端口扫描技术

使用单线程的简单端口扫描器

程序由以下几部分组成：
1.读取端口及目标服务器
2.测试TCP端口连接
3.输出开放端口结果

#!/usr/bin/python
# -*- coding: utf-8 -*-

import sys
from socket import *

# port_scan.py <host> <start_port>-<end_port>
host = sys.argv[1]
portstrs = sys.argv[2].split('-')

start_port = int(portstrs[0])
end_port = int(portstrs[1])

target_ip = gethostbyname(host)
opened_ports = []

for port in range(start_port, end_port):
    sock = socket(AF_INET, SOCK_STREAM)
    sock.settimeout(10)
result = sock.connect_ex((target_ip, port))
if result == 0:
   opened_ports.append(port)


print("Opened ports:")

for i in opened_ports:
    print(i)

在cmd上测试就可以知道处于开放状态的端口有哪些
这个网站是常用的端口号与其对应的服务：
http://www.docin.com/p-297998574.html

一个使用多线程的简单端口扫描器

#!/usr/bin/python
# -*- coding: utf-8 -*-

import sys
import thread
from socket import *

def tcp_test(port):
sock = socket(AF_INET, SOCK_STREAM)
sock.settimeout(10)
result = sock.connect_ex((target_ip, port))
if result == 0:
    lock.acquire()
    print "Opened Port:",port
    lock.release()


if __name__=='__main__':
    # portscan.py <host> <start_port>-<end_port>    

    host = sys.argv[1]
    portstrs = sys.argv[2].split('-')

    start_port = int(portstrs[0])
    end_port = int(portstrs[1])

    target_ip = gethostbyname(host)

    lock = thread.allocate_lock()

    for port in range(start_port, end_port):
       thread.start_new_thread(tcp_test, (port,))