端口扫描实验报告

端口扫描实验报告网络端口扫描实验报告姓名：刘俊峰学号：11054114班级：11052411课程：网络攻防技术老师：张旻一、网络端口扫描简介TCP/IP协议在网络层是无连接的，而“端口”，就已经到了传输层。

端口便是计算机与外部通信的途径。

一个端口就是一个潜在的通信通道，也就是一个入侵通道。

对目标计算机进行端口扫描，能得到许多有用的信息。

进行扫描的方法很多，可以是手工进行扫描，也可以用端口扫描软件进行。

在手工进行扫描时，需要熟悉各种命令，对命令执行后的输析出进行分，效率较低。

用扫描软件进行扫描时，许多扫描器软件都有分析数据的功能。

通过端口扫描，可以得到许多有用的信息，从而发现系统的安全漏洞。

扫描工具根据作用的环境不同可分为：网络漏洞扫描工具和主机漏洞扫描工具。

前者指通过网络检测远程目标网络和主机系统所存在漏洞的扫描工具。

后者指在本机运行的检测本地系统安全漏洞的扫描工具。

本实验主要针对前者。

端口是TCP协议中定义的，TCP协议通过套接字（socket）建立起两台计算机之间的网络连接。

它采用【IP地址：端口号】形式定义，通过套接字中不同的端口号来区别同一台计算机上开启的不同TCP和UDP连接进程。

端口号在0~~65535之间，低于1024的端口都有确切的定义，它们对应着因特网上常见的一些服务。

这些常见的服务可以划分为使用TCP端口（面向连接如打电话）和使用UDP端口（无连接如写信）两种。

端口与服务进程一一对应，通过扫描开放的端口就可以判断计算机中正在运行的服务进程。

二、实验目的1.了解熟悉MFC及的基本原理和方法。

2.加深对tcp的理解，学习端口扫描技术和，原理熟悉socket编程。

3.通过自己编程实现简单的IP端口扫描器模型。

4.通过端口扫描了解目标主机开放的端口和服务程序。

三、实验环境Windows操作系统VC++6.0开发环境四、实验设计实验原理通过调用socket函数connect()连接到目标计算机上,完成一次完整的三次握手过程，如果端口处于侦听状态，那么connect()就可以成功返回，否则这个端口不可用，即没有提供服务。

实验内容1. 设计实现端口扫描器2. IP地址、端口范围可以用户输入。

3. 要求有有好的可视化操作界面。

实验步骤：1、用户界面：使用vc6.0里的MFC来开发用户界面2、端口扫描：使用socket函数中的connect()连接计算机来判定目标计算机是否开放了要测试的端口五、代码实现#include <afxext.h>#include <winsock.h>#pragma comment(lib,"wsock32.lib")#define ZERO (fd_set *)0int maxth, scanok, scannum;int portip, hoststart, hoststop, startport, endport; long searchnum, searched;void usage(char *);void playx(int);void setip2(char *);void customport(char *, char *, char *);void portscannow(int);int main(int argc, char *argv[])WSADATA wsadata;system("cls.exe");printf("\r\n============== 命令行端口扫描器PortScanner V1.0 ==============");if ((argc < 3) || (argc > 4)){usage(argv[0]);return -1;}if(!(stricmp(strlwr(argv[1]), "-p") == 0)){usage(argv[0]);return -1;}if (WSAStartup(MAKEWORD(1,1), &wsadata) != 0){printf("\r\nWsatartup error");return -1;}if (argc == 3)setip2(argv[2]);}elseif (argc == 4){customport(argv[0], argv[2], argv[3]);}else{usage(argv[0]);return -1;}portscannow(argc);WSACleanup();return 0;}void usage(char * prog){printf("Usage: %s <Option>", prog);printf("\r\n\n <Option>:");printf("\r\n -p [ Port|StartPort-EndPort ] <HostName|IP|StartIP-EndIP >");printf("\r\n\n Example: ");printf("\r\n %s -p 192.168.0.1", prog);printf("\r\n %s -p 192.168.0.1-192.168.0.254", prog);printf("\r\n %s -p 21-80 192.168.0.1", prog); printf("\r\n %s -p 21-80 192.168.0.1-192.168.0.254\r\n", prog);return;}void playx(int play = 0){char *plays[12]={" | "," / "," - "," \\ "," | "," / "," - "," \\ "," | "," / "," - "," \\ ",};if (searchnum != 0){for (int i = 0 ; i <= 3; i ++){printf(" =%s= %d%s Completed. \r", plays ,searched * 100 / (searchnum + 1), "%");Sleep(5);}}else{printf(" =%s=\r", plays[play]);Sleep(10);}}void setip2(char *cp){int host;struct hostent *testhost;char *startip = "", *endip = "";if (strstr(cp, "-") && strlen(cp) > 15 && strlen(cp) < 32){endip = strchr(cp, '-') + 1;strncpy(startip, cp, strlen(cp) - strlen(strchr(cp, '-')));hoststart = ntohl(inet_addr(startip));hoststop = ntohl(inet_addr(endip)); }else{testhost = gethostbyname(startip);if(!testhost){WSACleanup( );printf("\r\nCan't get ip of: %s", cp); exit(-1);}memcpy(&host, testhost->h_addr, 4); hoststop = hoststart = ntohl(host);}}void TestThread(int thread = 200) {for (;;){playx();if (maxth > thread)Sleep(100);else break;}return;}void WaitThreadEnd(){Sleep(6000);printf("\r \r\n");printf(" Wait ( %d )Thread end...\r\n", maxth); for(;;){if (maxth > 0){Sleep(100);playx();continue;}else break;}printf("\r\n");return;}void customport(char *cp, char *cp2, char *cp3) {int intport;char *checker;startport = atoi(cp2);endport = atoi(cp2);if (strstr(cp2,"-")){intport = atoi(checker = strchr(cp2, '-') + 1);if (intport > 0 && intport < 65536)endport = intport;}if (startport < 0 || startport > 65536 || endport < 0 || endport > 65535){usage(cp);exit(-1);}setip2(cp3);}UINT portscan(LPVOID port){int addr = portip;int sock;struct fd_set mask;struct timeval timeout;struct sockaddr_in server;unsigned long flag = 1;sock = socket(AF_INET, SOCK_STREAM, 0); if (sock == INV ALID_SOCKET){printf("\r\nSock Error:%s", WSAGetLastError());maxth --;return -1;}server.sin_family=AF_INET;server.sin_addr.s_addr = htonl(addr);server.sin_port = htons(short(port));playx();if (ioctlsocket(sock, FIONBIO, &flag) != 0){printf("\r\nSock Error:%s",WSAGetLastError());closesocket(sock);maxth --;return -1;}connect(sock, (struct sockaddr*)&server, sizeof(server));_sec = 18;_usec = 0;FD_ZERO(&mask);FD_SET(sock, &mask);switch(select(sock + 1, ZERO, &mask, ZERO, &timeout)){case -1:{printf("\r\nSelect() error");maxth --;return -1;}case 0:{maxth --;closesocket(sock);return -1;}default:if(FD_ISSET(sock, &mask)){shutdown(sock, 0);printf(" [Found:] %s Port: %d open.\r\n", inet_ntoa(server.sin_addr),ntohs(server.sin_port));closesocket(sock);scanok ++;maxth --;return 1;}}return 0;}void portscannow(int xp){int sport;char *timenow, timebuf[32];char *ports[32]={ "21","22","23","25","53","79","80","110","1 11","113","123","135","139","143","443","51 2", "513","514","515","540","1080","1433","1521 ","1524","3306","3389","5631","6000","6112" ,"8000","8080","12345"};timenow = _strtime(timebuf);printf("\r\nPortScan Start Time: %s\r\n\n",timenow);maxth = 0;scanok = 0;scannum = 0;searched = 0;searchnum = hoststop - hoststart +1;if(xp == 3)searchnum = searchnum * 32;if(xp == 4)searchnum = searchnum * (endport - startport+1);for (portip = hoststart; portip <= hoststop; portip ++, scannum ++){if ((portip % 256) == 0 || (portip % 256) == 255) {if(xp == 3)searchnum = searchnum - 32;if(xp == 4)searchnum = searchnum - (endport - startport +1);scannum --;playx();continue;}if (xp == 3){for (sport = 0; sport < 32; sport ++, maxth ++, searched ++){TestThread(180);CWinThread * pthread =AfxBeginThread(portscan,LPVOID(atoi((char*) ports[sport])));Sleep(120);}}if (xp == 4){sport = endport - startport;if(sport > 500 ){for(sport = startport; sport <= endport; sport ++, maxth ++, searched ++){TestThread(2000);CWinThread * pthread = AfxBeginThread(portscan, LPVOID(sport)); Sleep(10);}}else{for(sport = startport; sport <= endport; sport++, maxth ++, searched ++){TestThread(250);CWinThread * pthread = AfxBeginThread(portscan, LPVOID(sport)); Sleep(100);playx();}}}}WaitThreadEnd();timenow = _strtime(timebuf);printf("\r\nPortScan End Time: %s", timenow); printf("\r\nScan %d Hosts completed. Open %d Ports!\r\n", scannum, scanok);}六、代码实现在刚开始的时候编译是成功的，但是build是有错误的，如图：在网上找解决的方法，发现是MFC连接的问题，在工程—>设置—>microsoft基础类中不使用MFC改成使用MFC作为静态链接库，确定后再次build。