本文目录导读：
我来介绍几种不同编程语言实现端口扫描简易脚本的方法。
Python版本（最常用）
使用socket库（基础版）
import socket
import threading
from datetime import datetime
def scan_port(host, port):
"""扫描单个端口"""
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(1) # 设置超时时间
result = sock.connect_ex((host, port))
if result == 0:
print(f"端口 {port} 开放")
sock.close()
except Exception as e:
print(f"扫描端口 {port} 时出错: {e}")
def scan_ports(host, start_port, end_port):
"""扫描端口范围"""
print(f"开始扫描 {host} 的端口 {start_port}-{end_port}")
print(f"开始时间: {datetime.now()}")
threads = []
for port in range(start_port, end_port + 1):
thread = threading.Thread(target=scan_port, args=(host, port))
threads.append(thread)
thread.start()
# 等待所有线程完成
for thread in threads:
thread.join()
print(f"扫描完成时间: {datetime.now()}")
# 使用示例
if __name__ == "__main__":
target_host = input("请输入目标主机IP或域名: ")
start_port = int(input("请输入起始端口: "))
end_port = int(input("请输入结束端口: "))
scan_ports(target_host, start_port, end_port)
使用python-nmap（高级版）
首先安装：pip install python-nmap
import nmap
import sys
def nmap_scan(target, ports):
"""使用nmap进行端口扫描"""
nm = nmap.PortScanner()
try:
print(f"正在扫描 {target} 的端口 {ports}")
nm.scan(target, ports, arguments='-sV') # -sV 获取服务版本
for host in nm.all_hosts():
print(f"\n主机: {host} ({nm[host].hostname()})")
print(f"状态: {nm[host].state()}")
for proto in nm[host].all_protocols():
print(f"\n协议: {proto}")
ports = nm[host][proto].keys()
for port in sorted(ports):
state = nm[host][proto][port]['state']
service = nm[host][proto][port].get('name', 'unknown')
print(f" 端口 {port}: {state} ({service})")
except Exception as e:
print(f"扫描出错: {e}")
# 使用示例
if __name__ == "__main__":
target = input("请输入目标: ")
ports = input("请输入端口范围 (如: 1-1000): ")
nmap_scan(target, ports)
Bash版本（简单快速）
#!/bin/bash
# 端口扫描脚本
TARGET=${1:-localhost}
START_PORT=${2:-1}
END_PORT=${3:-1000}
echo "扫描目标: $TARGET"
echo "端口范围: $START_PORT - $END_PORT"
echo "开始扫描..."
for port in $(seq $START_PORT $END_PORT)
do
# 使用 /dev/tcp 进行连接测试
timeout 1 bash -c "echo >/dev/tcp/$TARGET/$port" 2>/dev/null && \
echo "端口 $port 开放"
done
echo "扫描完成"
Go版本（高性能）
package main
import (
"fmt"
"net"
"sync"
"time"
"flag"
)
func scanPort(host string, port int, wg *sync.WaitGroup) {
defer wg.Done()
address := fmt.Sprintf("%s:%d", host, port)
conn, err := net.DialTimeout("tcp", address, 2*time.Second)
if err == nil {
fmt.Printf("端口 %d 开放\n", port)
conn.Close()
}
}
func main() {
host := flag.String("host", "localhost", "目标主机")
startPort := flag.Int("start", 1, "起始端口")
endPort := flag.Int("end", 1024, "结束端口")
flag.Parse()
fmt.Printf("扫描 %s 的端口 %d-%d\n", *host, *startPort, *endPort)
fmt.Println("开始扫描...")
var wg sync.WaitGroup
for port := *startPort; port <= *endPort; port++ {
wg.Add(1)
go scanPort(*host, port, &wg)
}
wg.Wait()
fmt.Println("扫描完成")
}
增强版Python脚本（带进度显示）
import socket
import threading
import time
from queue import Queue
from datetime import datetime
class PortScanner:
def __init__(self, host, threads=100):
self.host = host
self.threads = threads
self.open_ports = []
self.queue = Queue()
self.lock = threading.Lock()
def scan_port(self, port):
"""扫描单个端口"""
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.settimeout(1)
result = sock.connect_ex((self.host, port))
if result == 0:
service = self.get_service_name(port)
with self.lock:
self.open_ports.append((port, service))
print(f"\r[+] 发现开放端口: {port} ({service})")
sock.close()
except:
pass
def get_service_name(self, port):
"""获取常用服务名称"""
common_services = {
21: "FTP", 22: "SSH", 23: "Telnet",
25: "SMTP", 53: "DNS", 80: "HTTP",
110: "POP3", 143: "IMAP", 443: "HTTPS",
3306: "MySQL", 3389: "RDP", 5432: "PostgreSQL",
6379: "Redis", 8080: "HTTP-Proxy", 27017: "MongoDB"
}
return common_services.get(port, "Unknown")
def worker(self):
"""工作线程"""
while True:
port = self.queue.get()
if port is None:
break
self.scan_port(port)
self.queue.task_done()
def scan(self, start_port=1, end_port=65535):
"""执行端口扫描"""
print(f"目标: {self.host}")
print(f"时间: {datetime.now()}")
print("-" * 50)
# 创建线程
threads = []
for _ in range(self.threads):
t = threading.Thread(target=self.worker)
t.start()
threads.append(t)
# 添加任务到队列
for port in range(start_port, end_port + 1):
self.queue.put(port)
# 等待所有任务完成
self.queue.join()
# 停止工作线程
for _ in range(self.threads):
self.queue.put(None)
for t in threads:
t.join()
# 输出结果
print("-" * 50)
print(f"扫描完成! 发现 {len(self.open_ports)} 个开放端口:")
for port, service in sorted(self.open_ports):
print(f" 端口 {port}: {service}")
# 使用示例
if __name__ == "__main__":
target_host = input("请输入目标主机: ")
scanner = PortScanner(target_host)
scanner.scan(1, 1000) # 扫描前1000个端口
使用注意事项
- 法律合规：只扫描自己拥有或获得明确授权的系统
- 网络影响：大规模扫描可能触发防火墙警报或影响网络性能
- 超时设置：根据网络环境调整超时时间
- 线程控制：合理设置并发数，避免耗尽资源
编译/运行方法
Python脚本：
python3 port_scanner.py
Bash脚本：
chmod +x port_scanner.sh ./port_scanner.sh 192.168.1.1 1 1000
Go脚本：
go build -o port_scanner port_scanner.go ./port_scanner -host=192.168.1.1 -start=1 -end=1000
这些脚本可以根据实际需求进行修改和扩展，比如添加服务版本检测、操作系统的识别等功能。
