How to create a TCP port scanner using the SYN (TCP SYN) method?

Question

#####################################
# Portscan TCP         #
# #
#####################################
# -*- coding: utf-8 -*-
#!/usr/bin/python3
import socket

ip = input("Digite o IP ou endereco: ")

ports = []
count = 0

while count < 10:
    ports.append(int(input("Digite a porta: ")))
    count += 1


for port in ports:
    client = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    client.settimeout(0.05)
    code = client.connect_ex((ip, port)) #conecta e traz a msg de erro
#Like connect(address), but return an error indicator instead of raising an exception for errors
    if code == 0: #0 = Success
        print (str(port) + " -> Porta aberta")
    else:
        print (str(port) + " -> Porta fechada")

print ("Scan Finalizado")

The code above is a TCP Scanning. How can I turn it into a TCP SYN Scanning?

Answer 1

Paul, a TCP SYN (Synchronize) package needs a process called a three-part handshake (Handshaking). They are they:

1) Sending an initial package (SYN) from the client to the server

2) Sending a synchronization recognition package from the server to the client (SYN-ACK - Synchronize Acknowledge)

3) The end of the three-part handshake sent by the client to the server or acknowledgement message (ACK - Acknowledge).

As the TCP protocol has several sub-protocols as for example HTTP this handshake varies a lot and to implement this it is necessary not only programming knowledge, but knowledge of the protocol to which the handshake is being made.

So I suggest you study more about exchanging SYN packets and the protocols you want to sync (or establish connection - or check ports).

Edited: As promised follows an example of communication with authentication in 3 parts implementing only the idea, but no specific protocol.

With regard to the protocol, I shall abstain from the example because there are many possibilities and probably no example will serve the author of the question, as he has not specified any.

Follow server and client code. To test run on the same machine first the server and soon after a client instance.

Server Code: #! /usr/bin/python

import socket
import thread

class ServidorTcp:

    def __init__(self, host, porta):
        self.TAMANHO_BUFFER = 1024
        self.socket_servidor = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.socket_servidor.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        self.socket_servidor.bind((host, porta))

    def escutar(self):
        self.socket_servidor.listen(5)
        print("Aguardando conexoes")

        while 1:
            (cliente, endereco) = self.socket_servidor.accept()
            print("Cliente conectado: " + endereco[0])

            thread_cliente = thread.start_new_thread(self.sincronizar, (cliente, endereco))

    def sincronizar(self, cliente, endereco):
        retorno = cliente.recv(self.TAMANHO_BUFFER)

        if(retorno == "SYN"):
            cliente.send("SYN-ACK")

            retorno = cliente.recv(self.TAMANHO_BUFFER)

            if(retorno == "ACK"):
                print("Sincronizado com o cliente remoto.")

        cliente.close()

#executar o server.
servidor = ServidorTcp('localhost', 7171)
servidor.escutar()

Client code:

    #!/usr/bin/python

import socket

class ClienteTcp:

    def __init__(self):
        self.TAMANHO_BUFFER = 1024
        self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    def conectar(self, host, porta):
        print("Conectando a " + host + ":" + str(porta) + "...")
        self.socket.connect((host, porta))

    def sincronizar(self):
        self.socket.send("SYN")
        retorno = self.socket.recv(self.TAMANHO_BUFFER)

        autenticado = False

        if retorno == "SYN-ACK":
            self.socket.send("ACK")

            #Conexao efetuada com sucesso.
            autenticado = True

        return autenticado

    def enviar(self, mensagem):
        self.socket.send(mensagem)

    def fechar(self):
        self.socket.close()

#executar o cliente.
cliente = ClienteTcp()
cliente.conectar('localhost', 7171)

if cliente.sincronizar():
    #Agora sei com quem estou me comunicando e a conversa pode iniciar entre as pontas.
    print("Sincronizado com o servidor remoto.")
else:
    print("Nao foi possivel estabelecer o sincronismo com o servidor remoto.")

I hope my answer was helpful.