Port Scanner Script

Write it in words before code. (1) Target: a single host constant, "127.0.0.1". (2) Port list: a handful of well-known numbers you already recognize — 22, 80, 443, 8000, 3306 — not range(1, 65536). (3) For each port: create SOCK_STREAM, settimeout(0.5 or 1.0), connect_ex((host, port)), if 0 then OPEN else closed_or_filtered, close socket, print and/or append a line. That is a connect scanner from your vantage point. It is not a SYN stealth scan, not UDP, not nmap -A, not a vulnerability exploit. Open means the TCP handshake completed. Closed/filtered means it did not, in the time you waited. Firewalls can make live services look closed. Loopback still teaches the loop without touching anyone else.

Why a list instead of 1–65535 on day one: time, noise, and ethics. Even on localhost, a full 65k connect scan is slow with a 1-second timeout (worst case: hours) and teaches nothing extra about the loop. On any other host it is a loud event in IDS. Small lists keep the lesson about control flow. You can extend the list later on YOUR VM after the lab — still not across a /24 you do not own.

Authorization does not live in Python. connect_ex does not check a get-out-of-jail card. Skill does not create consent. Scanning random internet hosts, café Wi-Fi clients, an ISP’s equipment, a school subnet, or a neighbor’s router without written permission is unauthorized access / abuse of the network, regardless of “I am a student” or “I did not use nmap.” A TCP connect scan is still a scan. Keep the teaching tool on YOUR loopback. A lab VM you installed, whose IP you typed because you own the hypervisor, can be in scope later — still not the café. Print the host at the start of every run so a mistake is obvious before the loop. Hardcode the host so a mistake is harder.

Logging is part of scope. If you do not print HOST, you will not notice you pointed the script at yesterday’s cloud IP. If you log to a world-writable file, someone else on a shared PC reads your output. Notes go to $HOME/cyberlium-lab with chmod 600. They contain port numbers and OPEN/closed — not passwords, not other people’s IPs, not a trophy screenshot of a bank. The next lab will require that file path on purpose so evidence practice matches Topic 2/6 habits.

OPEN: connect_ex returned 0. Something accepted TCP. On 127.0.0.1 that something is a process on YOUR machine (ss -tuln / netstat can confirm). closed: typical connection refused — no listener, stack sent RST. filtered / timeout: the timeout fired; a drop or a slow path, not a clean RST. Beginners collapse the last two into closed_or_filtered, which is honest. Do not upgrade a timeout into “the host is down” or “the host is hiding NSA secrets.” Do not treat OPEN on localhost:8000 as a finding you must exploit. If you started http.server, OPEN is the expected reward for the next lab, not a vulnerability write-up.

False pictures: a listener bound to 127.0.0.1:8080 is OPEN from this scanner on loopback and invisible from another laptop. A listener on 0.0.0.0:8000 is reachable from more paths — still only your machine if you are in NAT. Scanning a public IP to “see the difference” is how labs go off the rails. Stay on 127.0.0.1 until the written lab says you may use a VM you control. This design lesson does not require a second host at all.

After a successful connect, some services send a greeting (SSH version line, SMTP banner, HTTP if you send a request). Reading a small recv() on 127.0.0.1 after you connected to a listener YOU started is optional literacy. It is not required for the design. It is not permission to pull banners from the internet, not a version-to-CVE pipeline, not an nmap -sV clone. Cap the recv (for example 64–256 bytes), keep the timeout, close the socket. Do not send crafted protocol probes to strangers. Do not brute login on an OPEN 22. OPEN is “a door existed,” not “walk in.”

If you skip banners entirely, you still have a complete beginner scanner: loop, connect_ex, record. That is what the lab implements. Banner code that takes HOST from argv will be the first thing someone aims at a school jumphost. Leave HOST hardcoded. Leave banners off unless you are talking to your own http.server.

Study the conceptual flow, then the tiny Python skeleton. You may run the skeleton on 127.0.0.1 now; you will expand it in the next lab. If every port is closed, that is a valid design check — many laptops listen on nothing in that list until you start http.server. Do not “fix” empty OPEN by changing HOST. Do not install nmap to compare. Save a design note if you want; chmod 600. The mission is that you can explain the loop and the legal line before you copy a longer script.

HOST = "127.0.0.1"                 # lock this; next lab keeps it hardcoded
PORTS = [22, 80, 443, 8000, 3306]  # small list — not range(1, 65536)
TIMEOUT = 0.5

err = connect_ex((HOST, port))

print(f"DESIGN CHECK target={HOST} ports={PORTS} timeout={TIMEOUT}")
print("Next lab: implement this on localhost only; write localhost-scan.txt mode 600")

You now can design a connect scanner as a loop with a timeout and a tiny port list, and you know the host string is the ethics control. OPEN is a vantage-point clue. Unauthorized scanning is illegal; this tool is for YOUR loopback. Banner grabs stay optional and local. Next — Lab — Build a Port Scanner — copy-paste Python, HOST hardcoded to 127.0.0.1, results in localhost-scan.txt mode 600, optional http.server on port 8000 on YOUR machine.