Ip Brute Force

[flyingpoptartcat]

hey guys, i wrote this perl script that trys pinging every posible ipAddr (ipv4) possible. id love to see this grow and be optimized with new features

use ,edit, and share the code as you wish:

version3

#!/usr/bin/perl
# writen by flyingpoptartcat
#perl ipbf.pl [-S ipaddr] [-sn ipaddr] [p Proto]
#
#useage:
#	-S	-	IP address to start at
#	-sn	-	scan just the subnet example 1.23.10.1-255
#	-p	-	Protocall of ping

use Net::Ping;
use Net::IP;
use Getopt::Long;



my $StartIP = "1.0.0.1";
my $Subnet = "f";
my $Proto = "icmp";

GetOptions(
    'S=s'    => \$StartIP,
	'sn=s'	=> \$Subnet,
	'p=s'	=> \$Proto,
);


my $Ping = Net::Ping->new("$Proto", 0, 30);


print "ip brute forcer v3...\n";




if($Subnet != 'f') {
	&subnet();
} else {
	&regular();
}



sub regular{
	print "Protocall - $Proto\nStart IP - $StartIP\n";
	my $ip = Net::IP->new("$StartIP - 255.255.255.255");
	while(($ip->ip()) < "255.255.255.256" ){

		print $ip->ip() . " up\n" if $Ping->ping($ip->ip());
		$ip++;

	}
}

sub subnet{
        print "Protocall - $Proto\nsubnet of $Subnet\n";
	my $ip = Net::IP->new("$Subnet - 255.255.255.255");
	for($i = 1;$i < 256;$i++){
		print $ip->ip() . " up\n" if $Ping->ping($ip->ip());
		$ip++;
	}

}

version 2

#!/usr/bin/perl
use Net::Ping;
use Net::IP;
use Getopt::Long;

print "ip brute forcer v2...\n";

$StartIP = "1.0.0.1";


GetOptions(
    'S=s'    => \$StartIP,
) or die print q{
useage:
	-S	-	IP address to start at
};


my $Ping = Net::Ping->new("icmp", 0, 30);
my $ip = Net::IP->new("$StartIP - 255.255.255.255");


while(($ip->ip()) < "255.255.255.256" ){


	print $ip->ip() . " up\n" if $Ping->ping($ip->ip());
	$ip++;

}

version 1

#!/usr/bin/perl
use Net::Ping;

$Ping = Net::Ping->new("icmp", 0, 18);
print "ip brute forcer...\n";

for($i4 = 1; $i4 < 256;$i4++){	

	for($i3 = 1; $i3 < 256;$i3++){

		for($i2 = 1; $i2 < 256;$i2++){

			for($i1 = 1; $i1 < 256;$i1++){

					$IpAddr = $i4 . "." . $i3 . "." . $i2 . "." . $i1;
					print "$IpAddr\n" if $Ping->ping($IpAddr);

			}

		}

	}

}

Edited July 31, 2011 by flyingpoptartcat

[flyingpoptartcat]

didn't let me use all the white space

[hexophrenic]

I am guessing this was just an academic, getting a handle on scripting type of exercise, right? :P

[flyingpoptartcat]

I am guessing this was just an academic, getting a handle on scripting type of exercise, right? :P

ya, it ain't very practical.

[flyingpoptartcat]

this one might be faster:

#!/usr/bin/perl

use IO::Socket;

for($i4 = 1; $i4 < 256;$i4++){

for($i3 = 1; $i3 < 256;$i3++){

for($i2 = 1; $i2 < 256;$i2++){

for($i1 = 1; $i1 < 256;$i1++){

$IpAddr = $i4 . "." . $i3 . "." . $i2 . "." . $i1;

my $sock = new IO::Socket::INET (

PeerAddr => $IpAddr,

PeerPort => '80',

Proto => 'tcp',

);

if($sock){

print "$IpAddr up\n";

} else {

print "$IpAddr checked\n";

}

}

}

}

}

[flyingpoptartcat]

make more pretty in $i1 for loop:

if($Ping){

print "$IpAddr up\n";

} else {

if($i1 = 255) {

print "status: $IpAddr\n";

}

}

[Infiltrator]

Nice script very straight forward and concise.

[flyingpoptartcat]

Nice script very straight forward and concise.

Thank YOu

[digip]

Well, if you are going to implement a ping, might as well use some other code to do an arp, if its a local network, as a ping might be ignored, but they will still reply to an arp. They have to reply to arp since its basics of networking, but there are various types of arp which a device might not reply to, depending on the OS and software/hardware in use. I used to use a bat script in windows to do this, to find other machines on the local network, for ones that didn't reply to a ping, but will give up the ghost via an arp reply after the ping. ;)

[flyingpoptartcat]

Well, if you are going to implement a ping, might as well use some other code to do an arp, if its a local network, as a ping might be ignored, but they will still reply to an arp. They have to reply to arp since its basics of networking, but there are various types of arp which a device might not reply to, depending on the OS and software/hardware in use. I used to use a bat script in windows to do this, to find other machines on the local network, for ones that didn't reply to a ping, but will give up the ghost via an arp reply after the ping. ;)

Thats a good idea. ill post some new code later to add that feature

but i can't install any arp packages

Edited July 29, 2011 by flyingpoptartcat

[digip]

Thats a good idea. ill post some new code later to add that feature

but i can't install any arp packages

Arp is a basic fundamental of networking and built into the OS itself. you wouldn't be able to do any networking without it, so you should be able to call it directly in some manner from the OS itself.

See the system command:

http://www.linuxquestions.org/questions/programming-9/how-to-call-the-arp-linux-shell-command-from-within-a-perl-program-156159/

Edited July 29, 2011 by digip

[Jason Cooper]

Nice to see another person learning to use Perl, it is a great language. Try the Net::IP module for perl. It will let you replace your 4 loops with just one, and also give you the option of doing IPv6 as well as IPv4.

Also consider using the Getopt::Long module for adding in switches and parameters as it will add very little code to your script but make it very versatile.

Oh, to get the white-space to show in the code in your posts put it in code tags (pressing the <> button on the editor will give you a pair of code tags to paste your code between)

[flyingpoptartcat]

Nice to see another person learning to use Perl, it is a great language. Try the Net::IP module for perl. It will let you replace your 4 loops with just one, and also give you the option of doing IPv6 as well as IPv4.

Also consider using the Getopt::Long module for adding in switches and parameters as it will add very little code to your script but make it very versatile.

Oh, to get the white-space to show in the code in your posts put it in code tags (pressing the <> button on the editor will give you a pair of code tags to paste your code between)

ok. thanks. ill try those

[int0x80]

nmap -sP 0.0.0.0/0

:)

[flyingpoptartcat]

nmap -sP 0.0.0.0/0

:)

or you could just do that... :'(

[digip]

nmap -sP 0.0.0.0/0

:)

nmap is a great tool, but if someone wants to learn how to do something and understand the under pinnings of things, writing your own program is a great place to start learning and gets others excited to get involved with it as well. There are tools for doing just about anything, but if all we did all day was point and click, what have we learned?

[int0x80]

nmap is a great tool, but if someone wants to learn how to do something and understand the under pinnings of things, writing your own program is a great place to start learning and gets others excited to get involved with it as well. There are tools for doing just about anything, but if all we did all day was point and click, what have we learned?

To work smarter, not harder? :)

I know your point, I was just being snarky, and in a way making my own point of avoiding wheel re-invention.