Scanner de redes

Hace un tiempo tenía ganas de escribir un scriptcito que me automatice el escaneo de la intranet de la empresa, y con la necesidad de descubrir los IPs de ciertos dispositivos, me puse a escribir el demorado script.

El script no es para nada complejo, simplemente utiliza los fingerprint devueltos por un escaneo de nmap para diferenciar los distintos dispositivos. Lo que hace básicamente es escanear las IPs entre dos valores pasados por parámetro, y por cada IP decide si se trata de un web server, un database server, un switch, un router, un firewall, un mail server, una impresora, y los clasifica guardando las IPs con los ports en archivos separados.
Existe un programa llamado autoscan que es mucho más completo y utiliza interfaz gráfica, pero a mi nunca me anduvo, me satura la red y el programa colapsa sin dejarme guardar los resultados. Por eso cree este script que hace todo lo q necesito.

La licencia del script es GPLv2.
El gran mérito se lo lleva el nmap que es el que realiza el verdadero trabajo, sin dudas el programa más útil que he encontrado para mi trabajo.

Espero que les sea de utilidad y que si hacen alguna derivación lo comenten en el blog, tal vez me sea de utilidad a mi también =)

Los comentarios están en inglés porque me acostumbré a programar así, con comentarios en inglés, éste le puede servir a mucha más gente.

#!/bin/bash

######################################################
# Created by: d3m4s1@d0v1v0
# Date: 2009-11-04
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License v2 as published by
# the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

######################################################

if [ $# -lt 2 ]
then
 echo "usage: $0  "
 exit -1
fi

INI_IP=$1  # from which IP do you want to scan? // take into account the "this network" direction (e.g. 192.168.0.0)
FINAL_IP=$2  # until which IP do you want to scan? // take into account the broadcast direction! (e.g. 192.168.0.255)

time=$( date +"%m-%d-%y %H:%M" )

echo "Starting dv-scan-network 0.1.1beta at $time..."

IP=(${INI_IP//./ })
IP_FIN=(${FINAL_IP//./ })

timestamp=$( date +"%s" )

mkdir report-$timestamp &> /dev/null
cd report-$timestamp

webservers=0
printers=0
switchs=0
routers=0
remote_access=0
dbservers=0
mailservers=0
firewalls=0
hosts=0
down=0

for (( A=${IP[0]}; A<=${IP_FIN[0]}; A++ )) do   for (( B=${IP[1]}; B<=${IP_FIN[1]}; B++ ))   do     for (( C=${IP[2]}; C<=${IP_FIN[2]}; C++ ))     do       for (( D=( ${IP[3]} ); D<=${IP_FIN[3]}; D++ ))       do  scanIP="$A.$B.$C.$D"    echo -n "scanning $scanIP..."   hostscan=$( nmap -sV $scanIP -O )  if [ $? == 0 ]  then    echo " [done]"  else    echo " [failed]"  fi    if [[ "$hostscan" =~ "Host seems down" ]]  then    echo "$scanIP" >> down.txt
  let down++
 
else
  if [[ "$hostscan" =~ switch ]]
  then
    printf "%s $hostscan" >> switchs.txt
    echo "" >> switchs.txt
    echo "--------------" >> switchs.txt
    echo $scanIP >> switchs-ip.txt
    let switchs++
  fi
 
  if [[ "$hostscan" =~ router ]]
  then
    printf "%s $hostscan" >> routers.txt
    echo "" >> routers.txt
    echo "--------------" >> routers.txt
    echo $scanIP >> routers-ip.txt
    let routers++
  fi
 
  if [[ "$hostscan" =~ printer ]]
  then
    printf "%s $hostscan" >> printers.txt
    echo "" >> printers.txt
    echo "--------------" >> printers.txt
    echo $scanIP >> printers-ip.txt
    let printers++
  fi
 
  if [[ "$hostscan" =~ Apache ]] || [[ "$hostscan" =~ IIS ]]
  then
    printf "%s $hostscan" >> web-servers.txt
    echo "" >> web-servers.txt
    echo "--------------" >> web-servers.txt
    echo $scanIP >> web-servers-ip.txt
    let webservers++
  fi
 
  if [[ "$hostscan" =~ smtp ]] || [[ "$hostscan" =~ pop3 ]] || [[ "$hostscan" =~ imap ]]
  then
    printf "%s $hostscan" >> mail-servers.txt
    echo "" >> mail-servers.txt
    echo "--------------" >> mail-servers.txt
    echo $scanIP >> mail-servers-ip.txt
    let mailservers++
  fi
 
  if [[ "$hostscan" =~ oracle ]] || [[ "$hostscan" =~ mysql ]] || [[ "$hostscan" =~ ms-sql ]] || [[ "$hostscan" =~ 3051 ]]
  then
    printf "%s $hostscan" >> db-servers.txt
    echo "" >> db-servers.txt
    echo "--------------" >> db-servers.txt
    echo $scanIP >> db-servers-ip.txt
    let dbservers++
  fi
 
  if [[ "$hostscan" =~ ssh ]] || [[ "$hostscan" =~ microsoft-rdp ]] || [[ "$hostscan" =~ vnc ]] || [[ "$hostscan" =~ telnet ]]
  then
    printf "%s $hostscan" >> remote-access.txt
    echo "" >> remote-access.txt
    echo "--------------" >> remote-access.txt
    echo $scanIP >> remote-access-ip.txt
    let remote_access++
  fi
 
  if [[ "$hostscan" =~ firewall ]]
  then
    printf "%s $hostscan" >> firewalls.txt
    echo "" >> firewalls.txt
    echo "--------------" >> firewalls.txt
    echo $scanIP >> firewalls-ip.txt
    let firewalls++
  fi
 
  printf "%s $hostscan" >> scan.txt
  echo "" >> scan.txt
  echo "--------------" >> scan.txt
  echo $scanIP >> hosts-ip.txt
  let hosts++
 
  sleep 10
fi
     done
   done
 done
done

endtimestamp=$( date +"%s" )
scantime=$(( endtimestamp - timestamp ))
echo $scantime

endtime=$( date +"%m-%d-%y %H:%M" )

hours=$((scantime / 3600))
seconds=$((scantime % 3600))
minutes=$((scantime / 60))
seconds=$((scantime % 60))

echo ""
echo "scan ended at $endtime in $hours:$minutes:$seconds"
echo "dv-scan-network resume:"
echo "scanned hosts = "$hosts
echo "hosts that seems down = "$down
echo "web servers found = "$webservers
echo "mail servers found = "$mailservers
echo "database servers found = "$dbservers
echo "switchs found = "$switchs
echo "routers found = "$routers
echo "remote access found = "$remote_access
echo "printers found = "$printers
echo "firewalls found = "$firewalls
echo ""
echo "for more information about the hosts, read the report at the report-timestamp/ directory"