怎样做端口扫描简易脚本

本文目录导读：

1. Python版本（最常用）
2. Bash版本（简单快速）
3. Go版本（高性能）
4. 增强版Python脚本（带进度显示）
5. 使用注意事项
6. 编译/运行方法

我来介绍几种不同编程语言实现端口扫描简易脚本的方法。

Python版本（最常用）

使用socket库（基础版）

import socket
import threading
from datetime import datetime
def scan_port(host, port):
    """扫描单个端口"""
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(1)  # 设置超时时间
        result = sock.connect_ex((host, port))
        if result == 0:
            print(f"端口 {port} 开放")
        sock.close()
    except Exception as e:
        print(f"扫描端口 {port} 时出错: {e}")
def scan_ports(host, start_port, end_port):
    """扫描端口范围"""
    print(f"开始扫描 {host} 的端口 {start_port}-{end_port}")
    print(f"开始时间: {datetime.now()}")
    threads = []
    for port in range(start_port, end_port + 1):
        thread = threading.Thread(target=scan_port, args=(host, port))
        threads.append(thread)
        thread.start()
    # 等待所有线程完成
    for thread in threads:
        thread.join()
    print(f"扫描完成时间: {datetime.now()}")
# 使用示例
if __name__ == "__main__":
    target_host = input("请输入目标主机IP或域名: ")
    start_port = int(input("请输入起始端口: "))
    end_port = int(input("请输入结束端口: "))
    scan_ports(target_host, start_port, end_port)

使用python-nmap（高级版）

首先安装：pip install python-nmap

import nmap
import sys
def nmap_scan(target, ports):
    """使用nmap进行端口扫描"""
    nm = nmap.PortScanner()
    try:
        print(f"正在扫描 {target} 的端口 {ports}")
        nm.scan(target, ports, arguments='-sV')  # -sV 获取服务版本
        for host in nm.all_hosts():
            print(f"\n主机: {host} ({nm[host].hostname()})")
            print(f"状态: {nm[host].state()}")
            for proto in nm[host].all_protocols():
                print(f"\n协议: {proto}")
                ports = nm[host][proto].keys()
                for port in sorted(ports):
                    state = nm[host][proto][port]['state']
                    service = nm[host][proto][port].get('name', 'unknown')
                    print(f"  端口 {port}: {state} ({service})")
    except Exception as e:
        print(f"扫描出错: {e}")
# 使用示例
if __name__ == "__main__":
    target = input("请输入目标: ")
    ports = input("请输入端口范围 (如: 1-1000): ")
    nmap_scan(target, ports)

Bash版本（简单快速）

#!/bin/bash
# 端口扫描脚本
TARGET=${1:-localhost}
START_PORT=${2:-1}
END_PORT=${3:-1000}
echo "扫描目标: $TARGET"
echo "端口范围: $START_PORT - $END_PORT"
echo "开始扫描..."
for port in $(seq $START_PORT $END_PORT)
do
    # 使用 /dev/tcp 进行连接测试
    timeout 1 bash -c "echo >/dev/tcp/$TARGET/$port" 2>/dev/null && \
    echo "端口 $port 开放"
done
echo "扫描完成"

Go版本（高性能）

package main
import (
    "fmt"
    "net"
    "sync"
    "time"
    "flag"
)
func scanPort(host string, port int, wg *sync.WaitGroup) {
    defer wg.Done()
    address := fmt.Sprintf("%s:%d", host, port)
    conn, err := net.DialTimeout("tcp", address, 2*time.Second)
    if err == nil {
        fmt.Printf("端口 %d 开放\n", port)
        conn.Close()
    }
}
func main() {
    host := flag.String("host", "localhost", "目标主机")
    startPort := flag.Int("start", 1, "起始端口")
    endPort := flag.Int("end", 1024, "结束端口")
    flag.Parse()
    fmt.Printf("扫描 %s 的端口 %d-%d\n", *host, *startPort, *endPort)
    fmt.Println("开始扫描...")
    var wg sync.WaitGroup
    for port := *startPort; port <= *endPort; port++ {
        wg.Add(1)
        go scanPort(*host, port, &wg)
    }
    wg.Wait()
    fmt.Println("扫描完成")
}

增强版Python脚本（带进度显示）

import socket
import threading
import time
from queue import Queue
from datetime import datetime
class PortScanner:
    def __init__(self, host, threads=100):
        self.host = host
        self.threads = threads
        self.open_ports = []
        self.queue = Queue()
        self.lock = threading.Lock()
    def scan_port(self, port):
        """扫描单个端口"""
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(1)
            result = sock.connect_ex((self.host, port))
            if result == 0:
                service = self.get_service_name(port)
                with self.lock:
                    self.open_ports.append((port, service))
                    print(f"\r[+] 发现开放端口: {port} ({service})")
            sock.close()
        except:
            pass
    def get_service_name(self, port):
        """获取常用服务名称"""
        common_services = {
            21: "FTP", 22: "SSH", 23: "Telnet",
            25: "SMTP", 53: "DNS", 80: "HTTP",
            110: "POP3", 143: "IMAP", 443: "HTTPS",
            3306: "MySQL", 3389: "RDP", 5432: "PostgreSQL",
            6379: "Redis", 8080: "HTTP-Proxy", 27017: "MongoDB"
        }
        return common_services.get(port, "Unknown")
    def worker(self):
        """工作线程"""
        while True:
            port = self.queue.get()
            if port is None:
                break
            self.scan_port(port)
            self.queue.task_done()
    def scan(self, start_port=1, end_port=65535):
        """执行端口扫描"""
        print(f"目标: {self.host}")
        print(f"时间: {datetime.now()}")
        print("-" * 50)
        # 创建线程
        threads = []
        for _ in range(self.threads):
            t = threading.Thread(target=self.worker)
            t.start()
            threads.append(t)
        # 添加任务到队列
        for port in range(start_port, end_port + 1):
            self.queue.put(port)
        # 等待所有任务完成
        self.queue.join()
        # 停止工作线程
        for _ in range(self.threads):
            self.queue.put(None)
        for t in threads:
            t.join()
        # 输出结果
        print("-" * 50)
        print(f"扫描完成! 发现 {len(self.open_ports)} 个开放端口:")
        for port, service in sorted(self.open_ports):
            print(f"  端口 {port}: {service}")
# 使用示例
if __name__ == "__main__":
    target_host = input("请输入目标主机: ")
    scanner = PortScanner(target_host)
    scanner.scan(1, 1000)  # 扫描前1000个端口

使用注意事项

1. 法律合规：只扫描自己拥有或获得明确授权的系统
2. 网络影响：大规模扫描可能触发防火墙警报或影响网络性能
3. 超时设置：根据网络环境调整超时时间
4. 线程控制：合理设置并发数，避免耗尽资源

编译/运行方法

Python脚本：

python3 port_scanner.py

Bash脚本：

chmod +x port_scanner.sh
./port_scanner.sh 192.168.1.1 1 1000

Go脚本：

go build -o port_scanner port_scanner.go
./port_scanner -host=192.168.1.1 -start=1 -end=1000

这些脚本可以根据实际需求进行修改和扩展，比如添加服务版本检测、操作系统的识别等功能。