port_banner_scan.py

#!/usr/bin/env python
# -*- coding:utf-8 -*-
#
# to get a opened-port and the banner, if the service of the port is web, the script will get the web title
#
# Usage:
# port_banner_scan.py IP/CIDR [ports] [-o outputfile] [-t theadnum]

import re
import sys
import Queue
import socket
import chardet
import requests
import threading
from netaddr import IPNetwork
mutex = threading.Lock()
requests.packages.urllib3.disable_warnings()

PORTS = [21,22,23,25,53,67,68,80,81,82,83,84,85,86,87,88,89,90,109,110,139,143,161,389,443,445,465,512,513,514,808,843,873,880,888,993,995,1080,1090,1098,1099,1158,1352,1433,1434,1521,1723,1873,2082,2083,2181,2222,2375,2601,2604,3128,3306,3311,3312,3389,3690,4440,4444,4445,4848,5000,5432,5632,5800,5900,5984,6082,6379,7001,7002,7778,8000,8001,8002,8003,8004,8005,8006,8007,8008,8009,8010,8020,8030,8040,8050,8060,8069,8070,8080,8081,8082,8083,8084,8085,8086,8087,8088,8089,8090,8099,8100,8161,8200,8291,8443,8480,8488,8588,8688,8788,8800,8888,8900,9000,9001,9002,9003,9004,9005,9006,9007,9008,9909,9010,9020,9030,9040,9050,9060,9070,9080,9090,9043,9200,9300,9060,9080,9090,9999,10000,10001,10990,11211,14147,27017,28017,50000,50030,50070,61616]
result = []

def gettitle(ip, port):
    urls = ["http://%s:%d"%(ip, int(port)), "https://%s:%d"%(ip, int(port))]
    for url in urls:
        try:
            req = requests.get(url, timeout=2, verify=False)
            if req.status_code  == 400:
                continue
            title_match = re.search(r'<title>(.*?)</title>', req.content, flags=re.I|re.M)
            if title_match: title=title_match.group(1)
            return title
        except:
            pass
    return ""

def portscan(ip, port):
    service_info = ""
    title = ""
    try:
        socket.setdefaulttimeout(2.0)
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((ip, int(port)))
    except:
        return False, ""

    try:
        s.send('hello')
        r = s.recv(512)
        service_info = ''.join(r.splitlines())
        if "http" in r.lower():
            for i in r.splitlines():
                if 'server' in i.lower():
                    service_info = i
            title = gettitle(ip, port)
        s.close()
    except:
        pass
    return service_info, title

def start():
    while not q.empty():
        try:
            ip, port = q.get(block = True, timeout = 1).split(':')
            service_info, title = portscan(ip, port)
            if service_info != False:
                mutex.acquire()
                try:
                    if chardet.detect(title)['encoding'] == 'utf-8':
                        title = title.decode('utf-8')
                    result.append("%-18s\t%-5s\t%-50s\t%-20s"%(ip, str(port), service_info, title))
                    print "%-18s\t%-5s\t%-50s\t%-20s"%(ip, str(port), service_info, title)
                    mutex.release()
                except:
                    print "\n"
                    mutex.release()
            q.task_done()
        except Exception as e:
            pass
            
if __name__ == "__main__":
    threads = 200
    output = ""
    allports = 0
    argvs = sys.argv[:]

    if '-t' in argvs:
        try:
            threads = int(argvs[argvs.index('-t')+1])
            del argvs[argvs.index('-t')+1], argvs[argvs.index('-t')]
        except:
            sys.exit('[*] threads error')
    if '-o' in argvs:
        try:
            output = argvs[argvs.index('-o')+1]
            del argvs[argvs.index('-o')+1], argvs[argvs.index('-o')]
        except:
            sys.exit('[*] output file error')
    if '-all' in argvs:
        allports = 1
        argvs.remove('-all')

    if len(argvs) == 2:
        ports = PORTS
    elif len(argvs) == 3:
        try:
            ports = argvs[2].split(',')
            for port in ports:
                if int(port) < 1 or int(port) > 65535:
                    sys.exit("[*] ports should be 1-65535")
        except:
            sys.exit('[*] ports should be a comma-separated list')
    else:
        sys.exit('Usage: %s IP/CIDR [ports] [-o outputfile] [-t theadnum]'%(argvs[0]))

    try:
        ips = IPNetwork(argvs[1])
    except:
        sys.exit("[*] IP format error")
    if allports == 1:
        map(lambda x: ports.append(x), range(1, 65536))
    ip_list = [ip.format() for ip in ips]
    port_list = list(set(ports))

    ip_port_list = [ip+":"+str(port) for ip in ip_list for port in port_list]

    result.append("%s\n%s\n%-18s\t%-5s\t%-50s\t%-20s\n%s"%(' '.join(sys.argv), '-'*100, "IP", "Port", "ServiceInfo", "WebTitle", '-'*100))
    print "%s\n%s\n%-18s\t%-5s\t%-50s\t%-20s\n%s"%(' '.join(sys.argv), '-'*100, "IP", "Port", "ServiceInfo", "WebTitle", '-'*100)
    q = Queue.Queue()
    map(lambda x: q.put(x), ip_port_list)
    map(lambda x: x.start(), [threading.Thread(target=start) for i in range(threads)])
    q.join()
    result.append("-"*100)
    print "-"*100

    if output != "":
        try:
            fp = open(output, "a+")
            map(lambda x: fp.writelines(x+'\n'), result)
            fp.close()
        except:
            pass