All language subtitles for 16. Building a Port Scanner

All right.

Welcome to the last video in our python module.

So now we're going to be making a port scanner.

And you heard me say in last video that it's going to be a terrible port scanner and it is but it's

going to be a functional port scanner as well.

And we'll talk about what we can do to improve it and how we can think this through.

So what we're going to do is we're going to go ahead and open up a g edit here some Nisei g at it and

we'll just go ahead and call the scanner dot pi and we'll do the ampersand at the end and let's go ahead

and declare that this is going to be Python 3.

And now let's talk through some things.

So there's going to be a lot of familiarity.

Everything I've done up until this point has been for a reason and you're going to start to see it all

tied together.

So the end goal of this project is going to be that we run something along the lines of Python 3 scanner

dot pi and we provide an IP address here.

Now with that IP address it's going to go ahead and scan through a selected port range for us and try

to return back results whether or not the port is open.

So we're just checking if a port is open on a machine.

So to do that we're going to need a few things.

So first of all we're going to need to import cysts we're going to import socket as we are going to

make a node to node connection and we're going to import date time from date time as we're going to

make a pretty little banner as well so why was this important.

I told you assisted come back into play.

So we have here an argument.

So there are actually two arguments in theory argument zero is that we're running scattered up pie argument

one is that we are running against an IP address.

Now since we're building this script out we want it to take two arguments and only two arguments.

So we're going to build that into our script from the get go.

So let's go ahead and just define our target.

And it's always good when you're building out a script to have good notes in there as well.

So not only that you can go back and read it but if you send this somebody else they could also read

through it as well so put good comments in here good notes saying what you're doing.

So in this instance we're going to put an if statement again conditional argument here and we're going

to say if the length of CIS dot ARG we remember this is the same thing is like a dollar sign one in

bash we're going to take that we're going to say if it's equal to two we're going to go ahead and do

something.

What we're going to do is we're gonna declare a variable of target and we're going to say socket get

a host by name and then we're going to get CIs we won.

So we're taking the first argument.

Again this is same thing as dollar sign one like this in bash.

Why are we doing this.

Well we're just translating a hostname here to IP for now.

This is not inherently necessary.

We could just declare the target by input.

It could just be.

Target equals sister RB 1.

But we're just taking an extra step here in case instead of somebody putting in an IP address they could

just put in like a hostname say we have a host here and it's you know like a one of mine is called The

Punisher.

You know what if it were they put in Punisher wall that Punisher name does DNS and a resolves to an

IP address.

It's going to go ahead and do that with this argument here.

So we're just putting an extra step thinking ahead.

We also need else to this.

So if it doesn't equal two if it's three if it's one it's nine then we're gonna go ahead and just print

out and say invalid amount of arguments and then we can actually take this here.

And we can put this into a print statement as well as print to say something like syntax.

Python 3 scanner IP address.

Something along those lines OK.

So I always like to say that.

And then just run it make sure everything works fine.

So let's go ahead and give it Python 3.

We'll say scanner add up pi and we'll give it no argument and it's gonna say OK invalid arguments syntax

is Python 3 standard pi IP so we'll just give it an argument here OK.

So it writes didn't get the we met the conditions and we set the target variable to well to this right.

So that's OK for now.

So let's go ahead and I like to always put it in a pretty little banner or something.

Now let's add a pretty banner and I'm just gonna do something like this.

I'm going to say print and we're gonna do dashes.

We'll do 50 dashes and then we'll go ahead.

I'm going to copy this.

Just easier and let's go ahead and print a couple of things we'll say print we'll say scanning the target

and then we'll add a space all of us do plus target and then we'll say print time started and then we

can just do a space there plus the string of date time now.

Now that came back into play as well.

So make sure you have three closing parentheses.

So we've now utilized this socket and date time all of which we have seen in the past.

And then that last copy paste here for the banner says go ahead and save this and give it another go

and you can see it says OK scanning target and it's resolving to this twenty three this is this is not

accurate but you know just let it do its thing and then it's got the time started of the scan here so

you can see here I'm putting in a hostname and it's trying to resolve to DNS to this maybe this is how

what it resolves to I don't know but we'll move on.

So the next thing we're going to do is what is called a tri statement.

So we're going to try to do something.

And if we can't do it we have exceptions.

So you'll see what this looks like when it's all built out.

So go ahead and type try and you're going to see try later as well we get into the exploit development

so we're going to do a for statement.

So for port in range now when you specify the range if we were going to do a full on port scanner we

would do for port one through sixty five five thirty five OK that will take forever.

We'll talk about why I told you this was a bad port scanner.

We'll talk about why we're not going to do this in a little bit.

So let's go ahead and delete these and we're just going to put something like 50 to eighty five and

I'll clarify why we're doing that in just a second.

So on top of this let's add in some familiar language we're going to say X equals socket dot socket

and then socket dot a f underscore iiNet comma socket dot SOC stream remember a fine it is IP for SOC

stream is our port.

So we're going to say socket dot set default time out to one why are we doing this.

This is going to attempt to connect to a port.

If that port is not connected all it's going to wait one second and then it's going to move on.

That way we're not sitting there forever trying to make a connection to a port.

We set the timer ourselves so we're also going to store a result.

So the result is going to be s dot connect underscore E X and it's going to be target comma port so

why are we doing this.

Well when we do this connect underscore at e x ray returns an error indicator someone returns an air

indicator.

If a port is open the result back is going to be zero.

If a port is not open it's going to throw an error which is going to trigger a one.

So let's think that through if results is equal to zero then we're going to go ahead and just print

out that this port is open.

We'll throw this in here this time for a place holder instead let's say it is open and we'll do a format

port and then one more thing I'll close it out and we'll walk through this one more time so that it

all makes sense.

OK.

So then we're closing the connection.

OK.

So you've got this tri statement.

Let's walk through it one more time.

We've got a for loop here.

Remember four is just an outer it we're going through and iterate we're going through four fifty in

so we're defining a port right in this range.

Fifty fifty one fifty two.

All of it to eighty five.

We're going to repeat this whole process.

We're going to establish our variable s which we did in the socket video the previous video.

Right.

We're just declaring Hey I know I'm going to want to connect to IP before and a port when I do make

that connection.

I want that default time out to be one second OK.

So then I'm going to store inside of a variable of result.

I'm going to say let's connect to the target which we've already established.

As.

The V1 and the port which is our it it here in our loop and if that port is open it's gonna return 0.

If it's not open it's going to return 1.

So if that result is zero go ahead and print out that that port is open close the connection and then

we're gonna go back and try to establish another connection with port or with the port number fifty

one fifty two fifty three will loop through all this until we make it all the way through.

Eighty five OK.

So it's just one big loop that we're doing now.

We need to throw in a few exceptions to make this code really work.

So here's an exception exception.

Keyboard interact.

So if you've been using Linux for a little bit now you should know something like control C is a keyboard.

Interrupt.

So if we want to interrupt the scan we need to define that there is an interruption here.

So I'm just going to put in something like exiting program.

And we're gonna say when that happens when there is a keyboard interrupt we're gonna say sis exec.

That allows for that clean exit.

Hey there's another exception that could be occurred here.

Right.

So we're gonna see a socket that gee I air and we're gonna say print hostname could not be resolved.

So if we can't resolve the hostname DNS is failing us we're just gonna go ahead and exit out.

And then one more.

What if we can't make the connection to the address in general.

Well that's what's called a socket error.

So we're gonna say socket dot error and we're going to print out couldn't get a type that couldn't connect

to server and then we're also going to exit this.

So it's a cyst that exit.

So I'll give you a little bit of time to catch up on this script if you're behind.

I was typing fast and talking as well.

So one more walkthrough.

We're going to do our for loop through these specific ports and then we're gonna go ahead and have some

exception.

So we're gonna try these with exceptions here if we had control C we want to exit the program if there

is no hostname resolution we want to exit the program if we can't connect to the IP address that we

specify we want to exit the program.

So we need to build in these exits and these are this that this is that thinking logically that I talked

about earlier in earlier videos right that we it wouldn't hurt to build this out and then just think

logically and I will be the first person to tell you that when I build a script out and I write it it's

always terrible first time's always terrible.

Tenth time still probably pretty terrible.

You have to start thinking of things logically like you might not define an if statement the beginning

right.

You might have to think through that because you might need one argument or two arguments or three arguments

and you don't know.

So maybe this doesn't look like this and it doesn't look like the pretty banner in here either.

And you just start with this for loop and then you realize well maybe I should make that a try statement

because what if the user wants to exit or there's no connection for a hostname or there's no connection

to the server.

How do we get out of that or elsewhere is going to be stuck in this for loop until it's done.

But if we get into one of these air situations it's going to get weird.

Right.

So and then you start thinking through OK well I know my argument.

So let me go add in a statement at the top so the user knows how to use it and then maybe I'll put a

pretty banner in there when it's all said and done and it starts to really design itself.

Now before we run this let's talk about why this isn't great this is going to sit here and run through

one port at a time for a second of a timeout and then reiterate this is going to take a little bit to

run through these little ports.

Now when we get into scanning you're going to see that there are tools out there designed that do it

much better much more efficiently and much faster this is not the best way.

There is something that we could do called threading now threading would take the process and run multiple

processes at once for us and allow us to scan a lot of ports at once.

That would be a potential idea here and there's just improvements that we can do.

You know some of the things that we thought about already like the socket get host by hostname you might

not have thought about that in your first iteration you might just say hey I want to just put its IP

for and what happens if you know we supply an argument and the argument is something like a mixed bunch

of numbers now notably be like 1 5 2 and then you got letters and somebody mistyped or or what if you

give you know an IP address that doesn't exist.

Something like this or you know maybe like 256 dot or 257 or something you know that that isn't possible

how is that built in.

How are we going to prevent that in our script right now.

Not that big of a deal.

We're writing this for ourselves so you know it's not doesn't be perfect but if we write this for somebody

else we go put this on github.

We kind of want all those errors to be handled and that's where these exceptions come into play and

these if statements at the beginning come into play as well so we can handle those errors and those

exceptions and we can really start thinking logically on how an end user might fat finger something

or break a program or do something even maliciously possibly.

So there are ways around this and we'll talk about it as well when we get into a bash script that I

wrote later on in the course and we can kind of look at how that was written and how it strips out some

arguments and prevent some human error but we'll get to that later.

So let's go ahead and actually save this now we've got our scanners scanner script and we're gonna go

ahead and run it so I'm going to run this and I'm going to run this against my router.

So my suggestion to you is to do the same or do it to a machine that you know is in your network and

has a port open.

Why am I choosing my router and this specific range.

Now my router should have port 53 open because of DNS and it should have port 80 open because I need

to access the web interface on it.

So I'm going to go ahead and run this and I have a typo.

So I have something called soccer here.

I sure do.

If you caught that originally good job.

You knew I was going to mess up.

Let's try one more time.

And there you go.

So it just ran through it really fast said Port fifty three is open port 80 is open and immediately

you know it knew it knew.

So it did its job it went out there and it found port 53 in Port 80 which is what I was expecting.

Hopefully yours did the same.

Now I could back this off to one through you know sixty five thousand five thirty five.

And another thing we can do if you want to see the speed let's say sixty five five thirty five.

I am going to keyboard interrupt this but we can print out something along the lines of checking for

and then we'll do something like this.

OK.

And then we say dot format and then port.

So when we say this and we run it take a look.

Now

so it's checking through all these ports.

It's going kind of fast.

But look it's it's finding ports but this isn't pretty.

All right.

We wouldn't want this we only wanted to say when the ports open.

But it's taking some time.

We're on port.

Twenty thousand of sixty five thousand or so on top of you know just being being a little bit annoying.

It's it's really you know throwing our screen into twenty thousand lines now.

So the only reason I would put a statement in here like this is if I was doing a couple numbers and

I wanted to see like if we go back to 50 and to 80 we'll do 80 1.

We do this.

It's good way to see how fast your scanners running if it's running.

It's a good way to have print statements in there if you might see any errors and you could see it ran

through 80 pretty fast and found fifty three and 80 open.

So I would delete this if you want to do a full port scan again you could do one through sixty five

five thirty five.

Go ahead and say that sorry if you heard my dog barking It's really windy tonight.

So we're gonna go ahead and do it one more time.

And now it should be a little prettier.

And then as the ports are open it'll print out.

And if you want to get fancier you can have a little thing at the bottom that says hey this took this

long to scan.

Here's how many ports are open et cetera.

So this is finding all the ports some to go ahead and control sea and you can see now exiting program

our keyboard interrupt worked.

So everything is working really really well.

And that is it.

So that's it for the python series.

And hopefully this all made sense is all built upon it.

You know we could take this in the goal here again is not to be an expert in Python the goal here is

to get you interested in Python to get you seeing that it's really not that bad.

And in about an hour and a half to two hours time we started with nothing and built out a nice script

at all you know just built less upon less until we got here.

So we're going to move on and actually get into the hacking you have successfully completed all of your

foundational courses.

We've got the Linux down we've got the networking down we've got the python down and now we're ready

to get into the good stuff.

So I'm very excited to do the hacking.

This is our strong suit this is our bread and butter and we're really going to knock out of the park

so I will catch you over in the next video when we start learning about hacking.