j))
    for t in threads:
        t.join()
    print("[*] Completed!!!")

if __name__ == "__main__":
    main()