Instructor: Welcome back.
We are about to start our first coding project.
Are you ready to create your own first tool for hacking?
We're going to create our tool using Python 3.
And since Python is out of scope for this course,
I won't be explaining Python basics.
However, I will give my best to explain
what we are exactly doing inside of our code
for anyone that hasn't programmed before.
Now I know what you're thinking.
Programming is not needed for hacking.
That is true.
However, learning programming will help you understand
how different tools work in greater details
and it'll also allow you to create and weaponize
your own tools that you can use.
My advice for anyone that is learning ethical hacking
and penetration testing is to,
at some point of your journey, learn a programming language.
Since if you are only using tools that other people create
you're limited to their tools.
Now these programming projects
you can watch as we go through the course
or you can skip it until you finish entire course
and then get back to them.
It is completely up to you.
Nonetheless, let's get straight
into creating our first tool.
Here we are in our Kali Linux.
So how are we going to approach this?
Well, for some of you
that already have programming experience
and already know Python,
feel free to code this program wherever you want.
You can code it on your host machine,
you can code it in your Kali Linux machine,
whatever you feel the best.
You can also use any editor you want
but for you that haven't programmed before
and have no idea what I'm talking about,
what we are going to do is we're going to open our terminal
and inside of our desktop directory
we are going to create a directory called tools.
Now you will notice we got it right here on the screen
and if I change the directory to that directory,
right here we will create our program
and we're going to put our code inside of our nano editor.
Now we are already familiar as to how we can use nano.
So to open a file, we want to type nano
and then the file name.
In our case we are creating a Python program
so it needs to have extension.py.
And since we just finished lab scanning section,
we will be creating a port scanner.
It'll not be an advanced port scanner like Nmap
but we are going to see how we can create a simple one
just so you better understand how scanning of ports work.
So let's type nano and then portscanner.py
and this will automatically open up our file here.
We're going to type in our code.
The reason why we are not using anything else
to type in our code is because nano editor is really simple
and easy to use.
First thing that we're going to do
is we're going to import the libraries
that we are going to need for this project.
The first library is called socket library
and we import them like this.
This import command just loads this library
and we need this library to be able to communicate
with other machines using TCP and UDP protocols.
And another library that we are going to use
is called termcolor library,
and we are only going to need this library
in order to print some statements in different colors.
So nothing else besides that.
Let us create the base of our program.
So the first thing we need to do,
whenever we are creating some type of a connection
over TCP or UDP, we need to initiate a socket object.
And socket objects are also called socket descriptors
and they're used for internet communication.
To initiate a socket object in Python,
we can call the object sock for example
and to initiate it we'll type equals and then socket.socket.
So what we're basically doing right here
is we are calling this library
and calling the socket function from that library.
This will initiate the socket object for us
and it'll be stored right here.
And all we are left to do since Python
is an easy programming language
is we need to connect to our target
and our port.
And for that we're going to use our socket object
and the connect function onto our socket object.
This connect function requires two different parameters
that we specify between two open and two closed brackets
and those parameters are ipaddress
and also port.
But these are something that we have not defined yet.
Our program does not know what an IP address is
or what the port is.
So what I'm going to do
is I will create the function right here
and to initiate the function I just type def
and then the function name.
This function name will be called scanned port
and it will take two parameters
which will be these two parameters.
So let's copy them and let's paste them right here.
These are going to be the two parameters
the double function will take.
And these two lines of code will belong to our function.
In order to make them belong,
you just tab once both of these lines
and they will belong to this scan_port function.
Now that we try to connect,
there is logically one thing that we need to do.
This connect function will either succeed,
so we will manage to connect to a port
or it will not succeed,
we won't be able to connect to that port.
So those are two different options.
Once we manage to connect, that means that the port is open.
And if we don't manage to connect,
that means that the port is closed.
And what we are going to do to figure out
whether a certain port is closed or opened,
we're going to use try and except statement.
And to specify try and except statement,
we can do something like this.
In the first line of our function we type try
and then we tab these two lines
to belong to the try statement,
and down here we also add except.
Make sure to add two dots at the end.
And what this simply means is that inside of our function,
it'll try to initiate the socket object
and then it'll try to connect onto a certain port,
on a certain IP address the approval specify later.
If it manages to do that,
then we can print something like,
print, Port Opened.
We can specify something like this.
If it doesn't manage to connect
then it'll proceed to this except statement
and then we can print, Port Closed.
All right, so simple as that.
Now there are a few things that are wrong
with this function.
First of all, we are just printing Port Opened.
So once we try to connect to a port,
we will not know which port is open, which port is closed
since we didn't specify a number.
To specify exactly which port is open,
what I'm going to do is type Port Opened and then plus
and then I can specify string of port.
And remember port is our parameter for our function
and what this string function does is
it converts the port which is an integer number most likely
to be a string,
so it can print it out using this print statement.
What I'm going to do also is add space right here
so we print this more nicely.
And right here I will add the plus sign
which means that we successfully discovered an open port.
And down here we're going to do the same thing.
So we are going to print minus sign,
which means port is closed
and then we are going to add plus the string of port.
Another thing we will do in case we find out an open port
is we can close this socket object.
Since we successfully completed an action
we found an open port, we can close this socket object.
Okay, so this is our base function.
For now on we're going to leave it like this.
But there are a few more things that we need to specify.
First of all, we want to prompt to the user of this program
what IP address or what target they want to scan.
So outside of this function we can create a variable
called target or targets, whatever you like.
And that variable will be equal to input
and this input function allows the user of the program
once they run the program to input any string
that they want.
And here we will specify to them
that we need a target.
So enter target to scan.
Once they enter a target, we can also ask them for port,
port to scan.
Now trust me, I know what you're thinking right here.
This is too simple.
We're only scanning one port on a target,
so we don't really want to do that.
We want to specify right here ports,
so this will be, enter how many ports
you want to scan,
so they can scan a hundred ports or a thousand ports
or all 65,000 ports if they like.
But how are we going to change that inside of our code?
Well, we are not going to touch this at all.
What we are going to do is we'll create another function
called scan,
but this just start the same.
This one doesn't have the port inside of the name
and this scan function will take two arguments as well
and those arguments are going to be the targets
and the ports.
And all we are going to do right here
is we're going to iterate, so for port in range
from one to ports, for each and every port
we're going to call scan_port function.
And this scan_port function, remember, takes two arguments
and those two arguments are going to be targets and port.
And let me explain this a little bit better.
What these two lines do is this will iterate from one
to any number that they specified right here
inside of this line,
and then it'll call for each and every number
this scan_port function.
So it'll start from one
and then it'll scan port number one using this function,
then it will increase port to be two,
and then it'll call scan_port function once again,
once the port is equal to two,
and it'll do that until it reaches the port's number
that the user of the program specified right here.
But what if our user wants to specify multiple targets?
What then?
They for example don't want to scan only one target,
they want to scan two targets.
That's why what we are going to do
is we're going to change this scan function
and this scan function will take target as an input
and it'll scan the port on target.
But notice this target
is something that we don't really have,
if we call right here scan, target, and then ports,
we have targets but we do not have target
and we are going to change this targets variable
to be enter targets to scan.
And inside of the brackets we'll explain to them,
split them by comma,
so they can specify for example two targets.
They can specify them like this.
They want to scan 192.168.1.1,
comma, 192.168.1.5.
For example, if they specify it like this,
then we have a problem.
We will call this scan function on one target
but we need to split this input so it scans this IP address
and then after it it scans this IP address.
Let's see how we can do that.
For now down here what we are going to do
is we are going to check if there is comma
inside of our targets variable,
if, and to specify that we open single quote,
type comma and close single quote.
If comma is in targets,
this means that they specified multiple targets.
So what we are going to do
is we are going to go down a little bit
and then print and then open double quotes.
We can specify this star sign
just so it looks a little bit better.
Scanning multiple targets.
And let's close the double quotes.
And then right here what we can do
is instead of calling this scan function
outside of the if statement,
we're going to call it inside of the if statement.
And what we are going to do
is we are going to use a for loop
inside of this if statement.
So for IP address
and we are going to call it ip_addr
in targets.split.
And this split function simply splits the input
that the user specified by any sign
that we specify in between these single quotes.
Now since the users of this program
will specify targets with comma,
we also want to split the input with comma.
That way we're going to get with two IP addresses
that don't have this comma in between them.
And for each IP address in this target's variable,
we're going to scan IP address
and let us strip it out of any empty spaces
and we do that by typing strip, open the brackets,
single quote, space, single code
and the second parameter we believe to be ports.
In any other case, in case they specified only one target,
we're going to use else statement.
And in that case we are simply just going to scan
targets and then ports.
So we are just pasting the entire input of this variable
inside of the scan function
and that is because they only inputted one IP address,
because there is no comma inside of this variable.
So let's go to this real fast,
just to figure out everything a little bit better.
Let's go from the beginning of the program
which is down here.
So we ask the user for the targets,
they can specify either one target to scan
or multiple targets to scan separated by comma.
Then they specify the ports that they want to scan,
and by specifying ports I mean the amount of ports
that they want to scan,
so if they type 500 right here,
our program will scan first 500 ports.
Once we take these two variables
and we take the input from the user,
we check whether comma is inside of this target's variable.
If it is, that means multiple targets have been specified.
Then we go for each IP address
inside of this targets variable
and we check out those IP addresses
by splitting the input with comma.
Then we will scan each and every IP address
with the specified amount of ports.
In case they only specified one IP address,
then we scan that one IP address
with the specified amount of ports.
Once we go to the scan function,
this will go for port in range one
to the amount of port specified
and it will perform this scan_port function
for each and every port.
If we manage to connect, we will print port is opened.
If we don't manage to connect, we will print port is closed.
Let's see whether this works.
If I Control + O, then Enter,
and Control + X to exit.
To run this program, I can use python3
and then portscanner.py.
It asks us enter targets to scan, split them by comma.
And what I'm going to do, I'm going to scan my router.
What you can do, you can open
and start your Metasploitable
and I'm going to start it right now as well,
just so we can test later the multiple target scan.
And I'm going to type the IP just on my router
which is this one.
Press Enter, enter how many ports you want to scan.
Let's say I want to scan first 100 ports
and we get our first error.
Now don't worry, errors occur a lot in programming.
Let's see what the error says.
String object cannot be interpreted as integer
and it is inside of this line.
Hmm, let's check it out.
Let's go back to our program using nano,
so nano portscanner.py,
and let's see where the error is.
It seems to be right here.
So we are pasting this ports option as an integer
but we are taking an input as a string.
So what we can do is we can wrap this ports input
inside of the integer function
which will convert this number into an integer.
Let's try and see whether this fixed the problem.
If I type it once again 192.168.1.1
and then ports 100.
Wow.
This finished really fast.
And we can see it scanned 100 ports.
It managed to find these two that are open
and this one as well, let me just find it.
And this one as well.
Now I know what you're thinking.
This is a terrible output.
We can barely see which ones are open
and which ones are closed.
So what we can do to fix this,
we can go back to our program and in the except part
where we print that the port is closed,
we are not going to print anything,
we're just going to pass.
This pass simply means do nothing
and continue with the execution of the program.
Why we do this?
Well, we don't really care which ports are closed.
We only want to print the ports that are open.
So let's see whether this fixed our program.
If I type python3 portscanner
and I run the same IP address, which is my router,
first 100 ports, there it is.
We get a whole lot better output.
We only get ports that are open.
Let's test this program onto different targets.
So I started my Metasploitable
and what I'm going to do is log in.
Check the IP address of Metasploitable
which is 192.168.1.5.
And if I run the program once again
and type 192.168.1.1, which is my router,
and then comma, 192.168.1.5, press Enter,
Enter amount of ports.
Let's say we want to scan 100 ports.
And this will work, but it gives us the wrong output.
We don't know which ports belong to which target.
So let's go back to our program and see how we can fix this.
To fix this, we are going to add a print statement
inside of our scan function.
Right at the beginning we are going to print,
first we are going to start with a new line character
and a new line character is back \n.
Close the single quote, plus
and let's open single quote once again.
Enter space and then type starting scan for,
another space and then single quote, plus,
the string of the target.
And remember, target is our argument to our function
and this target is an actual IP address
that was split right here.
Here we paste this IP address inside of the scan function.
And this ip_addr.strip is the same thing
as this target right here.
So if we print it like this and close two brackets
because we have one bracket opened right here,
let's test it out once again, Control + O to save,
Control + X to exit,
and let me run the program once again.
First 100 ports.
This is a lot better.
We get which ports are open for my router
and we also get which ports are open
for my Metasploitable.
Now with this our program is basically finished.
What you can do to make this better
is you can change the output a little bit.
So right here where you print scanning multiple targets,
we can use the termcolor library that we imported
and from that termcolor library
we can take the colored function.
And this function just changes the color
of our print statement into any color that we want.
So what we need to do is inside of the print statement
type termcolor.colored, open bracket,
type the statement that you want to print,
close one bracket, type comma,
and then open single quote,
and let's say we want to print this in green,
and then I need to close two more brackets,
one for the colored function and one for the print function.
Let's see whether this will work.
Control + O to save once again
and Control + X to exit.
Python3 portscanner.py.
Hmm, unmatched bracket.
So let's check it out.
Yeah, we do got one bracket more.
Let us go back and remove it.
So we got print bracket closed right here
and we got the colored bracket closed right here.
So yeah, this one right here is one too extra.
Let's delete it.
Save it once again.
Run the program.
Type any two targets that you want to scan.
In my case I am using router and Metasploitable,
and I want to scan, let's say this time I want to scan
first 200 ports.
Now it doesn't seem to print it in green for some reason.
Let's see what the problem is.
If I go all the way down to our print statement,
right here it seems that our colored function
only took this as an argument
and we wanted to take this as well.
So what we need to do,
whoops, we first of all need to delete this.
What we need to do is open another bracket right here
and close another bracket right here.
Now this does seem confusing
with all of these brackets being open and closed,
but what we just did is we extracted this statement
to be one function.
So inside of the colored, we open one bracket
for the function itself.
Then we paste two arguments
and we split these arguments like this.
And first argument is this print statement
while the second argument is the color
that we want to print it in.
Hopefully right now this will work.
And if I go and run the program once again
and scan first 200 ports, now it seems to work.
It says scanning multiple targets
and it is printed in green.
As we can see for our Metasploitable
we also found two more additional ports
because we increased the number to 200.
Cool, now you got your first tool ready to use
in your penetration tests.
Now even though this is a simple port scanner,
you can do many things to make it a little bit better.
If you are an experienced programmer,
what you can do, you can try to receive a banner
from these open ports
so you can try to send packets and receive packets
and store the response inside the variable
and then print it out to see what banner
does an open port have.
And banner is just something that an open port might send
as an information as to which software it is running
on that open port.
And from that vendor
we can also extract the version of that software.
But we are not going to be doing that right now
because that would be a little bit too advanced for us.
Right now we are happy with this program.
In the next few videos
we're going to be covering vulnerability analysis.
See you there.