共计 3542 个字符,预计需要花费 9 分钟才能阅读完成。
导读 | Evilscan 是一个网络扫描器,它运行在 NodeJS 环境中。有许多种选项,允许用户扫描单个 IP 地址或一个范围的 IP。它还允许用户选择扫描单个端口或一组端口。 |
环境
Centos8
npm(Node 包管理器)
安装
从 github 中克隆该仓库,如果系统没有安装 git 和 npm 需要提前安装:
[root@localhost ~]# yum -y install git npm
[root@localhost ~]# git clone https://github.com/eviltik/evilscan.git
Cloning into 'evilscan'...
remote: Enumerating objects: 901, done.
remote: Counting objects: 100% (178/178), done.
remote: Compressing objects: 100% (124/124), done.
remote: Total 901 (delta 88), reused 114 (delta 46), pack-reused 723
Receiving objects: 100% (901/901), 12.97 MiB | 5.66 MiB/s, done.
Resolving deltas: 100% (545/545), done.
进入 evilscan
工作目录并安装:
[root@localhost ~]# cd evilscan/
[root@localhost evilscan]# npm install -g evilscan
/usr/local/bin/evilscan -> /usr/local/lib/node_modules/evilscan/bin/evilscan.js
+ evilscan@1.8.0
added 4 packages from 4 contributors in 6.476s
使用方式
使用下面命令可以查看 evilscan 的帮助信息:
[root@localhost ~]# evilscan --help
Usage: evilscan [options]
Example: evilscan --target=192.168.0.0/24 --port=21-23,80
Options:
--port port(s) you want to scan, examples:
--port=80
--port=21,22
--port=21,22,23,5900-5900
--reverse display DNS reverse lookup
--reversevalid only display results having a valid reverse dns, except if
ports specified
--geo display geoip (free maxmind)
--banner display grabbed banner when available
--bannerraw display raw banner (as a JSON Buffer)
--bannerlen grabbed banner length in bytes
default 512
--progress display progress indicator each seconds
--status ports status wanted in results (example --status=OT)
T(timeout)
R(refused)
O(open, default)
U(unreachable)
--scan scan method
tcpconnect (full connect, default)
tcpsyn (half opened, not yet implemented)
udp (not yet implemented)
--concurrency max number of simultaneous socket opened
default 500
--timeout maximum number of milliseconds before closing the connection
default 2000
--hugescan allow number of ip/port combinaison greater than 16580355
(i.e a /24 network with port range 0-65535)
--display display result format (json,xml,console)
default console
--outfile dump result in a file
--json shortcut for --display=json
--xml shortcut for --display=xml
--console shortcut for --display=console
--help display help
--about display about
--version display version number
使用实例
语法:
evilscan [options]
扫描网络中的一台主机上的 0 -4000 端口,抓取 banner 并仅显示 open 的端口:
[root@localhost ~]# evilscan 192.168.0.10 --port=0-4000 --banner
192.168.0.10|139||open
192.168.0.10|135||open
192.168.0.10|110||open
192.168.0.10|25||open
192.168.0.10|445||open
192.168.0.10|2381||open
192.168.0.10|2301||open
192.168.0.10|3389||open
扫描网络中的一台主机上的 0 -100 端口,抓取 banner,仅显示打开的端口,使用 json 格式输出,每秒显示进度状态:
[root@localhost ~]# evilscan 192.168.0.13 --port=0-100 --banner --isopen --istimeout --progress --json
{"_timeStart":"N/A","_timeElapsed":"N/A","_jobsTotal":100,"_jobsRunning":0,"_jobsDone":0,"_progress":0,"_concurrency":500,"_status":"Starting","_message":"Starting"}
{"_timeStart":1628685339594,"_timeElapsed":999,"_jobsTotal":100,"_jobsRunning":100,"_jobsDone":0,"_progress":0,"_concurrency":500,"_status":"Running","_message":"Scanning 192.168.0.13:100"}
{"_timeStart":1628685339594,"_timeElapsed":2003,"_jobsTotal":100,"_jobsRunning":100,"_jobsDone":0,"_progress":0,"_concurrency":500,"_status":"Running","_message":"Scanning 192.168.0.13:100"}
{"ip":"192.168.0.13","port":25,"status":"open"}
{"ip":"192.168.0.13","port":22,"banner":"SSH-2.0-OpenSSH_7.9-hpn14v15\\r\\n","status":"open"}
{"ip":"192.168.0.13","port":80,"status":"open"}
{"_timeStart":1628685339594,"_timeElapsed":2019,"_jobsTotal":100,"_jobsRunning":0,"_jobsDone":100,"_progress":100,"_concurrency":500,"_status":"Finished","_message":"Scanned 192.168.0.13:80"}
提示:并发数默认为100
。如果想扫描大量的 ip/ 端口范围,可以使用 --concurrency
选项(例如 1000)。
如果要突破 1024
个打开套接字的限制,使用下面命令更新限制参数:
ulimit -u unlimited
总结
Evilscan 是一个网络扫描器,它运行在 NodeJS 环境中。有许多种选项,允许用户扫描单个 IP 地址或一个范围的 IP。它还允许用户选择扫描单个端口或一组端口。
正文完
星哥说事-微信公众号
![post-qrcode](https://www.xgss.net/wp-content/uploads/2023/07/二维码-微信公众号256x256.jpg)