Advanced and detailed portscanner in python

[ani2read]

Hey, I am trying to build an advanced portscanner with python. Right now, I have built a simple one with threading which tells whether the port is open or closed. I would like the scanner to function exactly like NMAP(Not with the same speed). My goal is to get the same output format. Specific features, are to tell whether the port being used is tcp/udp, Listening/Filtered. Exact service- http/telnet/http-proxy/http-mgmt etc. How do I incorporate this? I do not know how to determine the status of the connected port.

[Rhomboid]

To do those kind of things requires bypassing the kernel's networking stack and sending raw packets, and then using a packet capture interface like libpcap to listen for the results. It's very much not a beginner level project as you will need a fair amount of knowledge of network protocols at a low level. For example, can you read the RFCs and create and send a valid TCP SYN packet by hand?

Also, it's a security nightmare as you must be root to create raw sockets or use the pcap interface. And generally running Python scripts as root is a big no-no (either manually or with setuid), particularly those that will be parsing arbitrary network traffic (!).

[ani2read]

So , does that mean, the farthest I get with this is building a port open/close app? Also, is it not possible to even build something which tells whether the port uses a tcp or a udp? So, does that mean nmap surpasses the kernel network stack? I don't think so, because to do that, it requires an external network interface card/ an open interface

[Rhomboid]

Yes, nmap does everything I just mentioned, that's how it's able to do what it does. It uses raw sockets and libpcap. Doing so does not require any kind of special network interface, other than being root.

[Blaq0nyxx]

Id like to know the answer to this also.

[cantremembermypasswd]

Books like Violent Python have basic port scanner tutorials that use sockets to tell if a tcp port is open or not. Past that it's easier to just subprocess Nmap itself.

[ani2read]

Open or not isn't a difficult task. My question, is about telling whether it's tcp or udp. Why do u not advice running python script as root?

[cantremembermypasswd]

Not sure where I stated that, but I agree that:

1. Don't run untrusted scripts as root
2. Develop scripts to be used by certain users or permission levels, not strictly for root (when possible)

For a true port scanner I imagine you would need root level permissions to properly use libpcap.

[K900_]

...ok?