#!/usr/bin/perl
use IO::Socket;
use Getopt::Std;
use Socket;
use LWP::Simple;
use NetAddr::IP

my($target,$start,$finish,$proto,$port,$sock);

my %default = (
        target          =>      "localhost",
        start           =>      "0",
        finish          =>      "65535",
        proto           =>      "tcp"
);     

getopts('t:s:f:p:h', \my %option);

$option{h} && die << "HELPMSG";
usage: portscanner.pl [-t target] [-s start_port] [-f finish_port]
                      [-p protocol]
defaults: -t $default{target}           -s $default{start}
          -f $default{finish}           -p $default{proto}
HELPMSG

$target = $option{t} || $default{target};
$start =  $option{s} || $default{start};
$finish = $option{f} || $default{finish};
$proto = $option{p} || $default{proto};
       
$ip = NetAddr::IP->new($target);
@server_list = $ip->hostenum;
       
foreach $victim (@server_list)
{      
        $victim =~ s!/\d+!!;
        for($port = $start;$port <= $finish; $port++)
        {
                 $sock = IO::Socket::INET->new(PeerAddr => $victim,
                                               PeerPort => $port,
                                               Proto => $proto
                                        ) or die "wtf: $!\n:;
                $sock->timeout(5);                 
                if ($sock)
                {
                        $portdesc = getservbyport($port, $proto) || "u
+nknown";
                        print "$victim:$port==>\t\t$proto\t\t$portdesc
+\n";
                        if ($port == 80) { www_banner($victim); } 
                        elsif ($port == 79) { finger($victim); }
                        else { banner_grab(); }
                        print "\n";
                }
        }
}        
sub banner_grab {
        $netfd = &makeconn($target, $port);
        sysread $netfd, $message,100;
        close $netfd;
        print "$message\n";
        if ($message =~ /ssh/i) { print "w00p! we got ssh!\n"; }
        elsif ($message =~ /ftp/i) { print "ftp is open\n"; }
        elsif ($message =~ /Sendmail/i) { print "sendmail is running\n
+"; }
}                                                                     
+    

sub makeconn
{           
        my ($host, $portname, $server, $pt,$pts, $proto, $servaddr);
        $host = $_[0];
        $pt = $_[1];
        $server = gethostbyname($host) or die "gethostbyname: cannot l
+ocate host: $!";
        $pts = getservbyport($pt, 'tcp');
        $proto = getprotobyname('tcp') or die " : $!";
        $servaddr = sockaddr_in($pt, $server);
        socket(CONNFD, PF_INET, SOCK_STREAM, $proto);
        connect(CONNFD, $servaddr) ;
        return CONNFD;
}                     

sub www_banner {
        my ($host) = @_;
        my ($content_type, $document_length, $modified_time,$expires,$
+server) = head("http://$host");
        print "HTTP Server:\t$server\n";
}                                       

sub finger {
  my ($target) = @_;
  $remote = IO::Socket::INET -> new(
                Proto => "tcp",
                PeerAddr => $target,
                PeerPort => 79
                );
  print $remote "\n";
  @lines = <$remote>;
  close $remote;
  foreach $line (@lines) { print "$line\n"; }
}
[download]