端口扫描技术深度解析（安全服务日常工作之大量端口状态扫描）
端口扫描技术深度解析（安全服务日常工作之大量端口状态扫描）import nmap import threading from openpyxl import load_workbook from xlwt import Workbook wk = Workbook(encoding='utf-8') wsheet = wk.add_sheet('Worksheet') co = {} ls = [] def read_excel_file(): wb = load_workbook('test/diqu.xlsx') #读取excel文件 # sheets = wb.get_sheet_names() # print(sheets) sheet = wb['暴露面资产全量'] # print(sheet) m = sheet[&#
使用python模块nmap，读取excel数据对多个ip端口探活扫描我一个响指下去，每个人都要少一个睾丸。。。
pip list #cmd或powershell下 查看已安装模块，至于pip命令环境变量，自己解决 pip install python-nmap
编写简单的nmap单端口跑一下看看效果。
'''如果安装了python-nmap模块还不能使用，那就自行安装nmap图形化界面，然后添加到环境变量里，这样就ok了，我的就是这样；'''
import nmap
np = nmap.PortScanner()
a = np.scan(hosts='42.247.22.192' ports='80' arguments='-v -n -T4')
print(a)
返回结果： （重要的地方我已标红，主要就是看返回端口状态和服务名）
{'nmap': {'command_line': 'nmap -oX - -p 80 -v -n -T4 42.247.22.192' 'scaninfo': {'tcp':
{'method': 'syn' 'services': '80'}} 'scanstats': {'timestr': 'Thu Jun 10 11:31:57 2021'
'elapsed': '1.72' 'uphosts': '1' 'downhosts': '0' 'totalhosts': '1'}} 'scan': {'42.247.22.192':
{'hostnames': [{'name': '' 'type': ''}] 'addresses': {'ipv4': '42.247.22.192'} 'vendor':
{} 'status': {'state': 'up' 'reason': 'syn-ack'} 'tcp': {80: {'state': 'open' 'reason': 'syn-ack' 'name': 'http'
'product': '' 'version': '' 'extrainfo': '' 'conf': '3' 'cpe': ''}}}}}
2、下面对得到的数据整理一下输出，让他看起来简洁一些
import nmap
np = nmap.PortScanner()
a = np.scan(hosts='42.247.22.192' ports='80' arguments='-v -n -T4')
ip = '42.247.22.192'
for i in a['scan'][ip]['tcp'].keys():
state = a['scan'][ip]['tcp'][i]['state']
name = a['scan'][ip]['tcp'][i]['name']
print(ip i state name)
返回结果： 42.247.22.192 80 open http
看着整洁多了。
后面关于excel读取和线程的代码我直接贴了，今天事情多不细说了。。
3、使用python调用excel模块和线程模块，读取excel数据，对多条数据进行扫描。import nmap
import threading
from openpyxl import load_workbook
from xlwt import Workbook
wk = Workbook(encoding='utf-8')
wsheet = wk.add_sheet('Worksheet')
co = {}
ls = []
def read_excel_file():
wb = load_workbook('test/diqu.xlsx') #读取excel文件
# sheets = wb.get_sheet_names()
# print(sheets)
sheet = wb['暴露面资产全量']
# print(sheet)
m = sheet['G'] #读取excelG列，我的G列是 ip:port 例：1.1.1.1:80
for cell in m: #这个for循环用于分割ip和端口，存到co字典
# print(cell.value)
mn = cell.value.split(':')
if mn[0] in co:
co[mn[0]].append(mn[1])
else:
try:
co[mn[0]] = [mn[1]]
except:
co[mn[0]] = []
def thread(ip_port): # 设置线程
thread_num = threading.Semaphore(20) # 设置线程数
thread_list = []
for IP port in ip_port.items(): # 创建线程
t = threading.Thread(target=nmap_ping_scan args=(IP port thread_num ))
thread_list.append(t)
# print(t)
for t in thread_list: # 开始线程
t.start()
for t in thread_list: # 等待线程
t.join()
print('线程结束')
def nmap_ping_scan(ip port thread_num): #使用nmap扫描，结果存入ls列表
global ls
strport = ' '.join(ports for ports in port)
thread_num.acquire() # 线程锁
try:
nm = nmap.PortScanner()
global result
np = nm.scan(hosts=ip ports=strport arguments="-v -n -T4")
for i in np['scan'][ip]['tcp'].keys():
state = np['scan'][ip]['tcp'][i]['state']
name = np['scan'][ip]['tcp'][i]['name']
ls.extend([[ip i state name]])
# print(ip i state)
except Exception as e:
# print(e)
pass
thread_num.release()
def excel_write(ls): #把ls列表的数据保存到新的excel中
try:
for u in range(len(ls)):
p = 0
for k in ls[u]:
wsheet.write(u p k)
p = 1
# print(u p k)
except:
pass
if __name__ == '__main__': #程序启动
read_excel_file()
thread(co)
excel_write(ls)
# print(ls)
wk.save('ceshi.xls')
# nmap_dan_scan(co)
# print(ls)
#ok，上述就是全部代码了，上面是开了线程的，下面再加个单线程的方法吧
#使用方法，把def thread 和 def nmap_ping_scan 注释掉
# 再最后if里把 nmap_dan_scan(co) 注释解掉，上面俩个调用注释掉就行。
def nmap_dan_scan(ip_port): #单线程跑跑
for ip port in ip_port.items():
strport = ' '.join(ports for ports in port)
try:
nm = nmap.PortScanner()
np = nm.scan(hosts=ip ports=strport arguments="-v -n -T4")
for i in np['scan'][ip]['tcp'].keys():
state = np['scan'][ip]['tcp'][i]['state']
print(ip i state)
except:
pass
扫描的结果大概就是这个样子。
#注#如果不想使用脚本这么麻烦的话，建议使用masscan命令比较简洁，这个命令有时扫描会存在波动，大多情况下还是不错的；（我是在centos下运行的）
写个平时用的栗子：masscan -p0-65535 -iL ip.txt --rate=2000 > masscan-scan.txt
