CLI Port Sniffer

[John]

Using fsockopen(), one of PHP's network functions, you have the ability to connect to a remove (or local) server. We will use this function to create a port sniffer, which will enable you to see what ports are open on any server.

Simply enough, to connect to a server, on port 80, you will use the following code:

$fp = fsockopen("www.example.com", 80, $errno, $errstr, 30); 

The first argument is the hostnam,e which can be a domain name or an ip address. The section argument is the port which we are connecting to. $errno holds the system level error number and $errstr is the error message (if an error occurred). The last argument is the connection timeout in seconds. To create the most simple port sniffer, we can just place the socket connection within a loop:

<?php
for($i = 1; $i < 1000; $i++) {
    $fp = @fsockopen("www.example.com", $i, $errno, $errstr, 1);
    if ($fp) {
        echo "The port $i is open.\n";
        fclose($fp);
    }
}
?>

This of course only checks the first 999 ports, and will fail if a connection was not established within one second. This can be ran via the command line, or in the browser. However, if it is ran in the browser, the script will need to finish executing prior to you seeing the results.

We can make this script more command line friendly by either allowing arguments to be passed in, or prompting the user for the required values. We will first start with arguments.

PHP defines the variable $_SERVER['argv'] for this reason. This variable is an array, so each argument (which are separated by a space) will be contained in the array. In relation to this variable, $_SERVER['argc'] returns the number of arguments supplied (which can be used for error checking). The script itself is considered an argument, so $_SERVER['argc'] will always be greater than or equal to one. In our script, three settings can varied, the minimum port number, the maximum port number, and the hostname. We will use these as arguments.

<?php
for($i = $_SERVER['argv'][2]; $i < $_SERVER['argv'][3]; $i++) {
    $fp = @fsockopen($_SERVER['argv'][1], $i, $errno, $errstr, 1);
    if ($fp) {
        echo "The port $i is open.\n";
        fclose($fp);
    }
}
?>

To make the script a little better, we will implement some error prevention.

<?php
$min = empty($_SERVER['argv'][2]) ? 1 : $_SERVER['argv'][2];
$max = empty($_SERVER['argv'][3]) ? 1000 : $_SERVER['argv'][3];
$host = empty($_SERVER['argv'][1]) ? die("No host provided\n") 
                                   : $_SERVER['argv'];

for($i = $min; $i < $max; $i++) {
    $fp = @fsockopen($host, $i, $errno, $errstr, 1);
    if ($fp) {
        echo "The port $i is open.\n";
        fclose($fp);
    }
}
?>

Now by simply running this command

john@earth:~$ php sniffer.php example.com 1 100

You will sniff the ports between 1 and 100 on example.com.

Lastly we can prompt users for values rather than requiring them to supply them as arguments. To do this, we use the constant STDIN. Most of the time it is defined, however, in the event it is not already defined, we will emulate it using fopen which can be seen in the first three lines of the code below. To grab content from the command line, we use fread.

<?php
if(!defined("STDIN")) {
    define("STDIN", fopen('php://stdin','r'));
}

echo "Host Name: ";
$host = fread(STDIN, 80);
echo "Min: ";
$min = fread(STDIN, 80);
echo "Max: ";
$max = fread(STDIN, 80);

This code will prompt the user for the three necessary values. However, they are all strings. Since the ports need to be integers, we can simply cast them. Moreover, the strings main contain extra garbage (line feeds) so we need to trim() $host. Finally we are left with the following code:

<?php
if(!defined("STDIN")) {
    define("STDIN", fopen('php://stdin','r'));
}

echo "Host Name: ";
$host = fread(STDIN, 80);
echo "Min: ";
$min = fread(STDIN, 80);
echo "Max: ";
$max = fread(STDIN, 80);
$host = trim($host);

for($i = (int)$min; $i < (int)$max; $i++) {
    $fp = @fsockopen($host, $i, $errno, $errstr, 1);
    if ($fp) {
        echo "The port $i is open.\n";
        fclose($fp);
    }
}
?>

Running this script produces the following output:

john@earth:~$ php sniffer.php
Host Name: localhost
Min: 1
Max: 100
The port 23 is open.
The port 80 is open.

[Jordan]

Very nice tutorial! Were you able to figure out how to use sockets with GTK yet?

[John]

No, my LAMP is screwd up. I do intend on fixing it tonight, and playing with some sockets though.

[Jordan]

I haven't started reading the PHP-GTK+ (Pro) book I bought but once I do we should start a project together. I'm not sure what anyone would actually use since you need PHP and GTK installed before you can use it but it would be fun.

[adserverexpert]

its very good tutorial for to use sockets.

[John]

its very good tutorial for to use sockets.

Thank you. If you have any questions regarding the code, feel free to ask.