0

so this is what I need to do. I need a way to check if port 80 is open (if the host is running a web server on port 80) on lots of IPs at a time, very fast, and then only save the ips that have port 80 open. What would be the best way to do this the fastest? Thanks.

2

This would be really simple with Python, at least to verify that the port is open. You could then verify that there is a web-server running there if you make a request and verify the header (200 OK I think).

Anyway, to do this in Python install nmap to your system and then the python nmap bindings.

#!/usr/bin/env python

import nmap, threading, urllib2, socket

baseip = "108.170.28.{}"

def NmapPortScan( targethost, targetport = 80 ):
    print("Trying: " + str(targethost) )
    scanner = nmap.PortScanner()
    result = scanner.scan( str(targethost), str(targetport) )

    if ( int(result['nmap']['scanstats']['uphosts']) == 1):
        try:
            state = result[str(targethost)]['tcp'][int(targetport)]['state']
            print "State: {} : {}".format(str(targethost), str(state))
            return state
        except:
            print "State: {} : {}".format( str(targethost), "error")
            return "error"
    else:
        print "{}: Not up".format( str(targethost) )
        return "notup"

def CheckHttpStatus( targethost ):
    req = urllib2.urlopen( targethost )
    if( "Content-Type: text/html" in req.info().headers[3] ):
        return True
    else:
        return False

def LogIp( ipaddr ):
    with open("openips.txt", "a") as fi:
        fi.write( ipaddr + '\n' )
        fi.close()

def CheckIps( ip ):
    if ( NmapPortScan( ip ) == "open" ) and ( CheckHttpStatus( "http://" + socket.gethostbyaddr( ip )[0] ) ):
        #if ( CheckHttpStatus( "http://" + socket.gethostbyaddr( ip )[0] ) ):
        LogIp( ip )
        print( "Open Port 80 on: " + str(ip) )

def main():
    for i in range(153, 201):
    #for i in range(153, 154):
        ip = baseip.format(str(i))
        #CheckIps( ip )
        th = threading.Thread(target=CheckIps, args=(ip,))
        th.start()

if __name__ == "__main__":
    main()

This will both:

  1. Print a message to the console: Open Port 80 on: xxx.xxx.xxx.xxx

  2. Log to a file the IP: openips.txt saved to wherever you ran the script from.

|improve this answer|||||
  • Hmm... could you make this work for scanning big IP ranges? I do not know python... – user1307079 Jul 11 '13 at 20:11
  • @user1307079 - I'll update in a minute when I can do it and test. – nerdwaller Jul 11 '13 at 20:17
  • @user1307079 - Done. Should work for your IP range, but it looks like few are "up" and a bunch are giving errors. If you plugin google's IP 74.125.225.167 - instead of the range, you'll see it be happy. – nerdwaller Jul 11 '13 at 20:57
  • Thanks, it works :). How would I configure it to scan an even larger range of IP's though? Like all the way up to 1.x.x.x. And do you think that the python Nmap module will be faster than a regular nmap scan? – user1307079 Jul 11 '13 at 22:03
  • @user1307079 - That'll take a bit more work, but you can. Easiest answer is if you want to do all ip's from 1.0.0.0 to 1.255.255.255 is do: baseip = "1.{0}.{0}.{0}" and then change my loop to be for i in range(0, 256): (note: 256 because it is [start-end)). Yes, this is likely faster because you are threading out all the nmap work. But I am not super familiar with how nmap fully works outside of limited use cases I have used it for. – nerdwaller Jul 11 '13 at 23:45
3

Fastest way:

~ # nmap 192.168.1.0/24 -p 80

just change 192.168.1.0/24 to your subnet/mask

|improve this answer|||||
2

Check out nmap.org for information on the nmap command-line tool, which may already be installed on your system. It's for exactly this purpose. Remember, do no evil!

|improve this answer|||||
  • I have tried this: nmap 108.170.28.153-200 -p 80 | grep -Em 1 "\|[0-9\.]+\|" | sed -r "s/^.*\|([0-9\.]+)\|.*$/\1/g" >>file.txt, but I get this error: Failed to find device eth0 which was referenced in /proc/net/route... – user1307079 Jul 11 '13 at 20:00
  • 1
    that's an entirely separate issue... – MattDMo Jul 11 '13 at 20:02
  • 1
    Did you try google-ing the error message? – Janos Pasztor Jul 11 '13 at 20:02
  • Yes, I could not get anything helpful, I am using eth1 for my main eth though... – user1307079 Jul 11 '13 at 20:04
  • yeah, I figured. Are you running the latest version of nmap? – MattDMo Jul 11 '13 at 20:06
1

Write a script that uses nmap or netcat to query the IP addresses in question then parse the result.

|improve this answer|||||
  • I have tried this: nmap 108.170.28.153-200 -p 80 | grep -Em 1 "\|[0-9\.]+\|" | sed -r "s/^.*\|([0-9\.]+)\|.*$/\1/g" >>file.txt, but I get this error: Failed to find device eth0 which was referenced in /proc/net/route... – user1307079 Jul 11 '13 at 19:59
0

Use Nmap and pipe the output through grep.

|improve this answer|||||
  • I have tried this: nmap 108.170.28.153-200 -p 80 | grep -Em 1 "\|[0-9\.]+\|" | sed -r "s/^.*\|([0-9\.]+)\|.*$/\1/g" >>file.txt, but I get this error: Failed to find device eth0 which was referenced in /proc/net/route... – user1307079 Jul 11 '13 at 19:58
  • You need to grep for "Open" or something specific that nmap generates to tell you the scanned port is online. – Scandalist Jul 11 '13 at 20:02
  • How would I modify it so it works? Nothing is outputted. – user1307079 Jul 11 '13 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.