Python3 For Pentesting - Developing An Nmap Scanner

Key Takeaways

[Music] hey guys hackersploit here back again with another video and welcome back to the python scripting series now i know i haven't uploaded a video in this series for a long time especially in python and you know as promised earlier during the schedule and in the previous python 3 video we're going to be looking at creating our very own tools and utilizing the python programming language to essentially create various tools that can use that can be used to automate tasks uh to automate various aspects of the penetration testing life cycle so without further ado let's get started now as you've probably read by the title of this video we'll be looking at creating an nmap scanner now this is going to be part of a larger project and we're going to be creating uh every every weekend really we're going to be working on each of the modules that will then fit in into the larger script so this script is essentially going to be an all-in-one reconnaissance slash enumeration slash fuzzing tool uh that will essentially have all the tools necessary for you to automate the process or at least make it a little bit easier and also we'll be looking at uh trying to implement a documentation system or a web interface all right so for this video let's start off with creating a very simple nmap scanner with python 3. now for those of you who have watched my uh my video on python 2 where i actually created this i really did not give it any useful functionality i simply explained how the the nmap module for python works so hopefully now i can explain it a little bit better so my development environment for this entire project will be as follows i'm currently running kali linux alright so you can test it out on any linux distribution or in windows if you want uh just make sure to install the uh the python nmap module all right now we're gonna we're gonna also be using python 3 so again because of the fact that python 2 is almost getting deprecated or losing support in i think in 2020 so i think it's time to move on to python 3. i've fully learned it and i really enjoy using it and the differences are very minor all right so as you can see i'm using v visual studio code as my development uh my integrated development environment and i have the python extensions installed from the extensions manager right over here i've set up my um if you can just take a look we have set up my interpreter whether that is going to be used for uh for the project so make sure you set it as python 3. all right so i'm going to be discussing various uh methods uh and various nmap methods and i'll explain hopefully i can explain what each and every one does all right so the program that we're going to create today is we're going to create a very very simple program that will ask the user uh for the uh for an ip address that they want to scan it'll then prompt them i'll then ask them for uh to to select a type of scan that they want to run for for example we could have a synth scan a udp scan or a complete comprehensive scan that will include operating system fingerprinting service fingerprinting uh an aggressive scan synth scanning and also using the default scripts that come with nmap all right so uh to get the python nmap module installed make sure you have pip and for the appropriate version you make sure you have pip installed for python 3. so uh let me just open up my terminal here and i'll increase the the font size here just give it a second there we are all right so to install it all you need to do is simply type in uh you simply need to type in pip3 uh install and you have your python uh nmap if i'm not if i'm not mistaken so just hit enter and they should install the python and module just give it a few seconds to start collecting the details and there you are so i already have it installed and you can see it's the latest version is python and map version 0.6.1 all right so we are pretty much good to go at this point all right so let me just go back into my development environment here and the first thing we are going to do is we are going to need to import nmap so to do that as you probably know uh you know through the syntax of python is done by typing in import nmap all right and that's as simple as that so we've imported the nmap module and now we can use the various classes and methods that come within the module which are extremely helpful we're then going to create a variable called scanner and this is going to be used to call the class the nmap port scanner class so to do that we simply type in nmap and we use the port scanner class right over here and uh we can also just add the two uh we can add uh the two per the two brackets there all right so if you hover over the port scanner right over here it should give you a bit more information about the class so there you are you can go ahead and inspect it if you've set up your development environment correctly all right so we have assigned the variable uh we're using the variable to call so whenever we use the variable we are going to be extending the functionality of the port scanner or of the nmap module really or the pod scanner class all right so now we're going to prompt the user we're just going to say welcome and of course as i said this is going to be part of a larger program so this is going to be one function so when we're going to be compiling everything together this is going to be one part off of the entire larger program or script and it'll be completely open source and a lot of you guys can improve it if you want you can fork this on github and improve it in any way you feel uh is is much better or will increase the the performance the efficiency etc all right so we're going to say welcome this is a simple um nmap automation tool all right so simple nmap automation tool and that's pretty much it for that line uh we are now just going to add a divider here um so i'll just create a small little divider here that will just separate this from anything else that we are actually going to get started with all right so now we are going to prompt the user to enter the ip address that they want to scan and to do this we're going to be using we'll assign it a variable and since we're inputting the data we can prompt them and then wait for the input and i'll show you how to do that so we're just going to create a variable called ip address and that is going to be equals to the input and we have the prompt there that's going to prompt the user to input so we're going to say please um enter your or we can just please enter the vip address you want to scan all right so you want to scan all right and uh we can just give it a nice little colon right over there so we have great punctuation and then we're going to print out uh we're going to print out we're going to say we're just going to make sure that the user has entered the ip correctly so we're going to ask them if this is the correct ip so we're going to say the ip you entered is and since the value is already we've already given ip address the value of the user has already inputted it we can simply just give it a nice little space here and use the variable ip address there to display what the user entered all right and the type is going to be that of of the variable itself or the the data that the uh that the user inputs of course we're going to be sanitizing the input to make sure that um that no other pieces of text are entered because if if the user enters any any strings here uh it'll really not be any uh really not be helpful all right so now um we can now create another variable here that is going to ask the user to select uh to select the type of scan they want to run all right but before we do that let me just save this and make sure everything is working correctly so i'm just going to run the python file in the terminal and for some reason my compiler here is not allowing me to actually execute this let me just make sure i have the correct python version here so let me use python 3 like so and let me just run this one more time still give me if it still gives me the error i can let me just run it in my terminal here all right so cd desktop and we're just going to run python3 and that's going to be scanner.pi and there we are so welcome this is a simple nmap automation tool please enter the ip address you want to scan [Applause] 68.1.1 i'm going to hit enter and there we are so that is working perfectly it's going to even prompt i'll give you the uh the ip that you entered which is awesome now we can extend the functionality a little bit more all right so we are going to be calling the variable response so this is going to be the response that the user gives when uh when prompted or asked as to what scan they want to run all right and again we're going to be prompting or waiting for the user input here we're going to have a multi-line um sorry we're gonna have a multi-line string uh or uh we're gonna have a multi-line strings here so we are going to essentially just uh make sure that this goes to a new line so to the next line so we're gonna say please um please enter uh the type of scan you want to run so the type of scan sorry about that the type of scan you want to run and we'll move on to the next line and let me just tap this right over here we can indent it so it matches that uh and we're just going to say option one is going to be uh let me just make sure that is correctly lined there um sorry about that let me just indent that correctly all right there we are so we're going to say option one is going to be a synax scan so syn ack scan punctuate that correctly and we're going to say option 2 is going to be let's see a udp scan of course we'll be increasing the functionality of of this scanner but for now let's focus on very basic options that we can provide um let's say we want to use now we can want to perform a comprehensive scan and that can be denoted as follows and you can also give the user a bit of an idea of what this scan will do exactly uh but for that that's fine now we can also say let me just get out of that indentation we can now print this out and say uh you have we can also make sure we make sure that the user has selected the option uh correctly so we can say where we can say selected the uh we have selected option and we can just give it a nice little colon there and again we use the variable to which are the values assigned like so all right now we can use our conditional statements to either run scans depending on the answer that uh or depending on the on the on what the user wants to run in terms of a scan so option one is a synax scan option two is a udp scan and option three is a comprehensive scan all right so to do this we get started the if statement so if um well we can actually we don't need to get started with the equal sign so we're going to say if response is equal to 1 all right so that is the synax scan then i want you to do the following all right so we are going to say if a response is equal to 1 we want to first of all print the nmap version out we then want to initialize the scanner or use this kind of variable to call the nmap class so that we can essentially start the scan and we can provide the arguments in regards to the amount of ports that you want to scan and uh the uh the end map options or arguments that you need to provide to in order to perform uh the synax scan all right so let me show you what we're going to do so um we are going to let me just make sure that is indented correctly all right so we're going to say print we're going to print out um the nmap version so i'm just going to add some text here we're going to say nmap version is as follows we'll give it a nice little space here and we're going to say scanner dot nmap so we're using this kind of variable and now we're calling the additional functionality so scanner dot nmap version and we can then use the parentheses right over here we don't need to specify anything else all right so that is going to print out the nmap version and now we can actually get started with scanning so we're going to say scanner dot scan and in here we provide the ip address if you remember in my python 2 video we actually specified the ip address within the script which is not cool it's much better if a user can input the ip address that they want to scan all right so we are going to say um ip address the variable ip address which we assigned earlier which is not like that it is like so and now we're going to specify the range of ports so for a default scan we're just going to scan uh the ports from 1 to 1024 or you can you can run even the entire spectrum of ports if that's what you want and of course we'll be customizing it all right so now we can then specify the argument so we want to verbose the output and we're going to perform a simple a synax scan so that is denoted by ss so those are the arguments so the scanner requires all of these um it's very simple to understand what's going on here just like if you would run a simple nmap scan in your terminal you first provide you provide the the nmap you type in nmap you then provide the ip address the port and the type of a scan you want to run now of course if you don't specify the port it's going to scan the the 1000 of the most popular ports which you can do but it's always good to have that in place in case you want to customize uh if in case you want to uh customize the range or the types of ports you want to scan all right so we have uh essentially started the scan now we need to print out the scan info all right so the scan info will display various in uh bits of information like for example tcp these services and the method so if you if it's a connect method you'll display that so to do that we simply type in uh print we're printing it out so we're going to say print and we're going to say scanner sorry scanner dot scan info and it'll give you this right over here if you have intellisense enabled in your integrated development environment all right so we're just displaying the scan info and now we need to print um we now need to display whether or not the ip address is up or down when i say up or down whether it's active it's connected to the internet it's reachable or it's unreachable so to do this we're going to say print and we're going to be making a use of the uh the uh the state method that comes with nmap so i'll show you how to use it so we're just going to put in some text so we're going to say ipstatus so just so the user understands what's going on and we'll leave a nice little space there and we're going to call scanner uh we're going to say scanner and in your square brackets we're going to give the ip address variable so ip address let me just make sure that is spelled out correctly so ip address and ip address dot state and that is going to essentially show if the ip address is up or down so the user knows whether it's online or offline all right we have our parentheses here and now we need to actually print all the protocols now um the protocols essentially just prints out what protocol you're scanning for with htcp or udp that's essentially what you're going to be printing out and of course you can edit the uh the order in which you want all of these results displayed this is uh totally up to you all right so we're going to say print um and uh well we have entered the scan information now yeah we were talking we have rented this state yeah we we probably now should display what protocol we're scanning for so um what i'm going to do is i'm going to open the brackets here and we're going to say scanner scanner of course the ip address it's important to always specify the value of the ip address here ip address in square brackets and this is dot all protocols all right dot all protocols and open the brackets right over here and i will go down right down over here and now uh we need to essentially display the open ports that's probably the most important bit of information here now to do this we use the keys method all right now the keys method will essentially return all the active ports or all the uh the ports that are reachable within the specified range all right so to do that the syntax is extremely simple to understand all we need to do is set type in print so because we're displaying it and we can say the open ports are going to be and we'll give it a space and we're going to say scanner and of course we specify the ip address here so ip address and that is going to be we need to specify the type of protocol so tcp in also square brackets and then the tcp dot keys all right so the keys method allows you to display as i mentioned earlier or will actually return all the active ports available within the specified range all right so that is how to use that now we have currently finished one of these conditional statements and of course we have to use the lift statement here but before we do that let's actually test the functionality and we'll test the first option that we have cated for if that is a synax scan all right so let me just run this in my terminal i'll actually keep that open now so we can have it on standby uh desktop all right so python 3 and we're running the scanner.pi all right so please enter the ip address you want to scan i'm going to try uh my my router because it probably has about three ports open uh 192.968.1.1 and it's going to ask us uh to enter the type of scan we want to run in of course we see our first error here we haven't actually switched to the next line right over here so before we actually do that let me uh actually add that piece of code right over here so that we actually move on to the next line all right so we'll just use the n command right over here oops that my bad and that is going to be the end command and there we are so that goes on to a new line and we'll just break this right over here and we'll start that one more time 0.1.1 and it's going to ask us for ip address i mean for the type of scan that we want to run since we've indicated for option one i'm going to hit one so it's going to tell us you have selected option one it's going to print out the nmap version it's going to print out the scan info which you can remove if you don't need the ip status is up you can see right over here the protocol will be using is tcp the current open ports are 22 23 and 80. all right so it's displaying the information that we wanted now many of you will say well this isn't really information that is displayed or formatted correctly and i totally understand and agree we are going to be looking at how to get only the the information we want for example we don't need it to display all of this right over here we can essentially sort it out so it displays it in a much better way or a much understandable way similar to what we have here with the ip status all right now if i was to run the script one more time and i enter an ip address on my local error network that that does not actually exist or is not online it should be able to tell us that it is offline all right so there we are you can see ip status is down and of course we're going to get an error here given the by the fact that it is uh it's not currently online which will be sorting out as as we move along with this project all right so that is the first option cated for now we use the lift statement here and we're going to see if we're going to provide another varied conditional statements here in case the user enters another option which is option 2 next and we can pretty much copy this except this is going to be for the udp scan so we need to change a bit of the syntax to actually uh to actually match that of a udp uh to actually make it uh to make it work for udp and i'll show you what we need to change exactly now i do not want to damage the indentation so i'm just going to copy this right over here and because because we do not need to type it out we do not need to type everything out so uh what we need to edit is we need to edit the we can leave the port range as as it is we don't need to change anything there is instead of pulse output we can change that into scu so we're scanning for udp ports scan info is fine iep status is also fine the protocols are fine we only need to change the tcp into udp right over here so it displays the udp posts that are currently active or online all right and if we save this and run we actually should see that this uh that this should be able to scan udp ports so i'm going to run it i'm going to enter one of my windows computers 192.68.1.10 i'm gonna hit enter i'm gonna hit two for udp scan you've selected option two this end map version is version seven point seven zero uh and we're just going to give that a few seconds to scan for all the udp ports available it should return the port 137 right over here excellent so we know it does work and it's telling us the ip status is up uh udp and the open ports are port 137 we'll be looking at or get a read of all of this information right over here but for now do not worry about any of that just focus on the functionality and the fact that it is returning the information that we want all right so we have our final uh we have our final version here that we need to our final uh option sorry that we need to cater for uh and that is going to be uh for the uh for the comprehensive scan which is going to be like a complete scan all right so i'm just gonna paste in what we copied earlier and we'll edit it appropriately in this case we are going to stick with tcp and that is a comprehensive scan so uh our comprehensive scan is going to be uh of course the post output we're going to use the syn scan so again i'll just make sure that is there one more time sv for service fingerprinting or service enumeration sc for defaults for the default scripts and an aggressive scan and operating system detection so quite comprehensive in terms of what it does you can you can edit the amount of ports you want to scan for you can change that right over here and we'll be adding that functionality so the user can enter the amount of ports that they want to scan for all right and this should uh work now for the comprehensive scan we are not going to test it because i'm pretty sure it is going to work uh now we can print in our last uh else uh statement here in case anyone enters anything funny or any uh anything over four so that we can actually just uh exit the program so we're just gonna make it a very simple exit right over here so if sorry what am i doing else well we can just say we can also use the lf instead of l so l if response is equal to well we can actually say greater than or equal to four uh so if it's anything like four or greater than four or four really then it should print out this now of course i have forgotten to include the colon here which would have caused a lot of issues and we'll just go down right over here and we're just going to say print and we're just going to say please enter a valid option okay and this is pretty much what we're going to be looking at in this video or what i wanted to cover in this video we can of course extend the functionality a little bit more to make it so that uh once the user has got the results it re-loops the program if the user so wishes to but for now let's just stick to this as the closure to this program or to this simple module that we've worked that we've worked on in this episode so i'm just going to save this and let's test if this script actually works or is functional and we can actually use it for getting results all right so what i'm going to do is i'm just going to drag this right over here so we can see everything that's being displayed and we're going to run python 3 and there we are python 3 scanner.pi and we're going to enter the iep address so i'm just going to run a comprehensive scan 0.1.102 on my windows operating system there we are comprehensive scan we're going to option 3 and it tells us you have selected option three the nmap version is and map version 7.70 and of course given that this is a comprehensive scan it's going to take a while so i'm just going to wait for this to complete and i'll get back to you when that's done all right the scan is completed and it pretty much give us the information we were expecting in terms of of what we wanted it to display so display the nmap version uh the scan information uh the status of the ip address uh the protocol that we're using and the open ports now uh given that this is a comprehensive scan it should have displayed more like the operating system that was detected but of course we haven't added that functionality yet now a lot of you guys are asking me well this is very very simple and i get the idea as i said we're going to be working on a larger script that will incorporate every aspect of the information gathering slash footprinting slash uh enumeration uh stage of penetration testing so it's going to include tools for ip addresses web web application scanning web application directory traversal all of that good stuff is going to be a complete script so we're going to work work at it one module at a time now of course i'm not done with this and i would like to see what you guys think and whether or not you can improve it definitely if you can this will be on github you can fork it and improve it and let me know once you've actually made uh or you have improved it so that i can actually take a look and we can then uh we can then release it as another version or we can we can actually create a branch all right so with that being said that's going to be it for this video guys thank you so much for watching if you have any questions or suggestions let me know in the comment section on my social networks on my website and i'll be seeing you in the next video peace [Music] [Applause] [Music]