Kali-Python scapy模塊-掃描

Kali Python3環境安裝scapy模塊

pip3?install?scapy

本地網卡網段arp_scan腳本

#!/usr/bin/python3

import?logging
import?subprocess
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
from?scapy.all?import?*
if?len(sys.argv)?!=?2:
????print("使用方法?-?./arp_ping.py?[interface]")
????print("示例?-?./arp_ping.py?eth0")
????print("用于掃描網卡所在的C類地址段")
????sys.exit()
interface?=?str(sys.argv[1])
ip?=?str(subprocess.check_output("ifconfig?"+?interface?+?"?|?grep?'broadcast'?|?cut?-d?'?'?-f?10?|?cut?-d?'.'?-f?1-3",?shell=True).strip(),?encoding='utf-8')
prefix?=?str(ip?+?'.')、
"""過濾出網段信息，輸出信息如：x.x.x."""
for?addr?in?range(0,254):
????answer?=?sr1(ARP(pdst?=?prefix+str(addr)),timeout?=?1,?verbose?=?0)
????if?answer?==?None:
??????"""返回結果為空，則說明目標未響應，并繼續掃描下一個，否則打印目標ip信息"""
????????pass
????else:
????????print(prefix+str(addr)?+?"存活")

C類網段ping_scan腳本

#!?/usr/bin/python3

import?logging
import?subprocess
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
from?scapy.all?import?*
if?len(sys.argv)?!=2:
"""如果輸入的參數不是2個，打印輸入示例，并退出"""
print("使用方法：?python3?ping_scan.py?x.x.x.0/24")
sys.exit()
address?=?str(sys.argv[1])
prefix?=?address.split('.')[0]?+?'.'?+?address.split('.')[1]?+?'.'?+?address.split('.')[2]?+?'.'
for?addr?in?range(1,254):
answer?=?sr1(IP(dst=prefix?+str(addr))/ICMP(),?timeout?=?1,?verbose?=?0)
if?answer?==?None:
pass
else:
print(prefix?+?str(addr)?+?"存活")

TCP掃描（通過目標ip是否有回包判斷存活狀態）

#?usr/bin/python3

import?logging
logging.getLogger("scapy.runtime").setLevel(logging.ERROR)
from?scapy.all?import?*

if?len(sys.argv)?!=?2:
	print("使用示例：python3?ACK_ping.py?192.168.95.0")
	print("對192.168.95.0/24?進行TCP?ACK?ping?掃描")
	sys.exit()

address?=?str(sys.argv[1])
prefix?=?address.split('.')[0]?+?'.'?+?address.split('.')[1]?+?'.'?+?address.split('.')[2]?+?'.'
for?addr?in?range(1,10):
	"""對目標ip的2222端口發送?TCP?ACK報文"""
	response?=?sr1(IP(dst=prefix?+?str(addr))/TCP(dport?=?2222,?flags?=?'A'),?timeout?=?1,?verbose?=?0)
	try:
		if?int(response[TCP].flags)?==?4:
			"""如果響應報文中的TCP?flags字段為4，即目標reset連接，打印目標ip"""
			print(prefix?+?str(addr)?+?"存活")
	except:
		pass