All right, welcome to the last video in our Python module, so now we're going to be making a port
scanner and you heard me say in last video that it's going to be a terrible port scanner and it is,
but it's going to be a functional port scanner as well.
And we'll talk about what we can do to improve it and how we can think this through.
So what we're going to do is we're going to go ahead and open up a get it here.
So I'm going to say get it and we'll just go ahead and call this scanner DCPI.
And we'll do the ampersand at the end.
And let's go ahead and declare that this is going to be Python three and now let's talk through some
things.
So there's going to be a lot of familiarity.
Everything I've done up until this point has been for a reason, and you're going to start to see it
all tie together.
So the end goal of this project is going to be that we run something along the lines of Python three
scanner dot pi and we provide an IP address here.
Now with that IP address is going to go ahead and scan through a selected port range for us and try
to return back results whether or not the port is open.
So we're just checking if a port is open on a machine.
So to do that, we're going to need a few things.
So first of all, we're going to need to import sis.
We're going to import socket as we are going to make a node to node connection and we're going to import
date time from date time as we're going to make a pretty little banner as well.
So why was this important, I told you this would come back into play.
So we have here an argument.
So there are actually two arguments in theory argument.
Zero is that we're running Scanadu Pie argument.
One is that we are running against an IP address.
Now, since we're building this script out, we want it to take two arguments and only two arguments.
So we're going to build that into our script from the get go.
So let's go ahead and just define our target.
And it's always good when you're building out a script to have good notes in there as well.
So not only that, you can go back and read it, but if you send this to somebody else, they could
also read through it as well.
So put good comments in here, good notes saying what you're doing.
So in this instance, we're going to put an if statement again, conditional argument here.
We're going to say if the length of CICIG v. remember, this is the same thing as like a dollar sign
one in Vache.
We're going to take that.
We're going to say if it's equal to two, we're going to go ahead and do something.
And we're going to do is we're going to declare a variable of target and we're going to say socket.
Guest host by name, and then we're going to get this RB one.
So we're taking the first argument again, this is the same thing as saying one like this in Basche.
Why are we doing this?
Well, we're just translating a hostname here to IPV for now.
This is not inherently necessary.
We could just declare the target by input.
It could just be targeted equal cesta RB one.
But we're just taking an extra step here in case instead of somebody putting in an IP address, they
could just put in like a hostname, say we have a host here and it's like one of mine is called the
Punisher.
You know, what if they put in Punisher?
Well, that Punisher name does DNS and resolves to an IP address.
It's going to go ahead and do that with this argument here.
So we're just putting an extra step, thinking ahead.
We also need else to this, so if it doesn't equal to if it's three, if it's one, it's done, then
we're going to go ahead and just print out and say invalid amount of arguments and then we can actually
take this here.
And we can put this into a print statement as well, just print to say something like syntax Python
three scanner IP address something along those lines.
So let's go ahead and I like to always put in a pretty little banner or something, you know, let's
add a pretty banner and I'm just going to do something like this.
I'm going to say print and we're going to do dashes.
We'll do 50 dashes and then we'll go ahead.
I'm going to copy this just easier.
And let's go ahead and print a couple of things.
We'll say print, we'll say scanning the target and then we'll add a space.
One of those do plus target and then we'll say print time started and then we can just do a space there,
plus the string of date time.
Now, now, that came back into play as well.
So make sure you have three closing parentheses.
So we've now utilized this socket and date time, all of which we have seen in the past.
And then that last copy paste here for the banner, the next thing we're going to do is what is called
a tri statement.
So we're going to try to do something.
And if we can't do it, we have exceptions.
So you'll see what this looks like when it's all built out.
So go ahead and type try and you're going to see try later as well when we get into the exploit development.
So we're going to do a four statements for port in range.
Now we need to specify the range.
If we were going to do a full on port scanner, we would do for port one three sixty five five thirty
five.
OK, that will take forever.
We'll talk about why I told you this was a bad port scanner.
We'll talk about why we're not going to do this in a little bit.
So let's go ahead and delete these and we're just going to put something like fifty to eighty five.
I'll clarify why we're doing that and just a second, so on top of this, let's add in some familiar
language.
We're going to say sequel's socket socket and then socket uff underscore đinđić, comma, socket sock
stream.
Remember, Affinia is IPB for sock stream is our port.
So we're going to say socket dot set default time out to one.
Why are we doing this.
This is going to attempt to connect to a port.
If that port is not connectable, it's going to wait one second and then it's going to move on that
way.
We're not sitting there forever trying to make a connection to a port.
We set the time ourselves.
So we're also going to store a result, so the result is going to be Estcourt, Connect, underscore
X and it's going to be Target comma port.
So why are we doing this?
Well, when we do this connect underscore x ray returns, an air indicator segment that returns an air
indicator, if a port is open, the result back is going to be zero.
If a port is not open, it's going to throw open air, which is going to trigger a one.
So let's think that through if the result is equal to zero, then we're going to go ahead and just print
out that this port is open.
We'll throw this in here, this time for a placeholder instead, let's say, is open and we'll do a
format port.
And then one more thing, I'll close it out and we'll walk through this one more time so that it all
makes sense.
OK, so then we're closing the connection.
OK, so we've got this tri statement.
Let's walk through it one more time.
We've got a for loop here.
Remember, for is just an illiterate.
We're going through an illiterate.
We're going through 450 in.
So we're defining a port right in this range.
So fifty, fifty one fifty two all the way up to eighty five.
We're going to repeat this whole process.
We're going to establish our variable X, which we did in the socket video the previous video.
Right.
Or just declaring, hey, I know I'm going to want to connect IPV for and a port.
When I do make that connection, I want that default time out to be one second.
OK, so then I'm going to store inside of a variable of a result, I'm going to say let's connect to
the target, which we've already established as this ARG V1 and the port, which is our iterate here
in our loop.
And if that port is open, it's going to return zero.
If it's not open, it's going to return one.
So if that result is zero, go ahead and print out that that port is open, close the connection and
then we're going to go back and try to establish another connection with port or with the port number.
Fifty one fifty two fifty three will loop through all this until we make it all the way through eighty
five.
OK, so it's just one big loop that we're doing now, we need to throw in a few exceptions to make this
code really work.
So here's an exception.
Exception keyboard interrupt.
So if you've been using Linux for a little bit now, you should know something like Control C is a keyboard
interrupt.
So we want to interrupt the scan.
We need to define that there is an interruption here.
So I'm just going to put in something like exiting program, OK?
And we're going to say when that happens, when there is a keyboard interrupt, we're going to say this
exit that allows for that clean exit.
OK, there's another exception that could be occurred here, right?
So we're going to say socket that air and we're going to say print hostname could not be resolved.
So if we can't resolve the hostname, DNS is failing us.
We're just going to go ahead and exit out.
And then one more.
What if we can't make the connection to the address in general?
Well, that's what's called a socket error.
So we're going to say socket error and we're going to print out.
Couldn't get in tiger type, I couldn't connect to the server, and then we're also going to exit this
sort of, say, system exit.
So I'll give you a little bit of time to catch up on this script if you're behind, I was typing fast
and talking as well.
So one more walk through, we're going to do our for loop through these specific ports and then we're
going to go ahead and have some exception.
So we're going to try these with exceptions here, if we had control.
See, we want to exit the program.
If there is no hostname resolution, we want to exit the program.
If we can't connect to the IP address that we specify, we want to exit the program.
So we need to build in these exits.
And these are those that this is that thinking logically that I talked about earlier in earlier videos.
Right.
That we it wouldn't hurt to build this out and then just think logically.
And I will be the first person to tell you that when I build the script out and I write it, it's always
terrible.
First time's always terrible.
Tense time still probably pretty terrible.
You have to start thinking of things logically, like you might not define enough statement at the beginning.
Right.
You might have to think through that because you might need one argument or two arguments or three arguments
and you don't know.
So maybe this doesn't look like this and it doesn't look like the pretty banner in here either.
And you just start with this Falu and then you realize, well, maybe I should make that a try statement,
because what if the user wants to exit or there's no connection for a hostname or there's no connection
to the server?
How do we get out of that or else we're just going to be stuck in this for loop until it's done.
But if we get into one of these er situations, it's going to get weird.
Right.
So and then you start thinking through.
OK, well I know my argument, so let me go add in a statement at the top so the user knows how to use
it and then maybe I'll put a pretty banner in there when it's all said and done and it starts to really
design itself.
Now, before we run this, let's talk about why this isn't great.
This is going to sit here and run through one port at a time.
For a second of a time out and then reiterate, this is going to take a little bit to run through these
little.
Now, when we get into scanning, you're going to see that there are tools out there designed that do
it much better, much more efficiently and much faster.
This is not the best way there is something that we could do called threading now, threatening to take
the process and run multiple processes at once for us and allow us to scan a lot of ports at once,
that would be a potential idea here.
And there's just improvements that we can do.
You know, some of the things that we thought about already, like the Sokka hosted by Hostname, you
might not have thought about that in your first iteration.
You might just say, hey, I want to just put it IP for.
And what happens if, you know, we supply an argument and the argument is something like a mixed bunch
of numbers.
Now, it could be like one, five, two.
And then you got letters and somebody mis typed or or what if you give, you know, an IP address that
doesn't exist, something like this, or, you know, maybe like two fifty six dot or two fifty seven
or something, you know, that that isn't possible.
How is that built in.
How are we going to prevent that in our script right now.
Not that big of a deal.
We're writing this for ourselves.
So, you know, it's not doesn't be perfect.
But if we write this for somebody else, we go put this on GitHub.
We kind of want all those errors to be handled.
And that's where these exceptions come into play.
And these if statements at the beginning come into play as well.
So we can handle those errors and those exceptions and we can really start thinking logically on how
an end user might fat or something or break a program or do something even maliciously, possibly.
So there are ways around this and we'll talk about it as well when we get into a bash script that I
wrote later on in the course.
And we can kind of look at how that was written and how it strips out some arguments and prevent some
human error.
But we'll get to that later.
So let's go ahead and actually save this.
Now, we've got our scanners scanner script and we're going to go ahead and run it.
So I'm going to run this and I'm going to run this against my router.
So my suggestion to you is to do the same or do it to a machine that, you know is in your network and
has a port open.
Why am I choosing my router and this specific range now?
My router should have port fifty three open because of DNS and it should have Port 80 open because I
need to access the web interface on it.
So I'm going to go ahead and run this.
And I have a typo, so I have something called soccer here.
I sure do.
If you caught that originally good job.
You knew I was going to mess up.
Let's try it one more time.
And there you go.
So it just ran through it really fast, said Port.
Fifty three is open, Port eight is open, and immediately it knew.
It knew.
So it did its job.
It went out there and it found Port 53 Importante, which is what I was expecting.
Hopefully yours did the same.
Now I could back this off to one through, you know, sixty five thousand five thirty five.
And another thing we can do, if you want to see the speed, let's say sixty five, five.
Thirty five.
I am going to keyboard interrupt this, but we can print out something along the lines of checking for
and then we'll do something like this.
OK, and then we say format and then port.
So when we say this and we run it, let's take a look now.
So it's checking through all these parts.
It's going kind of fast, but look, it's it's finding parts, but this isn't pretty.
Right.
We wouldn't want this.
We only want it to say when the ports open, but it's taking some time.
We're on port.
Twenty thousand of sixty five thousand.
So on top of, you know, just being being a little bit annoying, it's it's really throwing our screen
into twenty thousand lines now.
So the only reason I would put a statement in here like this is if I was doing a couple numbers and
I wanted to see like if we go back to 15 to 80, we'll do eighty one.
We do this.
It's a good way to see how fast your scanner is running.
If it's running, it's a good way to have print statements in there.
If you might see any errors and you could see it ran through 80 pretty fast and found fifty three and
eighty open.
So I would delete this.
If you want to do a full port scan again, you could do one three sixty five five thirty five.
Go ahead and say that.
Sorry if you hurt my dog barking It's really windy tonight so we're going to go ahead and do it one
more time and now it should be a little prettier.
And then as the ports are open, it'll print out.
And if you want to get fancier, you can have a little thing at the bottom that says, hey, this took
this long to scan, here's how many ports are open, etc. So this is finding all airports.
So I'm going to go ahead and control, see, and you can see now exiting program, our keyboard interrupt
worked.
So everything is working really, really well and that is it.
So that's it for the Python series.
And hopefully this all made sense.
This all built upon it.
You know, we could take this in.
The goal here, again, is not to be an expert in Python.
The goal here is to get you interested in Python, to get you seeing that it's really not that bad.
And in about an hour and a half to two hours time, we started with nothing and built out a nice script
at all, you know, just built less and less until we got here.
So we're going to move on and actually get into the hacking.
You have successfully completed all of your foundational courses.
We've got the Linux down.
We've got the networking down, we've got the Python down, and now we're ready to get into the good
stuff.
So I'm very excited to do the hacking.
This is our strong suit.
This is our bread and butter, and we're really going to knock it out of the park.
So I will catch you over in the next video when we start learning about hacking.