应用python模块nmap，载入excel数据信息对好几个ip端口探活扫描

我一个打响指下来，每个人要少一个睾丸。。。

1、磨刀不误砍柴工工欲善其事。安裝python-nmap模块。

pip list #cmd或powershell下 查询已安裝模块，对于pip命令系统变量，自身处理 pip install python-nmap

撰写简易的nmap单端口跑一下看一下实际效果。

\'\'\'假如安裝了python-nmap模块还无法应用，那么就自主安裝nmap图形界面页面，随后加上到系统变量里，那样就ok了，我的就这样；\'\'\'

import nmap   
np = nmap.PortScanner()  
a = np.scan(hosts=\'42.247.22.192\',ports=\'80\',arguments=\'-v -n -T4\')
print(a)

回到結果： （关键的地点我已标红，关键也是看回到端口状态和服务项目名）

{\'nmap\': {\'command_line\': \'nmap -oX - -p 80 -v -n -T4 42.247.22.192\', \'scaninfo\': {\'tcp\': 
{\'method\': \'syn\', \'services\': \'80\'}}, \'scanstats\': {\'timestr\': \'Thu Jun 10 11:31:57 2021\', 
\'elapsed\': \'1.72\', \'uphosts\': \'1\', \'downhosts\': \'0\', \'totalhosts\': \'1\'}}, \'scan\': {\'42.247.22.192\': 
{\'hostnames\': [{\'name\': \'\', \'type\': \'\'}], \'addresses\': {\'ipv4\': \'42.247.22.192\'}, \'vendor\': 
{}, \'status\': {\'state\': \'up\', \'reason\': \'syn-ack\'}, \'tcp\': {80: {\'state\': \'open\', \'reason\': \'syn-ack\', \'name\': \'http\',
\'product\': \'\', \'version\': \'\', \'extrainfo\': \'\', \'conf\': \'3\', \'cpe\': \'\'}}}}}

2、下边对取得的数据统计分析一下輸出，使他看上去简约一些

import nmap   
np = nmap.PortScanner()  
a = np.scan(hosts=\'42.247.22.192\',ports=\'80\',arguments=\'-v -n -T4\')
ip = \'42.247.22.192\'
for i in a[\'scan\'][ip][\'tcp\'].keys():
    state = a[\'scan\'][ip][\'tcp\'][i][\'state\']
    name = a[\'scan\'][ip][\'tcp\'][i][\'name\'] 
    print(ip,i,state,name)

回到結果： 42.247.22.192 80 open http

看见干净整洁多了。

后边有关excel载入和进程的编码我立即贴了，今日事儿多不详说了。。

3、应用python调用excel模块和进程模块，载入excel数据信息，对好几条数据信息开展扫描。

import nmap
import threading
from openpyxl import load_workbook
from xlwt import Workbook

wk = Workbook(encoding=\'utf-8\')
wsheet = wk.add_sheet(\'Worksheet\')
co = {}
ls = []
def read_excel_file():
    wb = load_workbook(\'test/diqu.xlsx\')   #载入excel文档
    # sheets = wb.get_sheet_names()
    # print(sheets)
    sheet = wb[\'曝露面财产全量\']
    # print(sheet)
    m = sheet[\'G\']      #载入excelG列，我的G列是 ip:port,例：1.1.1.1:80

    for cell in m:            #这一for循环用以切分ip和端口，存进co词典
        # print(cell.value)
        mn = cell.value.split(\':\')
        if mn[0] in co:
            co[mn[0]].append(mn[1]) 
        else:     
            try:    
                co[mn[0]] = [mn[1]]
            except:
                co[mn[0]] = []

def thread(ip_port):       # 设定进程
    thread_num = threading.Semaphore(20)     # 设定连接数
    thread_list = []
    for IP, port in ip_port.items():        # 建立进程
        t = threading.Thread(target=nmap_ping_scan, args=(IP, port, thread_num,))
        thread_list.append(t)
        # print(t)
    for t in thread_list:     # 逐渐进程
        t.start()

    for t in thread_list:    # 等候进程
        t.join()
    print(\'线程完毕\')

def nmap_ping_scan(ip,port,thread_num):    #应用nmap扫描，結果存进ls目录
    global ls
    strport = \',\'.join(ports for ports in port)
    thread_num.acquire()          # 线程锁
    try:
        nm = nmap.PortScanner()
        global result
        np = nm.scan(hosts=ip,ports=strport,arguments=\"-v -n -T4\")
        for i in np[\'scan\'][ip][\'tcp\'].keys():
            state = np[\'scan\'][ip][\'tcp\'][i][\'state\']
            name = np[\'scan\'][ip][\'tcp\'][i][\'name\']
            ls.extend([[ip,i,state,name]])
            # print(ip,i,state)
    except Exception as e:
        # print(e)
        pass
    thread_num.release()

def excel_write(ls):        #把ls列表的信息存放到新的excel中
    try:
        for u in range(len(ls)):
            p = 0
            for k in ls[u]:
                wsheet.write(u,p,k)
                p  = 1
                # print(u,p,k)
    except:
        pass

if ._name__ == \'._main__\':    #程序流程运行
    read_excel_file()
    thread(co)
    excel_write(ls)
    # print(ls)
    wk.save(\'ceshi.xls\')
    # nmap_dan_scan(co)
    # print(ls)

#ok，以上便是所有编码了，上边是开进程的，下边加上个单核的方式 吧
#操作方法，把def thread 和 def nmap_ping_scan 注解掉
# 再最终if里把 nmap_dan_scan(co) 注释解掉，上边两个调用注释掉就行。

def nmap_dan_scan(ip_port):    #单核跑跑
    for ip,port in ip_port.items():
        strport = \',\'.join(ports for ports in port)
        try:
            nm = nmap.PortScanner()
            np = nm.scan(hosts=ip,ports=strport,arguments=\"-v -n -T4\")
            for i in np[\'scan\'][ip][\'tcp\'].keys():
                state = np[\'scan\'][ip][\'tcp\'][i][\'state\']
                print(ip,i,state)
        except:
            pass   

扫描仪的結果大约就是这个模样。

#注#假如不希望应用脚本制作那么不便得话，提议应用masscan指令较为简约，这一指令有时候扫描仪会存有起伏，大多数情形下也是很好的；（我是在centos下运转的）

写个平常用的板栗：masscan -p0-65535 -iL ip.txt –rate=2000 > masscan-scan.txt