Tcp syn portscan code in C with Linux sockets

Port Scanning searches for open ports on a remote system. The basic logic for a portscanner would be to connect to the port we want to check. If the socket gives a valid connection without any error then the port is open , closed otherwise (or inaccessible, or filtered).

This basic technique is called TCP Connect Port Scanning in which we use something like a loop to connect to ports one by one and check for valid connections on the socket.

But this technique has many drawbacks :

1. It is slow since it establishes a complete 3 way TCP handshake. It waits for the connect() function to return.
2. It is detectable. It leaves more logs on the remote system and on any firewall that is running.

TCP-Syn Port scanning is a technique which intends to cure these two problems. The mechanism behind it is the handshaking which takes place while establishing a connection. It sends syn packets and waits for an syn+ack reply. If such a reply is received then the port is open otherwise keep waiting till timeout and report the port as closed. Quite simple! In the TCP connect technique the connect() function sends a ack after receiving syn+ack and this establishes a complete connection. But in Syn scanning the complete connection is not made.

This results in :
1. Faster scans – Partial TCP handshake is done. Only 2 packets exchanged , syn and syn+ack.
2. Incomplete connections so less detectable. But modern firewalls are smart enough to log all syn activites. So this technique is more or less detectable to same extent as TCP connect port scanning.

TCP Connect Port Scan looks like :

You -> Send Syn packet -> Host:port
Host -> send syn/ack packet -> You
You -> send ack packet -> Host

… and connection is established

TCP-Syn Port scan looks like

You -> send syn packet ->Host:port
Host -> send syn/ack or rst packet or nothing depending on the port status -> You

… stop and analyse the reply the host send :
If syn+ack reply then port open.
Closed/filtered otherwise.

Results are almost as accurate as that of TCP connection and the scan is much faster.

So the process is :

1. Send a Syn packet to a port A
2. Wait for a reply of Syn+Ack till timeout.
3. Syn+Ack reply means the port is open , Rst packet means port is closed , and otherwise it might be inaccessible or in a filtered state.

Tools

We shall code a TCP-Syn Port scanner on Linux using sockets and posix thread api.
The tools we need are :
1. Linux system with gcc and posix libraries installed
2. Wireshark for analysing the packets (Optional : for better understanding).

Program Logic

1. Take a hostname to scan.
2. Start a sniffer thread shall sniff all incoming packets and pick up those which are from hostname and are syn+ack packets.
3. start sending syn packets to ports in a loop. This needs raw sockets
4. If the sniffer thread receives a syn/ack packet from the host then get the source port of the packet and report the packet as open.
5. Keep looping as long as you have nothing else to do.
6. Quit the program if someone is calling you.

Code

1 /*
2     TCP Syn port scanner code in C with Linux Sockets :)
3 */
4  
5 #include<stdio.h> //printf
6 #include<string.h> //memset
7 #include<stdlib.h> //for exit(0);
8 #include<sys/socket.h>
9 #include<errno.h> //For errno - the error number
10 #include<pthread.h>
11 #include<netdb.h> //hostend
12 #include<arpa/inet.h>
13 #include<netinet/tcp.h>   //Provides declarations for tcp header
14 #include<netinet/ip.h>    //Provides declarations for ip header
15  
16 void * receive_ack( void *ptr );
17 void process_packet(unsigned char* , int);
18 unsigned short csum(unsigned short * , int );
19 char * hostname_to_ip(char * );
20 int get_local_ip (char *);
21  
22 struct pseudo_header    //needed for checksum calculation
23 {
24     unsigned int source_address;
25     unsigned int dest_address;
26     unsigned char placeholder;
27     unsigned char protocol;
28     unsigned short tcp_length;
29      
30     struct tcphdr tcp;
31 };
32  
33 struct in_addr dest_ip;
34  
35 int main(int argc, char *argv[])
36 {
37     //Create a raw socket
38     int s = socket (AF_INET, SOCK_RAW , IPPROTO_TCP);
39     if(s < 0)
40     {
41         printf ("Error creating socket. Error number : %d . Error message : %s \n" , errno ,strerror(errno));
42         exit(0);
43     }
44     else
45     {
46         printf("Socket created.\n");
47     }
48          
49     //Datagram to represent the packet
50     char datagram[4096];   
51      
52     //IP header
53     struct iphdr *iph = (struct iphdr *) datagram;
54      
55     //TCP header
56     struct tcphdr *tcph = (struct tcphdr *) (datagram + sizeof (struct ip));
57      
58     struct sockaddr_in  dest;
59     struct pseudo_header psh;
60      
61     char *target = argv[1];
62      
63     if(argc < 2)
64     {
65         printf("Please specify a hostname \n");
66         exit(1);
67     }
68      
69     if( inet_addr( target ) != -1)
70     {
71         dest_ip.s_addr = inet_addr( target );
72     }
73     else
74     {
75         char *ip = hostname_to_ip(target);
76         if(ip != NULL)
77         {
78             printf("%s resolved to %s \n" , target , ip);
79             //Convert domain name to IP
80             dest_ip.s_addr = inet_addr( hostname_to_ip(target) );
81         }
82         else
83         {
84             printf("Unable to resolve hostname : %s" , target);
85             exit(1);
86         }
87     }
88      
89     int source_port = 43591;
90     char source_ip[20];
91     get_local_ip( source_ip );
92      
93     printf("Local source IP is %s \n" , source_ip);
94      
95     memset (datagram, 0, 4096); /* zero out the buffer */
96      
97     //Fill in the IP Header
98     iph->ihl = 5;
99     iph->version = 4;
100     iph->tos = 0;
101     iph->tot_len = sizeof (struct ip) + sizeof (struct tcphdr);
102     iph->id = htons (54321); //Id of this packet
103     iph->frag_off = htons(16384);
104     iph->ttl = 64;
105     iph->protocol = IPPROTO_TCP;
106     iph->check = 0;      //Set to 0 before calculating checksum
107     iph->saddr = inet_addr ( source_ip );    //Spoof the source ip address
108     iph->daddr = dest_ip.s_addr;
109      
110     iph->check = csum ((unsigned short *) datagram, iph->tot_len >> 1);
111      
112     //TCP Header
113     tcph->source = htons ( source_port );
114     tcph->dest = htons (80);
115     tcph->seq = htonl(1105024978);
116     tcph->ack_seq = 0;
117     tcph->doff = sizeof(struct tcphdr) / 4;      //Size of tcp header
118     tcph->fin=0;
119     tcph->syn=1;
120     tcph->rst=0;
121     tcph->psh=0;
122     tcph->ack=0;
123     tcph->urg=0;
124     tcph->window = htons ( 14600 );  // maximum allowed window size
125     tcph->check = 0; //if you set a checksum to zero, your kernel's IP stack should fill in the correct checksum during transmission
126     tcph->urg_ptr = 0;
127      
128     //IP_HDRINCL to tell the kernel that headers are included in the packet
129     int one = 1;
130     const int *val = &one;
131      
132     if (setsockopt (s, IPPROTO_IP, IP_HDRINCL, val, sizeof (one)) < 0)
133     {
134         printf ("Error setting IP_HDRINCL. Error number : %d . Error message : %s \n" , errno, strerror(errno));
135         exit(0);
136     }
137      
138     printf("Starting sniffer thread...\n");
139     char *message1 = "Thread 1";
140     int  iret1;
141     pthread_t sniffer_thread;
142  
143     if( pthread_create( &sniffer_thread , NULL ,  receive_ack , (void*) message1) < 0)
144     {
145         printf ("Could not create sniffer thread. Error number : %d . Error message : %s \n" ,errno , strerror(errno));
146         exit(0);
147     }
148  
149     printf("Starting to send syn packets\n");
150      
151     int port;
152     dest.sin_family = AF_INET;
153     dest.sin_addr.s_addr = dest_ip.s_addr;
154     for(port = 1 ; port < 100 ; port++)
155     {
156         tcph->dest = htons ( port );
157         tcph->check = 0; // if you set a checksum to zero, your kernel's IP stack should fill in the correct checksum during transmission
158          
159         psh.source_address = inet_addr( source_ip );
160         psh.dest_address = dest.sin_addr.s_addr;
161         psh.placeholder = 0;
162         psh.protocol = IPPROTO_TCP;
163         psh.tcp_length = htons( sizeof(struct tcphdr) );
164          
165         memcpy(&psh.tcp , tcph , sizeof (struct tcphdr));
166          
167         tcph->check = csum( (unsigned short*) &psh , sizeof (struct pseudo_header));
168          
169         //Send the packet
170         if ( sendto (s, datagram , sizeof(struct iphdr) + sizeof(struct tcphdr) , 0 , (struct sockaddr *) &dest, sizeof (dest)) < 0)
171         {
172             printf ("Error sending syn packet. Error number : %d . Error message : %s \n" ,errno , strerror(errno));
173             exit(0);
174         }
175     }
176      
177     pthread_join( sniffer_thread , NULL);
178     printf("%d" , iret1);
179      
180     return 0;
181 }
182  
183 /*
184     Method to sniff incoming packets and look for Ack replies
185 */
186 void * receive_ack( void *ptr )
187 {
188     //Start the sniffer thing
189     start_sniffer();
190 }
191  
192 int start_sniffer()
193 {
194     int sock_raw;
195      
196     int saddr_size , data_size;
197     struct sockaddr saddr;
198      
199     unsigned char *buffer = (unsigned char *)malloc(65536); //Its Big!
200      
201     printf("Sniffer initialising...\n");
202     fflush(stdout);
203      
204     //Create a raw socket that shall sniff
205     sock_raw = socket(AF_INET , SOCK_RAW , IPPROTO_TCP);
206      
207     if(sock_raw < 0)
208     {
209         printf("Socket Error\n");
210         fflush(stdout);
211         return 1;
212     }
213      
214     saddr_size = sizeof saddr;
215      
216     while(1)
217     {
218         //Receive a packet
219         data_size = recvfrom(sock_raw , buffer , 65536 , 0 , &saddr , &saddr_size);
220          
221         if(data_size <0 )
222         {
223             printf("Recvfrom error , failed to get packets\n");
224             fflush(stdout);
225             return 1;
226         }
227          
228         //Now process the packet
229         process_packet(buffer , data_size);
230     }
231      
232     close(sock_raw);
233     printf("Sniffer finished.");
234     fflush(stdout);
235     return 0;
236 }
237  
238 void process_packet(unsigned char* buffer, int size)
239 {
240     //Get the IP Header part of this packet
241     struct iphdr *iph = (struct iphdr*)buffer;
242     struct sockaddr_in source,dest;
243     unsigned short iphdrlen;
244      
245     if(iph->protocol == 6)
246     {
247         struct iphdr *iph = (struct iphdr *)buffer;
248         iphdrlen = iph->ihl*4;
249      
250         struct tcphdr *tcph=(struct tcphdr*)(buffer + iphdrlen);
251              
252         memset(&source, 0, sizeof(source));
253         source.sin_addr.s_addr = iph->saddr;
254      
255         memset(&dest, 0, sizeof(dest));
256         dest.sin_addr.s_addr = iph->daddr;
257          
258         if(tcph->syn == 1 && tcph->ack == 1 && source.sin_addr.s_addr == dest_ip.s_addr )
259         {
260             printf("Port %d open \n" , ntohs(tcph->source));
261             fflush(stdout);
262         }
263     }
264 }
265  
266 /*
267  Checksums - IP and TCP
268  */
269 unsigned short csum(unsigned short *ptr,int nbytes)
270 {
271     register long sum;
272     unsigned short oddbyte;
273     register short answer;
274  
275     sum=0;
276     while(nbytes>1) {
277         sum+=*ptr++;
278         nbytes-=2;
279     }
280     if(nbytes==1) {
281         oddbyte=0;
282         *((u_char*)&oddbyte)=*(u_char*)ptr;
283         sum+=oddbyte;
284     }
285  
286     sum = (sum>>16)+(sum & 0xffff);
287     sum = sum + (sum>>16);
288     answer=(short)~sum;
289      
290     return(answer);
291 }
292  
293 /*
294     Get ip from domain name
295  */
296 char* hostname_to_ip(char * hostname)
297 {
298     struct hostent *he;
299     struct in_addr **addr_list;
300     int i;
301          
302     if ( (he = gethostbyname( hostname ) ) == NULL)
303     {
304         // get the host info
305         herror("gethostbyname");
306         return NULL;
307     }
308  
309     addr_list = (struct in_addr **) he->h_addr_list;
310      
311     for(i = 0; addr_list[i] != NULL; i++)
312     {
313         //Return the first one;
314         return inet_ntoa(*addr_list[i]) ;
315     }
316      
317     return NULL;
318 }
319  
320 /*
321  Get source IP of system , like 192.168.0.6 or 192.168.1.2
322  */
323  
324 int get_local_ip ( char * buffer)
325 {
326     int sock = socket ( AF_INET, SOCK_DGRAM, 0);
327  
328     const char* kGoogleDnsIp = "8.8.8.8";
329     int dns_port = 53;
330  
331     struct sockaddr_in serv;
332  
333     memset( &serv, 0, sizeof(serv) );
334     serv.sin_family = AF_INET;
335     serv.sin_addr.s_addr = inet_addr(kGoogleDnsIp);
336     serv.sin_port = htons( dns_port );
337  
338     int err = connect( sock , (const struct sockaddr*) &serv , sizeof(serv) );
339  
340     struct sockaddr_in name;
341     socklen_t namelen = sizeof(name);
342     err = getsockname(sock, (struct sockaddr*) &name, &namelen);
343  
344     const char *p = inet_ntop(AF_INET, &name.sin_addr, buffer, 100);
345  
346     close(sock);
347 }

Compile and Run

1 $ gcc syn_portscan.c -lpthread -o syn_portscan

-lpthread option is needed to link the posix thread libraries.

Now Run

1 $ sudo ./syn_portscan www.google.com
2 Socket created.
3 www.google.com resolved to 74.125.235.16
4 Local source IP is 192.168.0.6
5 Starting sniffer thread...
6 Starting to send syn packets
7 Sniffer initialising...
8 Port 53 open
9 Port 80 open

Note :

1. For the program to run correctly the local ip and the hostname ip should be resolved correctly. Wireshark should also show the TCP Syn packets as “Good” and not bogus or something.

2. The get_local_ip method is used to find the local ip of the machine which is filled in the source ip of packets. For example : 192.168.1.2 if you are on a LAN or 172.x.x.x if you are directly connected to internet. The local source ip value will show this.

3. The hostname_to_ip function resolves a domain name to its ip address. It uses the gethostbyname method.

时间： 2024-07-28 21:10:21

Tcp syn portscan code in C with Linux sockets的相关文章

Packet Sniffer Code in C using Linux Sockets (BSD) – Part 2

In the previous part we made a simple sniffer which created a raw socket and started receiving on it. But it had few drawbacks : 1. Could sniff only incoming data. 2. Could sniff only TCP or UDP or ICMP or any one protocol packets at a time. 3. Provi

C Packet Sniffer Code with Libpcap and Linux Sockets (BSD)

Libpcap is a packet capture library which can be used to sniff packets or network traffic over a network interface. Pcap Documentation gives a description of the methods and data structures available in the libpcap library. To install libpcap on your

Whois client code in C with Linux sockets

A whois client is a program that will simply fetch the whois information for a domain/ip address from the whois servers. The code over here works according to the algorithm discussed here. Code 1 /* 2  * @brief 3  * Whois client program 4  * 5  * @de

Linux有问必答：如何使用tcpdump来捕获TCP SYN，ACK和FIN包

Linux有问必答:如何使用tcpdump来捕获TCP SYN,ACK和FIN包 问题:我想要监控TCP连接活动(如,建立连接的三次握手,以及断开连接的四次握手).要完成此事,我只需要捕获TCP控制包,如SYN,ACK或FIN标记相关的包.我怎样使用tcpdump来仅仅捕获TCP SYN,ACK和/或FYN包? 作为业界标准的捕获工具,tcpdump提供了强大而又灵活的包过滤功能.作为tcpdump基础的libpcap包捕获引擎支持标准的包过滤规则,如基于5重包头的过滤(如基于源/目的IP地址/

扯谈网络编程之Tcp SYN flood洪水攻击

简介 TCP协议要经过三次握手才能建立连接: (from wiki) 于是出现了对于握手过程进行的攻击.攻击者发送大量的SYN包,服务器回应(SYN+ACK)包,但是攻击者不回应ACK包,这样的话,服务器不知道(SYN+ACK)是否发送成功,默认情况下会重试5次(tcp_syn_retries).这样的话,对于服务器的内存,带宽都有很大的消耗.攻击者如果处于公网,可以伪造IP的话,对于服务器就很难根据IP来判断攻击者,给防护带来很大的困难. 攻与防 攻击者角度 从攻击者的角度来看,有两个地方可以

linux kernel-为什么tcp/ip协议被写在了Linux内核里面，或者说有什么好处

问题描述 为什么tcp/ip协议被写在了Linux内核里面,或者说有什么好处 为什么tcp/ip协议被写在了Linux内核里面,或者说有什么好处,求高手专业性 的解答,谢谢 解决方案 因为Windows对微内核原理的应用(虽然Windows是混合内核),NT内核中的网络架构遵循NDIS三层驱动模型,最底层的NDIS小端口驱动一般是网卡驱动,中间有NDIS中间层驱动(过滤.防火墙),上面是NDIS协议驱动,比如TCP/IP,负责为应用程序提供socket支持和处理非链路层网络包.Windows允许

《Nmap渗透测试指南》—第2章2.5节TCP SYN Ping扫描

2.5 TCP SYN Ping扫描表2.4所示为本章节所需Nmap命令表,表中加粗命令为本小节所需命令--TCP SYN Ping扫描. TCP协议是TCP/IP协议族中的面向连接的.可靠的传输层协议,允许发送和接收字节流形式的数据.为了使服务器和客户端以不同的速度产生和消费数据,TCP提供了发送和接收两个缓冲区.TCP提供全双工服务,数据同时能双向流动.通信的每一方都有发送和接收两个缓冲区,可以双向发送数据.TCP在报文中加上一个递进的确认序列号来告诉发送者,接收者期望收到的下一个字节,如果

TCP SYN Connect

问题描述 TCP连接中,有的时候,会出现connect一次,发送多次的SYN信息,并且每一个SYN信息的Sourceport都是前一次加1,最后导致不能成功的建立连接,这是怎么回事啊,咋解决啊? 解决方案 解决方案二:在问题中附上错误提示是基本常识!每次port+1,有可能产生的BUG是端口冲突.举个例子,如果你使用了80端口,而你链接的端口又增长到了80,那就出现错误.解决方案三:该回复于2011-11-24 09:46:08被版主删除

Get ip address from hostname in C using Linux sockets

Here are 2 methods to get the ip address of a hostname : The first method uses the traditional gethostbyname function to retrieve information about a hostname/domain name.Code 1 #include<stdio.h> //printf 2 #include<string.h> //memset 3 #inclu