In this demo, we'll be creating a script capable of finding open ports and hosts,
and for that, we will use a PowerShell feature called TCP‑Connect,
which as the name suggests,
tries to send TCP packets and start a connection to a port.
So if you're ready, let's see how that's done in our lab environment.
Welcome back to our lab environment.
In this demo,
we will be using the TCP‑Connect class to scan an API for open ports.
So,
let's get started by declaring a NewObject from the
class System.Net.Sockets.TcpClient.
And, to make things easier,
I will just attribute this new object to a variable called TcpClient.
Perfect.
Now, let's start with the basics.
Let's say we to test if a port is open in the computer.
For that, I can use the function Connect from the TcpClient.
This function only requires two inputs.
The first one is our target IP,
and the second one is the port that we want to connect to.
Once I execute this, you'll note that it seems that nothing happened,
and that's a good sign.
If no errors are shown, it means that a connection was successful.
So, the port 80 is open on my server.
Just to show you, I will change here the port from 80 to 81,
which is a port that is closed on the server.
Once I run this, it hangs for a little bit,
and then we get this error here, saying that the connection failed.
Interesting, right?
Now, I'll put this command here inside of an echo command.
This means that if the connection is successful,
it will print a message saying that a port is open,
and if the connection fails, it will send an error that we saw before.
Perfect.
Okay, now let's say that I want to scan multiple ports at once.
For example, let's say I want to know all the open ports in this server.
We can use here a trick similar to what we used in the previous demo.
We can put the port range I want to scan in the beginning of this line,
and then use pipe, and the function for each object.
Basically, this will interact through the number 79 to 82,
and execute the port to connect for each of the ports.
And for this to work,
I'll have to replace the port number in the command by the $_ variable,
which is a result from the ForEach.
Also, I'll add the port number to a print message.
Perfect.
So, let's run this now.
Amazing.
It works.
Take a look.
For each port that is open, we see a message board is open,
and for each port that is not open, we see an error.
As we are only interested in knowing which ports are open,
we can actually ignore the errors and only view the open ports.
And to ignore the errors,
I'll forward all the error output to null using this
command in the end of the line.
This will ensure that only successful messages are displayed.
So, let's test this out.
Perfect.
It works.
We only see now the open ports; however,
as you might have noted, our scan is a little bit slow.
If we try to enumerate thousands of ports,
we would have to wait a little bit,
and one way of reducing this time is changing the
connection timeout to a lower value.
And we can do that by setting the TcpClient timeout to 50 or lower.
In this way, if a port is not answering,
you can quickly assume that it's closed.
Perfect.
Also, let me just clean up a little bit of script.
I'll move the $port_range to a variable,
so it is easier to change that if you want.
Then, okay, so far,
we have a basic port scanner that identifies open ports in a single IP,
but what if I want to scan multiple IPs at the same time?
Like, what if I want to find all open ports in the network?
One of the ways of doing that is using another for loop to scan multiple IPs.
Basically, we'll use a for inside of a for.
So, let's see how this looks like.
First, I'll define two variables, which are similar to the previous demo.
The first one is the network that we've scanned,
and the second variable is the $ip_range that were going to scan.
In this case here, I will scan from the IP 192.168.2.10,
all the way to 192.168.2.13.
Perfect.
Now, I have to create my for loop.
In here, I will start by using the forEach command,
and assign each value of the IP range into a variable called host_ip.
Now, we need to modify our connect command so we can scan each IP.
I will create here a temporary variable called $current_ip,
which basically merges the network IP and the current IP of the loop.
Now,
I can replace the hard‑coded IP in the connect command
with the variable that I just created.
And, that's about it; that's all I have to do.
So let me just close the brackets for the for command,
and let me just add one message here so we know which server is being scanned.
Perfect.
Now, let's cross our fingers and test this.
The first IP is being scanned, then the second IP is being scanned,
and it seems that it's working.
Take a look.
We found the port 80 open on the server 192.168.2.11, which is perfect.
It looks like we have a working port scanner.
Now, if you want,
we can just adjust the $port_range and the $ip_range to scan whatever we want.
And also, if you want, we can transform this into a standalone PowerShell script.
For that, I just have to declare the three user inputs using the param function,
and then command to these hard‑coded values.
Then, let me save this on my computer, and I will name this as port‑scanner.ps1.
Perfect.
Now, let's go to the PowerShell terminal and execute it from there.
I'll type the script name,
and then the three variables that we need to provide: ‑ip_network,
‑ip_range, and ‑port_range, and that's it.
Let's execute this.
Amazing!
It works!
As you can see, we found out that the IP 192.168.2.11 has the port 80 open,
and although this scanner might be a little bit slower than Nmap,
it is definitely more stealthy.
You can use this script to perform really specific scans.
For example,
if I want to figure out which servers on the network have SSH enabled,
I can just change this command for only scan the SSH port,
which is 22, and then adjust the IP range to whatever I want.
And when I want to execute this,
I'll get a list of all the servers in the network that have SSH enabled.
Pretty cool, right?
With just a few PowerShell lines,
we're able to create a port scanner that allows you to
discover open ports in your target network.
Perfect.
Now that we know which ports are open on each server,
we can then plan our next attacks.
For example, now that we know that one of the servers has a database server,
we can try to look into the database to find credentials and sensitive data.
And talking about sensitive data,
another really good place to look for sensitive documents is SMB shares.
So, in our next demo, we'll see how to find SMB shares using PowerShell.