Original subtitles

Welcome back.

We are about to start our first coding project, are you ready to create your own first tool for hacking?

We are going to create our tool using Python three.

And since Python is out of scope for discourse, I won't be explaining Python basics.

However, I will give my best to explain what we are exactly doing inside of our code for anyone that

hasn't programmed before.

Now I know what you're thinking.

Programming is not needed for hacking.

That is true.

However, learning programming will help you understand how different tools work in greater details,

and it will also allow you to create and weaponize your own tools that you can use.

My advice for anyone that is learning ethical hacking and penetration testing is to, at some point

of your journey, learn a programming language, since if you're only using tools that other people

create, you're limited to their tools.

Now, these programming projects you can watch as we go through the course, or you can skip it until

you finish entire course and then get back to them.

It is completely up to you nonetheless.

Let's get straight into creating our first stop.

Here we are in our clinics.

So how are we going to approach this?

Well, for some of you that already have programming experience and already know Python, feel free

to call this program wherever you want.

You can code it on your host machine.

You can code it in your clinics machine, whatever you feel the best.

You can also use any editor you want.

But for you that haven't programmed before and have no idea what I'm talking about, what we are going

to do is we are going to open our terminal.

And inside of our desktop directory, we we're going to create a directory called Tool's.

Now, you will notice we got it right here on the screen.

And if we change the directory to that directory.

Right here, we will create our program and we are going to put our code inside of a nano ed. Now,

we are already familiar as to how we can use nano set to open a file.

We want to type Nano and then the file name.

In our case, we are creating a Python program, so it needs to have extension.

And since we just finished our scanning section, we will be creating a port scanner.

It will not be an advance SportsCenter like map, but we are going to see how we can create the simple

one just to better understand how scanning of ports work.

So let's type now and then port scanner p y and this will automatically open up our file here.

We are going to type in our code.

The reason why we are not using anything else to type in our code is because Neno Ed is really simple

and easy to use.

First thing that we are going to do is we are going to import the libraries that we are going to need

for this project.

The first library is called Socket Library and we import them like this.

This import command just loads this library and we need this library to be able to communicate with

other machines using TCP and UDP protocols.

And another library that we are going to use is called Term Color Library.

And we're only going to need this library in order to print some statements in different colors.

So nothing else besides that, let us create the base of our program.

So the first thing we need to do whenever we are creating some type of a connection over TCP UDP, we

need to initiate a socket object.

And socket objects are also called socket descriptors and they are used for Internet communication to

initiate the socket object in Python.

We can call that object SOC, for example, and to initiate it with type equals and then socket socket.

So what we're basically doing right here is we're calling this library and calling the socket function

from that library.

This will initiate the socket object for us and it will be stored right here.

And all we are left to do since Python is an easy programming language, is we need to connect to our

target and our port.

And for that, we're going to use our socket object and the connect function onto our socket object.

This connect function requires two different parameters that we specify between two open and two closed

brackets, and those parameters are IP address and also port.

But these are something that we have not defined yet.

Our program does not know what an IP address is or what the port is.

So what I'm going to do is I will create the function right here and to initiate the function, I just

typedef and then the function name, this function name will be called Scan Port and it will take two

parameters, which will be these two parameters.

So it's Capitán.

And let's face them right here, these are going to be the two parameters that will function will take

and these two lines of code will belong to our function in order to make them belong.

You just tab once both of these lines and they will belong to this cannot function.

Now that we try to connect, there is logically one thing that we need to do, this connect function

will either succeed so we will manage to connect port or it will not succeed.

We won't be able to connect to that port.

So these are two different options once we manage to connect.

That means that the port is open.

And if we don't manage to connect, that means that the port is closed.

And what we are going to do to figure out whether a certain port is closed or opened, we're going to

use try and accept statement and to specify, try and accept statement.

We can do something like this in the first line of our function.

We type try and then we tap these two lines to belong to the tri statement.

And down here we also add except make sure to add two dots at the end.

And what this means is that inside of our function it will try to initiate the socket object and then

it will try to connect onto a certain port on a certain IP address that will specify later.

If it manages to do that, then we can print something like print the port opened.

We can specify something like this.

If it doesn't manage to connect, then it will proceed to this except statement and then we can print

port closed.

All right.

So simple as that.

Now, there are a few things that are wrong with this function.

First of all, we're just printing port opened, so once we try to connect to port, we will not know

which port is open, which port is closed, since we didn't specify a number to specify exactly which

port is open.

What I'm going to do is type port opened and then plus and then I can specify a string of port.

And remember, port is our parameter for our function.

And what this string function does is it converts the port, which is an integer number, most likely

to be a string, so it can print it out using this print statement.

What I'm going to do also is that space right here.

So we print this more nicely.

And right here I will add the plus sign, which means that we successfully discovered an open port and

down here we're going to do the same thing.

So we're going to print sign, which means port is closed and then we're going to add the plus the string

of port.

Another thing we will do in case we find out in open court is we can close the socket object.

Since we successfully completed an action, we found an open port.

We can close the socket object.

OK, so this is our base function for now, and we're going to leave it like this.

But there are a few more things that we need to specify, first of all, we want to prompt to the user

of this program what IP address or what target they want to scan.

So outside of dysfunction, we can create a variable called target or targets, whatever you like,

and that variable will be equal to input.

And this input function allows the user of the program once they run the program to input any string

that they want.

And here we will specify to them that we need a target.

So enter Target to scan.

Once they enter a target, we can also ask them for Port

Port to scan.

Now, trust me, I know what you're thinking right here.

This is too simple.

We're only scanning one port on a target, so we don't really want to do that.

We want to specify right here ports.

So this will be enter how many ports you want to scan so they can scan 100 ports or a thousand ports

or all sixty five thousand ports if they like.

But how are we going to change that inside of our code?

Well, we're not going to touch this at all, but we are going to do is will create another function

called Schenn, but this just started the same.

This one doesn't have the port inside of the name.

And this can function will take two arguments as well.

And those arguments are going to be the targets and the ports.

And all we are going to do right here is we're going to iterate so for support in range from one to

ports, for each and every port, we're going to call scan port function.

And this can port function, remember, takes two arguments and those two arguments are going to be

targets and port.

And let me explain this a little bit better.

What these two lines do is this will iterate from one to any number that they specified right here inside

of this line.

And then it will call for each and every no, this cannot function, so it will start from one and then

it will scan port No.

One using this function, then it will increase port to be two and then it will call scan port function

once again once the port is equal to two.

And it will do that until it reaches the ports number that the user of the program specified right here.

But what if our user wants to specify multiple targets, what then they, for example, don't want to

scan on the one target they want to scan to target?

That's why what we're going to do is we're going to change.

This can function and this can function will take Target as an input and it will scan the port on target.

But notice, this target is something that we don't really have if we call right here on target and

then ports, we have targets, but we do not have target and we're going to change this target variable

to be enter targets to scan.

And inside of the brackets, we will explain to them, split them by.

So they can specify, for example, to target.

They can specify them like this, they want to send money to that 168, that one that one comma 190

to that 168.

But one dot five, for example.

If they specify it like this, then we have a problem.

We will call this can function on one target, but we need to split this input.

So it's scans, this I.P. address and then after it, it scans this I.P. address.

Let's see how we can do it.

For now down here, but we're going to do is we're going to check if there is karma inside of our target's

variable if and to specify that we open single quote type comma and closing quote, if comma is in target.

This means that they specified multiple targets.

So what we are going to do is we're going to go down a little bit and then print and then open double

quotes.

We can specify this starshine just it looks a little bit better scanning multiple targets.

And let's close the double quotes and then right here, what we can do is, instead of calling this

can function outside of the statement, we're going to call it inside of the if statement.

And what we're going to do is we are going to use a for loop inside of this if statement, so forth,

IP address.

And we are going to call it IP ADR.

In targets that split and this split function simply splits the input that the user specified by any

sign that was specified in between these single quotes.

Now, since the users of this program will specify targets with comma, we also want to split the input

with a comma.

That way we are going to get with two IP addresses that don't have this comma in between them.

And for each I.P. address in this target's variable, we're going to scan IP address

and let us strip it out of any empty spaces and we do that by typing strip open the brackets, single

quote, space, single code.

And the second parameter, we believe to be port.

In any other case, in case they specified only one target, we're going to use a statement and in that

case, we are simply just going to scan targets and then report.

So we're just basing the entire input of this variable inside of this can function.

And that is because they only inputted one IP address because there is no comma inside of this variable.

So let's go through this real fast just to figure out everything a little bit better.

Let's go from the beginning of the program, which is down here.

So we asked the user for the targets.

They can specify either one target to scan or multiple targets to scan, separated by a comma.

Then they specify the ports that they want to scan.

And by specifying ports, I mean the amount of port that they want to scan.

So if they type five hundred right here, our program will scan first five hundred ports.

Once we take these two variables and we take the input from the user, we check whether A is inside

of this target variable.

If it is, that means multiple targets have been specified.

Then we go for each IP address inside of this target's variable and we check out those IP addresses

by splitting the input with comma.

Then we will scan each and every IP address with the specified amount of ports in case the only specified

one IP address.

Then we scan that one IP address with the specified amount of port.

Once we go to the scan function, this will go for port in range one to the amount of port specified

and it will perform this port function for each and every port.

If we manage to connect, we will print port is opened.

If we don't manage to connect, we will print.

Port is closed.

Let's see whether this works, if I control, OK, then enter and control, exit to exit, to run this

program, I can use Python three and then SportsCenter top.

Why it asks us to enter targets.

This can split them by comma.

And what I'm going to do, I'm going to scan my router.

What you can do, you can open and start your anticipatable and I'm going to start it right now as well,

just so we can test later.

The multiple targets can.

And I'm going to type the IP address on my router, which is this one press enter.

Enter how many ports you want to scan.

Let's say I want to scan first one hundred ports and we get our first error.

Now, don't worry, errors occur a lot in programming.

Let's see what the error says.

String object cannot be interpreted as integer and it is inside of this line.

Let's check it out.

Let's go back to our program using Nannerl so nanobots cannot apply and let's see where the error is.

It seems to be right here.

So we are pasting this sports option as an integer, but we are taking an input as a string.

So what we can do is we can wrap this port input inside of the integer function, which will convert

this number into an integer.

Let's try and see whether this fixed the problem.

If I type it once again when I do that one sixty eight to find that one and then port one hundred.

Wow, this finished really fast and we can see it's scanned 100 ports, it managed to find these two

that are open and this one as well.

Let me just find it and this one as well.

Now I know what you're thinking, this is a terrible output, we can barely see which ones are open

and which ones are closed.

So what we can do to fix this, we can go back to our program and in the accept part where we print

that the port is closed.

We are not going to print anything, we are just going to pass this by simply means to nothing and continue

with the execution of the program while we do this.

Well, we don't really care which ports are closed.

We only want to print the ports that are open.

So let's see whether this fixed our program, if I type Python three scanner and I run the same IP address,

which is my router first one hundred ports, there it is.

If we get the whole lot better output, if we only get ports that are open.

Let's test this program on two different targets, so I started my Métis botibol, and what I'm going

to do is log in and check the IP address of Anticipatable, which is 192.

It's 168 at one point five.

And if I run the program once again and type one, I took that one eight.

That one, that one which is my router and then comma 182, that 168, that one, that five press enter

and of ports, let's say we want to scan one hundred ports.

And this will work, but it gives us the wrong output if we don't know which ports belong to which target.

So let's go back to our program and see how we can fix this to fix this.

We're going to add a print statement inside of our scan function right at the beginning.

We are going to print.

First, we are going to start with a new online character and the new line character is back slash and.

Close the single quote plus.

And let's open single quote once again, enter space and then type starting scan for another space and

then single quote, plus the string of the target.

And remember, Target is our argument to our function.

And this target is an actual IP address that was split right here.

Here we paste this IP address inside of this can function and this IP are dot strip is the same thing

as this target right here.

So if I print it like this and close to Brackett's, because we have one bracket open right here, let's

test it out once again.

Control autosave, control x exit and let me run the program once again.

First one hundred.

This is a lot better.

We get which ports are open for my router and we also get which ports are open for me at this point.

The.

Now, with this, our program is basically finished, what you can do to make this better is you can

change the outfit a little bit.

So right here where you print scanning multiple targets, we can use the term color library that we

imported.

And from the term color library, we can take the colored function and dysfunction just changes the

color of our print statement into any color that we want.

So what we need to do is inside of the print statement type term color dot the colored open bracket

type the statement that you want to print, close one bracket type comma and then open single quote.

And let's say we want to print this in green and then I need to close two more brackets, one for the

colored function and one for the print function.

Let's see whether this will work.

Control autosave once again and control to exit by three courts cannot occupy unmatched bracket.

So let's check it out.

Yeah, we do.

Got one bracket more.

Let us go back and remove it.

So we got print bracket closed right here and we got the colored bracket close right here.

So, yeah, this one right here is one, two extra.

Let's delete.

Save it once again, run the program type two targets that you want to scan, in my case, I'm using

Rorter and Anticipatable and I want to scan, let's say this time I want to scan first.

Two hundred parts.

Now, it doesn't seem to print it in green for some reason.

Let's see what the problem is if I go all the way down to our print statement.

Right here, it seems that our colored function only took this as an argument and we wanted to take

this as well.

So what we need to do is we, first of all, need to delete this.

What we need to do is open another bracket right here and close another bracket right here.

Now, this does seem confusing with all of these brackets being open, closed.

But what we just did is we extracted this statement to be one function.

So inside of the colored, we open one bracket for the function itself.

Then we paste two arguments and we split these arguments like this.

And first argument is this print statement, while the second argument is the color that we want to

print it in.

Hopefully right now this will work.

And if I go and run the program once again

and scan the first two hundred words, now it seems to work, it says, scanning multiple targets and

it is printed in green.

As we can see for our anticipatable, we also found two more additional ports because we increased the

number to 200.

Cool.

Now you got your first tool ready to use in your penetration test.

Now, even though this is a simple port scanner, you can do many things to make it a little bit better

if you are an experienced programmer, what you can do, you can try to receive a banner from these

open ports so you can try to send packets and receive packets and store the response inside the variable

and then print it out to see what banner does an open port have.

And then there is just something that an open port might send as an information as to which software

it is running on that open port.

And from that vendor, we can also extract the version of that software.

But we are not going to be doing that right now because that would be a little bit too advanced for

us right now.

We are happy with this program.

In the next few videos, we're going to be covering vulnerability analysis.

See you there.