Port scanner - has it already been done?
Posted: Tue Oct 25, 2016 2:34 pmBefore i kill both remaining brain cells in the effort to code it, has anyone seen a port scanner for the ESP?
Are you wanting to scan ESP8266 for traffic? (Psst: the source code should tell you the port...)
OR, are you wanting to build an ESP8266 WiFi scanner (sniffer) looking for traffic?
If the latter, you should be able to dig into the structures.h tab of this project and ferret the listening port, perhaps (Additional code is likely required to extract the source/destination ports from the header.)
https://www.hackster.io/rayburne/esp8266-mini-sniff-f6b93a
Right now, I'm just outputting the MAC for traffic.
Structures used in the sniff project:
Code: Select all
// This-->tab == "structures.h"
#define ETH_MAC_LEN 6
uint8_t broadcast1[3] = { 0x01, 0x00, 0x5e };
uint8_t broadcast2[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
uint8_t broadcast3[3] = { 0x33, 0x33, 0x00 };
struct beaconinfo
{
uint8_t bssid[ETH_MAC_LEN];
uint8_t ssid[33];
int ssid_len;
int channel;
int err;
signed rssi;
uint8_t capa[2];
};
struct clientinfo
{
uint8_t bssid[ETH_MAC_LEN];
uint8_t station[ETH_MAC_LEN];
uint8_t ap[ETH_MAC_LEN];
int channel;
int err;
signed rssi;
uint16_t seq_n;
};
/* ==============================================
Promiscous callback structures, see ESP manual
============================================== */
struct RxControl {
signed rssi: 8;
unsigned rate: 4;
unsigned is_group: 1;
unsigned: 1;
unsigned sig_mode: 2;
unsigned legacy_length: 12;
unsigned damatch0: 1;
unsigned damatch1: 1;
unsigned bssidmatch0: 1;
unsigned bssidmatch1: 1;
unsigned MCS: 7;
unsigned CWB: 1;
unsigned HT_length: 16;
unsigned Smoothing: 1;
unsigned Not_Sounding: 1;
unsigned: 1;
unsigned Aggregation: 1;
unsigned STBC: 2;
unsigned FEC_CODING: 1;
unsigned SGI: 1;
unsigned rxend_state: 8;
unsigned ampdu_cnt: 8;
unsigned channel: 4;
unsigned: 12;
};
struct LenSeq {
uint16_t length;
uint16_t seq;
uint8_t address3[6];
};
struct sniffer_buf {
struct RxControl rx_ctrl;
uint8_t buf[36];
uint16_t cnt;
struct LenSeq lenseq[1];
};
struct sniffer_buf2 {
struct RxControl rx_ctrl;
uint8_t buf[112];
uint16_t cnt;
uint16_t len;
};
struct clientinfo parse_data(uint8_t *frame, uint16_t framelen, signed rssi, unsigned channel)
{
struct clientinfo ci;
ci.channel = channel;
ci.err = 0;
ci.rssi = rssi;
int pos = 36;
uint8_t *bssid;
uint8_t *station;
uint8_t *ap;
uint8_t ds;
ds = frame[1] & 3; //Set first 6 bits to 0
switch (ds) {
// p[1] - xxxx xx00 => NoDS p[4]-DST p[10]-SRC p[16]-BSS
case 0:
bssid = frame + 16;
station = frame + 10;
ap = frame + 4;
break;
// p[1] - xxxx xx01 => ToDS p[4]-BSS p[10]-SRC p[16]-DST
case 1:
bssid = frame + 4;
station = frame + 10;
ap = frame + 16;
break;
// p[1] - xxxx xx10 => FromDS p[4]-DST p[10]-BSS p[16]-SRC
case 2:
bssid = frame + 10;
// hack - don't know why it works like this...
if (memcmp(frame + 4, broadcast1, 3) || memcmp(frame + 4, broadcast2, 3) || memcmp(frame + 4, broadcast3, 3)) {
station = frame + 16;
ap = frame + 4;
} else {
station = frame + 4;
ap = frame + 16;
}
break;
// p[1] - xxxx xx11 => WDS p[4]-RCV p[10]-TRM p[16]-DST p[26]-SRC
case 3:
bssid = frame + 10;
station = frame + 4;
ap = frame + 4;
break;
}
memcpy(ci.station, station, ETH_MAC_LEN);
memcpy(ci.bssid, bssid, ETH_MAC_LEN);
memcpy(ci.ap, ap, ETH_MAC_LEN);
ci.seq_n = frame[23] * 0xFF + (frame[22] & 0xF0);
return ci;
}
struct beaconinfo parse_beacon(uint8_t *frame, uint16_t framelen, signed rssi)
{
struct beaconinfo bi;
bi.ssid_len = 0;
bi.channel = 0;
bi.err = 0;
bi.rssi = rssi;
int pos = 36;
if (frame[pos] == 0x00) {
while (pos < framelen) {
switch (frame[pos]) {
case 0x00: //SSID
bi.ssid_len = (int) frame[pos + 1];
if (bi.ssid_len == 0) {
memset(bi.ssid, '\x00', 33);
break;
}
if (bi.ssid_len < 0) {
bi.err = -1;
break;
}
if (bi.ssid_len > 32) {
bi.err = -2;
break;
}
memset(bi.ssid, '\x00', 33);
memcpy(bi.ssid, frame + pos + 2, bi.ssid_len);
bi.err = 0; // before was error??
break;
case 0x03: //Channel
bi.channel = (int) frame[pos + 2];
pos = -1;
break;
default:
break;
}
if (pos < 0) break;
pos += (int) frame[pos + 1] + 2;
}
} else {
bi.err = -3;
}
bi.capa[0] = frame[34];
bi.capa[1] = frame[35];
memcpy(bi.bssid, frame + 10, ETH_MAC_LEN);
return bi;
}
Ray