????????我們使用了原始套接字（socket.SOCK_RAW）來(lái)發(fā)送和接收ICMP消息，也就是通過(guò)模擬ICMP協(xié)議來(lái)進(jìn)行UDP端口的探測(cè)。我們構(gòu)造了一個(gè)簡(jiǎn)單的ICMP數(shù)據(jù)包，并將其發(fā)送到目標(biāo)主機(jī)的特定端口。然后，我們等待接收目標(biāo)主機(jī)返回的ICMP消息，并判斷其類(lèi)型和代碼是否為端口不可達(dá)消息。如果是，則推斷目標(biāo)端口關(guān)閉；如果不是，則認(rèn)為目標(biāo)端口開(kāi)放。

import socket
import os
import struct
import timedef udp_port_scan(target_ip, port):icmp = socket.getprotobyname("icmp")sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, icmp)sock.settimeout(1)  # 設(shè)置超時(shí)時(shí)間為1秒# 構(gòu)造ICMP消息data = b'abcdefghijklmnopqrstuvwabcdefghi'icmp_packet = struct.pack("!BBHHH32s", 8, 0, 0, 0, 0, data)try:sock.sendto(icmp_packet, (target_ip, port))start_time = time.time()while True:try:recv_packet, addr = sock.recvfrom(1024)end_time = time.time()elapsed_time = (end_time - start_time) * 1000  # 計(jì)算往返時(shí)間icmp_header = recv_packet[20:28]icmp_type, code, checksum, packet_id, sequence = struct.unpack("!BBHHH", icmp_header)#print(addr)#print(recv_packet)#print('elaspsed_time:',elapsed_time)#print(icmp_header)#print(icmp_type)#print(code)#print(checksum)#print(packet_id)#print(sequence)# 判斷是否為ICMP端口不可達(dá)消息if icmp_type == 3 and code == 3 and packet_id == os.getpid() & 0xFFFF:print(f"Port {port} is closed")break# 此時(shí)可以認(rèn)為端口開(kāi)放print(f"Port {port} is open")breakexcept socket.timeout:print(f"Port {port} is closed.Timeout!")breakfinally:sock.close()target_ip = '10.233.76.44'
target_ip = '115.236.153.177'
target_ip = '8.8.8.8'
ports_to_scan = [80, 443, 22, 53]  # 要探測(cè)的端口列表for port in ports_to_scan:udp_port_scan(target_ip, port)

請(qǐng)注意，在使用原始套接字和ICMP協(xié)議進(jìn)行UDP端口探測(cè)時(shí)，可能需要使用管理員權(quán)限運(yùn)行腳本。同時(shí)，由于涉及到底層協(xié)議和操作系統(tǒng)的原因，代碼在不同的平臺(tái)和環(huán)境中可能會(huì)有所調(diào)整。