How to Retrieve Port and Version Information Using Python

Introduction

In the world of cybersecurity and network management, it’s crucial to understand the services running on a target system and the versions of those services. Knowing this information helps security professionals identify potential vulnerabilities and ensure the network’s health. In this article, we’ll explore the methods for extracting version information from open ports on a target system.

What Are Ports?

Computers and servers use ports to facilitate network communication. A port is a numerical identifier that allows a device to connect to a specific service or application. For example, HTTP web services typically run on port 80, while SSH secure shell access uses port 22.

What Is Service and Version Information?

Each port that is open on a system is associated with a service. These services often have specific version or version numbers. Service and version information helps identify the type and version of a service running on a specific port. For instance, if an HTTP server is running Apache HTTP Server version 2.4.29, this information would provide details about the service and its version.

Notl: A more advanced version of the tool has been published on my github

Extracting Service and Version Information from Open Ports

There are various methods to extract service and version information from open ports:

1. Port Scanning: Port scanning is a technique used to determine which ports are open on a computer or network target. Popular port scanning tools like Nmap and Masscan not only identify open ports but can also discover the service type and version running on those ports.
2. Banner Grabbing: Banner information is a text-based piece of information that helps identify a service or server. Banner grabbing focuses on obtaining banner information from a specific port. This method is especially useful for services like HTTP servers.

Example of Banner Grabbing:

import socket
import argparse

def banner_grabbing(ip, port):
    try:
        sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        sock.settimeout(1)
        sock.connect((ip, port))
        sock.send(b"HEAD / HTTP/1.1\r\n\r\n")
        banner = sock.recv(1024).decode("utf-8", errors="ignore").strip()
        return banner.split("\n")[0]
    except Exception as e:
        return ""

def scan_ports(ip):
    open_ports = []
    for port in range(1, 7000):  # 1 to 1000 Scan ports between
        banner = banner_grabbing(ip, port)
        if banner:
            open_ports.append((port, banner))
    return open_ports

def main():
    parser = argparse.ArgumentParser(description="Extract service and version information from open ports.")
    parser.add_argument("ip", type=str, help="Target IP address")

    args = parser.parse_args()
    target_ip = args.ip

    open_ports = scan_ports(target_ip)

    if open_ports:
        print(f"{target_ip} Ports open at:")
        for port, banner in open_ports:
            print(f"Port {port}: {banner}")
    else:
        print(f"{target_ip} No open port found at.")

if __name__ == "__main__":
    main()

Conclusion

The process of extracting version information from open ports is an essential aspect of network security and monitoring. This information can be used to identify security vulnerabilities, check for up-to-date services, and monitor network health. However, it’s crucial to perform such scans within legal and ethical boundaries. Unauthorized or illegal attempts to access this information can result in legal consequences.