#!/bin/bash help() { cat </dev/null 2>&1; echo $?) [[ $ret == 0 ]] && { echo $c >> /tmp/tcp_ports; cg_color olbg "$c "; } } fast_ping(){ [[ $FORCE == true ]] && { echo $ip >> /tmp/ips; return; } nn=$(ping -n -w2 -c1 $ip >/dev/null 2>&1; echo $?) [[ $nn == 0 ]] && { echo $ip >> /tmp/ips; } } scan_tcp(){ [[ $1 ]] && { c=$1; ret=$(nc -w1 -z $ip $c 2>/dev/null; echo $?); [[ $ret == 0 ]] && { echo $c >> /tmp/tcp_ports; [[ $RUN_NMAP == true ]] && { command="nmap -Pn -n -sCV -p $(allports=($(&1 -vv | grep -i "open" | cut -d " " -f3 | tr "\n" " "); do keyports[$port]=$((${keyports[$port]}+1)); done; done out=$(for port in ${!keyports[@]}; do [[ ${keyports[$port]} -ne 0 ]] && echo -n "${port}(${keyports[$port]}) "; done) ir "Subnet" "Number of Hosts" "Open Ports" "${bytes[0]}.${bytes[1]}.${bytes[2]}.1/24" "${#live[@]}" "$out" for port in ${!keyports[@]}; do keyports[$port]=0; done [[ ${#live[@]} -eq 0 ]] && { UP='\033[1A'; printf "$UP"; } [[ -f /tmp/ips ]] && rm -rf /tmp/ips fi [[ $swing -eq 0 ]] && swing+=1 } cidr_to_ips() { # create array containing network address and subnet local network=(${1//\// }) # split network address by dot local iparr=(${network[0]//./ }) # if no mask given it's the same as /32 local mask=32 [[ $((${#network[@]})) -gt 1 ]] && mask=${network[1]} # convert dot-notation subnet mask or convert CIDR to an array like (255 255 255 0) local maskarr if [[ ${mask} =~ '.' ]]; then # already mask format like 255.255.255.0 maskarr=(${mask//./ }) else # assume CIDR like /24, convert to mask if [[ $((mask)) -lt 8 ]]; then maskarr=($((256-2**(8-mask))) 0 0 0) elif [[ $((mask)) -lt 16 ]]; then maskarr=(255 $((256-2**(16-mask))) 0 0) elif [[ $((mask)) -lt 24 ]]; then maskarr=(255 255 $((256-2**(24-mask))) 0) elif [[ $((mask)) -lt 32 ]]; then maskarr=(255 255 255 $((256-2**(32-mask)))) elif [[ ${mask} == 32 ]]; then maskarr=(255 255 255 255) fi fi # correct wrong subnet masks (e.g. 240.192.255.0 to 255.255.255.0) [[ ${maskarr[2]} == 255 ]] && maskarr[1]=255 [[ ${maskarr[1]} == 255 ]] && maskarr[0]=255 # total live_count["total"]=0 keyports=([21]=0 [22]=0 [80]=0 [88]=0 [135]=0 [443]=0 [445]=0 [554]=0 [1433]=0 [1521]=0 [2049]=0 [2375]=0 [3000]=0 [3306]=0 [4786]=0 [5000]=0 [5432]=0 [5984]=0 [6379]=0 [8000]=0 [8009]=0 [8080]=0 [8443]=0 [9100]=0 [9200]=0 [15672]=0 [27017]=0) # generate list of ip addresses local swing=0 local bytes=(0 0 0 0) for i in $(seq 0 $((255-maskarr[0]))); do bytes[0]="$(( i+(iparr[0] & maskarr[0]) ))" for j in $(seq 0 $((255-maskarr[1]))); do bytes[1]="$(( j+(iparr[1] & maskarr[1]) ))" for k in $(seq 0 $((255-maskarr[2]))); do bytes[2]="$(( k+(iparr[2] & maskarr[2]) ))" for l in $(seq 1 $((255-maskarr[3]))); do bytes[3]="$(( l+(iparr[3] & maskarr[3]) ))" ip=(`printf "%d.%d.%d.%d\n" "${bytes[@]}"`) fast_ping & [[ ! $mask == 24 ]] && [[ $HOST_SCAN == true ]] && ms done done done done # wait wait # read [[ ! $mask == 24 ]] && [[ $HOST_SCAN == true ]] && { for ((c=0; c<45; c++)); do echo -n "-"; done; echo; } [[ ! $mask == 24 ]] && { [[ ${live_count["total"]} == 0 ]] && { for i in {1..4}; do UP='\033[1A'; printf "$UP"; done; cg_color bby "Either dead hosts in this subnet or ping is disabled :("; exit; } || { [[ $HOST_SCAN == true ]] && exit || { ips=($(sort -t. -n -k1,1 -k2,2 -k3,3 -k4,4 /tmp/ips)); return; }; }; } [[ -f /tmp/ips ]] && ips=($(sort -t. -n -k +4 /tmp/ips)) || { cg_color bby "Either dead hosts in this subnet or ping is disabled :("; exit; } [[ $HOST_SCAN == true ]] && { out=${ips[*]}; l="\n"; echo -n "Number of live hosts: "; cg_color bbb ${#ips[@]}; echo -e "\e[1;92m${out//${IFS:0:1}/$l}\e[0m"; exit; } || return } # Syntax [[ $# < 1 ]] && help # use args RUN_NMAP=false HOST_SCAN=false PRINT_OPEN=false FORCE=false while [ "$1" != "" ]; do case $1 in -p | --port) shift if [[ $1 =~ ^[0-9]+$ && $1 -le 65535 ]]; then port=$1 else help exit fi ;; --nmap) RUN_NMAP=true ;; --open) PRINT_OPEN=true ;; --hosts) HOST_SCAN=true ;; --force) FORCE=true ;; *) if [[ $1 =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then ip=$1 elif [[ $1 =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/[0-9]+$ ]]; then cidr=$1 else help exit fi ;; esac shift done [[ ! ($ip||$cidr) ]] && help # Clean up cl # Scan TCP ports if [[ $ip ]]; then echo "--> Scanning $ip" if [[ $port ]]; then scan_tcp $port; pt /tmp/tcp_ports tcp else pp "TCP ports"; scan_tcp; pt /tmp/tcp_ports tcp fi elif [[ $cidr ]]; then cidr_to_ips $cidr for ip in ${ips[@]}; do echo "--> Scanning $ip" if [[ $port ]]; then scan_tcp $port; pt /tmp/tcp_ports tcp else pp "TCP ports"; scan_tcp; pt /tmp/tcp_ports tcp fi [[ ($RUN_NMAP == true) && -f /tmp/tcp_ports ]] && echo cl done fi