doushi1510 2014-06-18 07:56
浏览 74
已采纳

PHP端口扫描

This may be a duplicate post, BUT I've not seen any answer that correctly resolves this.

I'm trying to find a php script that can correctly determine the state of a TCP or UDP port.

I've tried several of the ones I've found online and they all return the wrong results. EG: On my local network I have ports 5000 UDP & 5060 TCP/UDP open and routing correctly.

If I run a test via http://www.ipfingerprints.com/portscan.php or GRC Shields Up then the correct results are returned, but all of the PHP Scripts I've tried fail and show the ports as closed.

I'm running the php script via my hosted account and trying to scan and test my own network.

This is one of the scripts I've tried:

    <html>
<head>
<?php echo "<title>Port Scanning " . $_GET['host'] . "</title>"; ?>
</head>
<body>
<?php
ini_set('display_errors', 0);

if(isset($_GET['host']) == true) 
    $host = $_GET['host'];
else
{
    echo "You didn't set the host parameter";
    die();
}

if(isset($_GET['sport']) == true) 
    $sport = $_GET['sport'];
else
{
    echo "You didn't set the sport parameter";
    die();
}

if(isset($_GET['eport']) == true) 
    $eport = $_GET['eport'];
else
{
    echo "You didn't set the eport parameter";
    die();
}

if($sport > $eport)
{
    $sport = $eport;
}

$scanned = 0;
$openports = 0;
$maxports = 1;
$totalports = ($eport - $sport) + 1;
$mins = floor(($totalports / 10) / 60);
$secs = ($totalports / 10) - $mins * 60;

echo "<font color=\"blue\">Scanning " . $totalports . " ports on " . $host . ", this should take around " . $mins . " minute(s) and " . $secs . " second(s), probably more depending on local website load, hardware, and other factors.<br/><br/></font>";
flush();

do
{
    if($scanned >= $maxports && $maxports != 0)
    {
        echo "<font color=\"darkgreen\" size=\"4\">Scan limit of " . $maxports . " ports reached, scanning stopped.</font><br/><br/><font color=\"darkred\" size=\"4\">Scanner written by Samo502</font>";
        flush();
        die();
    }
    if(fsockopen($host, $sport, $errorno, $errorstr, 0.1))
    {
        echo "<font color=\"darkgreen\">Port " . $sport . " is open on " . $host . "</font><br/>";
        $openports++;
        flush();
    }
    else
    {
        echo "<font color=\"red\">Port " . $sport . " is not open on " . $host . "</font><br/>";
        flush();
    }
    $scanned++;
    $sport++;
} while($sport <= $eport);

echo "<br/><font color=\"blue\">Done, " . $openports . " out of " . $totalports . " ports are open.</font><br/><br/><br/><font color=\"darkred\" size=\"4\">Scanner written by Samo502</font>";
die();
?>
</body>
</html>

Does anyone know of a way to do this correctly ?

Thanks

**UPDATE** I've found this which seems to work a bit better, but it's still not detecting that port 21 is currently open on my network..

http://resources.infosecinstitute.com/php-build-your-own-mini-port-scanner-2/

Any help gratefully received. Thanks

  • 写回答

3条回答 默认 最新

  • duanan6043 2014-06-18 08:18
    关注

    The best solution is to write a wrapper in PHP for nmap - seriously, you can't recode a better portscan than nmap.

    If you really want to do it, you should not simply open TCP port and check wether it does connect, you should start from a lower level of sockets, raw sockets.

    $mysocket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
    

    This allows you to investigate SYN, ACK handshake flags and do stealth or simply faster scans.

    You can create (non-blocking) sockets in parallel and check their buffer/connection using socket_select();, which is the fastest and most reliable way to handle several sockets in PHP. I'd probably use forks or threads or dispatch parts of the code to run a full portscan within the same time as a single port scan.

    Other functions you'd like to use are socket_set_timeout() and socket_set_blocking().

    shell_exec not working with nmap command

    https://unix.stackexchange.com/questions/28732/fastest-way-to-port-scan-nmap

    http://phpnmap.sourceforge.net/

    Probably the best solution, a PEAR package nmap wrapper: http://pear.php.net/package/Net_Nmap/

    本回答被题主选为最佳回答 , 对您是否有帮助呢?
    评论
查看更多回答(2条)

报告相同问题?

悬赏问题

  • ¥17 pro*C预编译“闪回查询”报错SCN不能识别
  • ¥15 微信会员卡接入微信支付商户号收款
  • ¥15 如何获取烟草零售终端数据
  • ¥15 数学建模招标中位数问题
  • ¥15 phython路径名过长报错 不知道什么问题
  • ¥15 深度学习中模型转换该怎么实现
  • ¥15 HLs设计手写数字识别程序编译通不过
  • ¥15 Stata外部命令安装问题求帮助!
  • ¥15 从键盘随机输入A-H中的一串字符串,用七段数码管方法进行绘制。提交代码及运行截图。
  • ¥15 TYPCE母转母,插入认方向