SYN扫描源代码

下面是一个网络编程的实例, Syn扫描器代码,可以作为参考.基本可以看为是ping命令的实现//getallIP.cpp#include <winsock2.h>#include <stdio.h>#pragma comment(lib,"ws2_32.lib")int main(){////////////////// 初始化Windows sockets API.//WORD wVersionRequested = MAKEWORD(2, 2);WSADATA wsaData;if (WSAStartup(wVersionRequested, &wsaData)) {printf("WSAStartup failed %s\n", WSAGetLastError());return 0;}//////////////////// 获得主机名.//char hostname[256];int res = gethostname(hostname, sizeof(hostname));if (res != 0) {printf("Error: %u\n", WSAGetLastError());return 0;}printf("hostname=%s\n", hostname);////////////////// 根据主机名获取主机信息.//hostent* pHostent = gethostbyname(hostname);if (pHostent==NULL) {printf("Error: %u\n", WSAGetLastError());return 0;}//////////////////// 解析返回的hostent信息.//hostent& he = *pHostent;printf("name=%s\naliases=%s\naddrtype=%d\nlength=%d\n", he.h_name, he.h_aliases, he.h_addrtype, he.h_length);sockaddr_in sa;//根据he.h_addr_list[nAdapter]是否为空来获取所有IP地址for (int nAdapter=0; he.h_addr_list[nAdapter]; nAdapter++) {memcpy ( &sa.sin_addr.s_addr, he.h_addr_list[nAdapter],he.h_length);// 输出机器的IP地址.printf("Address [%d%]: %s\n",nAdapter, inet_ntoa(sa.sin_addr)); // 显示地址串}//////////////////// 终止Windows sockets API//WSACleanup();return 0;}//mstcpip.h//头文件// Copyright (C) Microsoft Corporation, 1996-1999#if _MSC_VER > 1000#pragma once#endif/* Argument structure for SIO_KEEPALIVE_VALS */struct tcp_keepalive {u_long onoff;u_long keepalivetime;u_long keepaliveinterval;};// New WSAIoctl Options#define SIO_RCVALL _WSAIOW(IOC_VENDOR,1)#define SIO_RCVALL_MCAST _WSAIOW(IOC_VENDOR,2)#define SIO_RCVALL_IGMPMCAST _WSAIOW(IOC_VENDOR,3)#define SIO_KEEPALIVE_VALS _WSAIOW(IOC_VENDOR,4)#define SIO_ABSORB_RTRALERT _WSAIOW(IOC_VENDOR,5)#define SIO_UCAST_IF _WSAIOW(IOC_VENDOR,6)#define SIO_LIMIT_BROADCASTS _WSAIOW(IOC_VENDOR,7) #define SIO_INDEX_BIND _WSAIOW(IOC_VENDOR,8)#define SIO_INDEX_MCASTIF _WSAIOW(IOC_VENDOR,9) #define SIO_INDEX_ADD_MCAST _WSAIOW(IOC_VENDOR,10) #define SIO_INDEX_DEL_MCAST _WSAIOW(IOC_VENDOR,11)//主程序//synscan.cpp#include <winsock2.h>#include <ws2tcpip.h>#include <stdio.h>#include <time.h>#include "mstcpip.h"#pragma comment(lib,"ws2_32.lib")#define SEQ 0x28376839SOCKET sockRaw = INVALID_SOCKET,sockListen = INVALID_SOCKET;struct sockaddr_in dest;BOOL ScanOK=FALSE;char *DEST_HOST;int DEST_PORT;int DEST_PORTEND;int play=0;clock_t start,end;//程序运行的起始和结束时间float costtime;//程序耗时typedef struct _iphdr{unsigned char h_lenver; //4位首部长度+4位IP版本号unsigned char tos; //8位服务类型TOSunsigned short total_len; //16位总长度（字节）unsigned short ident; //16位标识unsigned short frag_and_flags; //3位标志位unsigned char ttl; //8位生存时间TTLunsigned char proto; //8位协议(TCP, UDP 或其他) unsigned short checksum; //16位IP首部校验和unsigned int sourceIP; //32位源IP地址unsigned int destIP; //32位目的IP地址}IP_HEADER;typedef struct _tcphdr //定义TCP首部{USHORT th_sport; //16位源端口USHORT th_dport; //16位目的端口unsigned int th_seq; //32位序列号unsigned int th_ack; //32位确认号unsigned char th_lenres; //4位首部长度/6位保留字unsigned char th_flag; //6位标志位USHORT th_win; //16位窗口大小USHORT th_sum; //16位校验和USHORT th_urp; //16位紧急数据偏移量}TCP_HEADER;struct //定义TCP伪首部{unsigned long saddr; //源地址unsigned long daddr; //目的地址char mbz;char ptcl; //协议类型unsigned short tcpl; //TCP长度}psd_header;//SOCK错误处理程序void CheckSockError(int iErrorCode, char *pErrorMsg) {if(iErrorCode==SOCKET_ERROR){printf("%s Error:%d\n", pErrorMsg, GetLastError()); closesocket(sockRaw);ExitProcess(-1);}}//计算检验和USHORT checksum(USHORT *buffer, int size){unsigned long cksum=0;while (size > 1){cksum += *buffer++;size -= sizeof(USHORT);}if (size){cksum += *(UCHAR*)buffer;}cksum = (cksum >> 16) + (cksum & 0xffff);cksum += (cksum >>16);return (USHORT)(~cksum);}//IP解包程序bool DecodeIPHeader(char *buf, int bytes){IP_HEADER *iphdr;TCP_HEADER *tcphdr;unsigned short iphdrlen;iphdr = (IP_HEADER *)buf;iphdrlen = sizeof(unsigned long) * (iphdr->h_lenver & 0xf);tcphdr = (TCP_HEADER*)(buf + iphdrlen);//是否来自目标IPif(iphdr->sourceIP != dest.sin_addr.s_addr)return false;//序列号是否正确if((ntohl(tcphdr->th_ack) != (SEQ+1)) && (ntohl(tcphdr->th_ack) != SEQ)) return false;//if(tcphdr->th_flag == 20)return true;//SYN/ACK - 扫描到一个端口if(tcphdr ->th_flag == 18){printf("\t%d\t open \n",ntohs(tcphdr->th_sport));return true;}return true;}void usage(void){printf("\t===================SYN portscaner======================\n");printf("\t============gxisone@ 2004/7/6===========\n");printf("\tusage: synscan DomainName[IP] StartPort-EndPort\n");printf("\tExample: synscan 1-139\n");printf("\tExample: synscan 192.168.1.1 8000-9000\n");}DWORD WINAPI RecvThread(LPVOID para)//接收数据线程函数{int iErrorCode;struct hostent *hp;char RecvBuf[65535]={0};sockListen = socket(AF_INET , SOCK_RAW , IPPROTO_IP);CheckSockError(sockListen, "socket");//设置IP头操作选项BOOL bOpt = true;iErrorCode = setsockopt(sockRaw,IPPROTO_IP,IP_HDRINCL,(char *)&bOpt,sizeof(bOpt));CheckSockError(iErrorCode, "setsockopt()");//获得本地IPSOCKADDR_IN sa;unsigned char LocalName[256];iErrorCode = gethostname((char*)LocalName,sizeof(LocalName)-1);CheckSockError(iErrorCode, "gethostname()");if((hp = gethostbyname((char*)LocalName)) == NULL){CheckSockError(SOCKET_ERROR, "gethostbyname()");}memcpy(&sa.sin_addr.S_un.S_addr,hp->h_addr_list[1],hp->h_length);sa.sin_family = AF_INET;sa.sin_port = htons(7000);iErrorCode = bind(sockListen, (PSOCKADDR)&sa, sizeof(sa));CheckSockError(iErrorCode, "bind");//设置SOCK_RAW为SIO_RCVALL，以便接收所有的IP包DWORD dwBufferLen[10] ;DWORD dwBufferInLen = 1 ;DWORD dwBytesReturned = 0 ;iErrorCode=WSAIoctl(sockListen, SIO_RCVALL,&dwBufferInLen, sizeof(dwBufferInLen),&dwBufferLen, sizeof(dwBufferLen),&dwBytesReturned , NULL , NULL ); CheckSockError(iErrorCode, "Ioctl");memset(RecvBuf, 0, sizeof(RecvBuf));//接收数据for(;;){iErrorCode = recv(sockListen, RecvBuf, sizeof(RecvBuf), 0);//CheckSockError(iErrorCode, "recv");DecodeIPHeader(RecvBuf,iErrorCode) ;}if(ScanOK){closesocket(sockListen);return 0;}}void playx(void) // 定义状态提示函数{// 进度条char *plays[12]={" | "," / "," - "," \\ "," | "," / "," - "," \\ "," | "," / "," - "," \\ ",};printf(" =%s=\r", plays[play]);play=(play==11)?0:play+1;Sleep(2);}//主函数int main(int argc,char **argv){char *p;if(argc!=3){usage();return 0;}p=argv[2];//处理端口参数if(strstr(argv[2],"-")){ DEST_PORT=atoi(argv[2]);for(;*p;)if(*(p++)=='-')break;DEST_PORTEND=atoi(p);if(DEST_PORT<1 || DEST_PORTEND>65535){ printf("Port Error!\n");return 0;}}DEST_HOST=argv[1];usage();int iErrorCode;int datasize;struct hostent *hp;IP_HEADER ip_header;TCP_HEADER tcp_header;char SendBuf[128]={0};//初始化SOCKETWSADATA wsaData;iErrorCode = WSAStartup(MAKEWORD(2,2),&wsaData);CheckSockError(iErrorCode, "WSAStartup()");sockRaw = socket(AF_INET , SOCK_RAW , IPPROTO_IP);CheckSockError(sockRaw, "socket()");sockListen = socket(AF_INET , SOCK_RAW , IPPROTO_IP);CheckSockError(sockListen, "socket");//设置IP头操作选项BOOL bOpt = true;iErrorCode = setsockopt(sockRaw,IPPROTO_IP,IP_HDRINCL,(char *)&bOpt,sizeof(bOpt));CheckSockError(iErrorCode, "setsockopt()");//获得本地IPSOCKADDR_IN sa;unsigned char LocalName[256];iErrorCode = gethostname((char*)LocalName,sizeof(LocalName)-1);CheckSockError(iErrorCode, "gethostname()");if((hp = gethostbyname((char*)LocalName)) == NULL){CheckSockError(SOCKET_ERROR, "gethostbyname()");}memcpy(&sa.sin_addr.S_un.S_addr,hp->h_addr_list[1],hp->h_length);sa.sin_family = AF_INET;sa.sin_port = htons(7000);iErrorCode = bind(sockListen, (PSOCKADDR)&sa, sizeof(sa));CheckSockError(iErrorCode, "bind");//获得目标主机IPmemset(&dest,0,sizeof(dest));dest.sin_family = AF_INET;dest.sin_port = htons(DEST_PORT);if((dest.sin_addr.s_addr = inet_addr(DEST_HOST)) == INADDR_NONE){if((hp = gethostbyname(DEST_HOST)) != NULL){memcpy(&(dest.sin_addr),hp->h_addr_list[1],hp->h_length);dest.sin_family = hp->h_addrtype;printf("dest.sin_addr = %s\n",inet_ntoa(dest.sin_addr));}else{CheckSockError(SOCKET_ERROR, "gethostbyname()");}}//开启监听线程HANDLE Thread=CreateThread(NULL,0,RecvThread,0,0,0);//填充IP首部ip_header.h_lenver=(4<<4 | sizeof(ip_header)/sizeof(unsigned long));//高四位IP版本号，低四位首部长度ip_header.total_len=htons(sizeof(IP_HEADER)+sizeof(TCP_HEADER)); //16位总长度（字节）ip_header.ident=1; //16位标识ip_header.frag_and_flags=0; //3位标志位ip_header.ttl=128; //8位生存时间TTLip_header.proto=IPPROTO_TCP; //8位协议(TCP,UDP…)ip_header.checksum=0; //16位IP首部校验和ip_header.sourceIP=sa.sin_addr.s_addr; //32位源IP地址ip_header.destIP=dest.sin_addr.s_addr; //32位目的IP地址//填充TCP首部tcp_header.th_sport=htons(7000); //源端口号tcp_header.th_lenres=(sizeof(TCP_HEADER)/4<<4|0); //TCP长度和保留位tcp_header.th_win=htons(16384);//填充TCP伪首部（用于计算校验和，并不真正发送）psd_header.saddr=ip_header.sourceIP;psd_header.daddr=ip_header.destIP;psd_header.mbz=0;psd_header.ptcl=IPPROTO_TCP;psd_header.tcpl=htons(sizeof(tcp_header));Sleep(500);printf("\n");printf("Scaning %s\n",DEST_HOST);start=clock();//开始计时for(;DEST_PORT<DEST_PORTEND;DEST_PORT++){playx();tcp_header.th_dport=htons(DEST_PORT); //目的端口号tcp_header.th_ack=0; //ACK序列号置为0tcp_header.th_flag=2; //SYN 标志tcp_header.th_seq=htonl(SEQ); //SYN序列号tcp_header.th_urp=0; //偏移tcp_header.th_sum=0; //校验和//计算TCP校验和，计算校验和时需要包括TCP pseudo header memcpy(SendBuf,&psd_header,sizeof(psd_header));memcpy(SendBuf+sizeof(psd_header),&tcp_header,sizeof(tcp_header)); tcp_header.th_sum=checksum((USHORT*)SendBuf,sizeof(psd_header)+sizeof(tcp_header));//计算IP校验和memcpy(SendBuf,&ip_header,sizeof(ip_header));memcpy(SendBuf+sizeof(ip_header),&tcp_header,sizeof(tcp_header)); memset(SendBuf+sizeof(ip_header)+sizeof(tcp_header),0,4);datasize=sizeof(ip_header)+sizeof(tcp_header);ip_header.checksum=checksum((USHORT *)SendBuf,datasize);//填充发送缓冲区memcpy(SendBuf,&ip_header,sizeof(ip_header));//发送TCP报文iErrorCode=sendto(sockRaw,SendBuf,datasize,0,(struct sockaddr*) &dest, sizeof(dest));CheckSockError(iErrorCode, "sendto()");}end=clock();//计时结束ScanOK=TRUE;printf("Closeing Thread.....\n");WaitForSingleObject(Thread,5000);CloseHandle(Thread);costtime= (float)(end - start) / CLOCKS_PER_SEC; //转换时间格式printf("Cost time:%f Sec",costtime);//显示耗时//退出前清理if(sockRaw != INVALID_SOCKET) closesocket(sockRaw);WSACleanup();re turn 0;}。