1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
#!/usr/bin/python
from socket import *
import socks
import argparse
import time
## This function tries to open a connection on a specific port
def connScan(host, port, wait, notor):
## If notor is set to True, it doesn't use the socks proxy
if notor:
sckt = socket(AF_INET, SOCK_STREAM)
sckt.settimeout(wait)
else:
sckt = socks.socksocket()
sckt.settimeout(wait)
## Try to connect, print to stdout on success
try:
sckt.connect((host, port))
print("[+] port {} on {} is open".format(port, host))
sckt.close()
return True
except:
pass
## This function goes throgh all ports and calls connScan for each one
def portScan(host, ports, wait, notor):
openPorts = 0
for p in ports:
if connScan(host, p, wait, notor):
openPorts += 1
print("{} open ports on {}.".format(openPorts, host))
def main():
startTime = time.time()
## Define and parse the arguments
parser = argparse.ArgumentParser(description="Simple port scanner that works over Tor")
parser.add_argument("HOSTS", help="IP or domain to scan", default="empty_host", nargs="?")
parser.add_argument("-H", "--hosts", metavar="HOSTS", dest="tgtHost", help="IP or domain to scan", default="empty_host_option")
parser.add_argument("-p", "--ports", metavar="PORTS", dest="tgtPort", help="ports to scan", default="21,22,23,25,53,80,443,8080,8333,9050,9150")
parser.add_argument("-t", "--timeout", metavar="TIMEOUT", dest="sockTimeout", type=int, help="seconds to wait before connection timeout for each port", default=1)
parser.add_argument("--clearnet", dest="clearnet", help="don't use Tor for scanning", action="store_true")
parser.add_argument("--torport", metavar="TORPORT", dest="torPort", type=int, help="port for Tor proxy", default="9050")
args = parser.parse_args()
## Combine HOST and --hosts values
if args.HOSTS == "empty_host":
if args.tgtHost == "empty_host_option":
parser.print_help()
print ("Host must be specified")
exit()
else:
args.HOSTS = args.tgtHost
else:
if args.tgtHost != "empty_host_option":
args.HOSTS = args.HOSTS + "," + args.tgtHost
## Set Tor as default Tor proxy for the scanner
socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5, "127.0.0.1", args.torPort)
## Load specified ports into PORTS list
if "-" not in args.tgtPort:
PORTS = list(map(int, args.tgtPort.split(",")))
else:
PORTS = list(map(int, args.tgtPort.split("-")))
if len(PORTS) != 2:
parser.print_help()
exit()
else:
PORTS = range(PORTS[0],PORTS[1]+1)
## Load other variables
HOSTS = args.HOSTS.split(",")
WAIT_TIME = args.sockTimeout
CLEARNET = False
if args.clearnet:
CLEARNET=True
## Scan each host in HOSTS list
for h in HOSTS:
portScan(h, PORTS, WAIT_TIME, CLEARNET)
endTime = time.time()
totalTime = endTime - startTime
print("Scan done in {} seconds".format(round(totalTime, 2)))
if __name__ == "__main__":
main()
|
