mirror of
https://github.com/PowerShellMafia/PowerSploit
synced 2026-06-08 12:13:33 +00:00
HarmJ0y
ad32d6c75b
-(More) PSScriptAnalyzering
-Tweaking of synopsis blocks in order to support platyPS
-Code standardization
-Generated docs
431 lines
8.4 KiB
Markdown
Executable File
431 lines
8.4 KiB
Markdown
Executable File
# Invoke-Portscan
|
|
|
|
## SYNOPSIS
|
|
Simple portscan module
|
|
|
|
PowerSploit Function: Invoke-Portscan
|
|
Author: Rich Lundeen (http://webstersProdigy.net)
|
|
License: BSD 3-Clause
|
|
Required Dependencies: None
|
|
Optional Dependencies: None
|
|
|
|
## SYNTAX
|
|
|
|
### cmdHosts
|
|
```
|
|
Invoke-Portscan -Hosts <String[]> [-ExcludeHosts <String>] [-Ports <String>] [-PortFile <String>]
|
|
[-TopPorts <String>] [-ExcludedPorts <String>] [-SkipDiscovery] [-PingOnly] [-DiscoveryPorts <String>]
|
|
[-Threads <Int32>] [-nHosts <Int32>] [-Timeout <Int32>] [-SleepTimer <Int32>] [-SyncFreq <Int32>] [-T <Int32>]
|
|
[-GrepOut <String>] [-XmlOut <String>] [-ReadableOut <String>] [-AllformatsOut <String>] [-noProgressMeter]
|
|
[-quiet] [-ForceOverwrite]
|
|
```
|
|
|
|
### fHosts
|
|
```
|
|
Invoke-Portscan -HostFile <String> [-ExcludeHosts <String>] [-Ports <String>] [-PortFile <String>]
|
|
[-TopPorts <String>] [-ExcludedPorts <String>] [-SkipDiscovery] [-PingOnly] [-DiscoveryPorts <String>]
|
|
[-Threads <Int32>] [-nHosts <Int32>] [-Timeout <Int32>] [-SleepTimer <Int32>] [-SyncFreq <Int32>] [-T <Int32>]
|
|
[-GrepOut <String>] [-XmlOut <String>] [-ReadableOut <String>] [-AllformatsOut <String>] [-noProgressMeter]
|
|
[-quiet] [-ForceOverwrite]
|
|
```
|
|
|
|
## DESCRIPTION
|
|
Does a simple port scan using regular sockets, based (pretty) loosely on nmap
|
|
|
|
## EXAMPLES
|
|
|
|
### -------------------------- EXAMPLE 1 --------------------------
|
|
```
|
|
Invoke-Portscan -Hosts "webstersprodigy.net,google.com,microsoft.com" -TopPorts 50
|
|
```
|
|
|
|
Description
|
|
-----------
|
|
Scans the top 50 ports for hosts found for webstersprodigy.net,google.com, and microsoft.com
|
|
|
|
### -------------------------- EXAMPLE 2 --------------------------
|
|
```
|
|
echo webstersprodigy.net | Invoke-Portscan -oG test.gnmap -f -ports "80,443,8080"
|
|
```
|
|
|
|
Description
|
|
-----------
|
|
Does a portscan of "webstersprodigy.net", and writes a greppable output file
|
|
|
|
### -------------------------- EXAMPLE 3 --------------------------
|
|
```
|
|
Invoke-Portscan -Hosts 192.168.1.1/24 -T 4 -TopPorts 25 -oA localnet
|
|
```
|
|
|
|
Description
|
|
-----------
|
|
Scans the top 20 ports for hosts found in the 192.168.1.1/24 range, outputs all file formats
|
|
|
|
## PARAMETERS
|
|
|
|
### -Hosts
|
|
Include these comma seperated hosts (supports IPv4 CIDR notation) or pipe them in
|
|
|
|
```yaml
|
|
Type: String[]
|
|
Parameter Sets: cmdHosts
|
|
Aliases:
|
|
|
|
Required: True
|
|
Position: Named
|
|
Default value: None
|
|
Accept pipeline input: True (ByValue)
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -HostFile
|
|
Input hosts from file rather than commandline
|
|
|
|
```yaml
|
|
Type: String
|
|
Parameter Sets: fHosts
|
|
Aliases: iL
|
|
|
|
Required: True
|
|
Position: Named
|
|
Default value: None
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -ExcludeHosts
|
|
Exclude these comma seperated hosts
|
|
|
|
```yaml
|
|
Type: String
|
|
Parameter Sets: (All)
|
|
Aliases: exclude
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: None
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -Ports
|
|
Include these comma seperated ports (can also be a range like 80-90)
|
|
|
|
```yaml
|
|
Type: String
|
|
Parameter Sets: (All)
|
|
Aliases: p
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: None
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -PortFile
|
|
Input ports from a file
|
|
|
|
```yaml
|
|
Type: String
|
|
Parameter Sets: (All)
|
|
Aliases: iP
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: None
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -TopPorts
|
|
Include the x top ports - only goes to 1000, default is top 50
|
|
|
|
```yaml
|
|
Type: String
|
|
Parameter Sets: (All)
|
|
Aliases:
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: None
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -ExcludedPorts
|
|
Exclude these comma seperated ports
|
|
|
|
```yaml
|
|
Type: String
|
|
Parameter Sets: (All)
|
|
Aliases: xPorts
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: None
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -SkipDiscovery
|
|
Treat all hosts as online, skip host discovery
|
|
|
|
```yaml
|
|
Type: SwitchParameter
|
|
Parameter Sets: (All)
|
|
Aliases: Pn
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: False
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -PingOnly
|
|
Ping scan only (disable port scan)
|
|
|
|
```yaml
|
|
Type: SwitchParameter
|
|
Parameter Sets: (All)
|
|
Aliases: sn
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: False
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -DiscoveryPorts
|
|
Comma separated ports used for host discovery.
|
|
-1 is a ping
|
|
|
|
```yaml
|
|
Type: String
|
|
Parameter Sets: (All)
|
|
Aliases: PS
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: -1,445,80,443
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -Threads
|
|
number of max threads for the thread pool (per host)
|
|
|
|
```yaml
|
|
Type: Int32
|
|
Parameter Sets: (All)
|
|
Aliases:
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: 100
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -nHosts
|
|
number of hosts to concurrently scan
|
|
|
|
```yaml
|
|
Type: Int32
|
|
Parameter Sets: (All)
|
|
Aliases:
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: 25
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -Timeout
|
|
Timeout time on a connection in miliseconds before port is declared filtered
|
|
|
|
```yaml
|
|
Type: Int32
|
|
Parameter Sets: (All)
|
|
Aliases:
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: 2000
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -SleepTimer
|
|
Wait before thread checking, in miliseconds
|
|
|
|
```yaml
|
|
Type: Int32
|
|
Parameter Sets: (All)
|
|
Aliases:
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: 500
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -SyncFreq
|
|
How often (in terms of hosts) to sync threads and flush output
|
|
|
|
```yaml
|
|
Type: Int32
|
|
Parameter Sets: (All)
|
|
Aliases:
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: 1024
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -T
|
|
\[0-5\] shortcut performance options.
|
|
Default is 3.
|
|
higher is more aggressive.
|
|
Sets (nhosts, threads,timeout)
|
|
5 {$nHosts=30; $Threads = 1000; $Timeout = 750 }
|
|
4 {$nHosts=25; $Threads = 1000; $Timeout = 1200 }
|
|
3 {$nHosts=20; $Threads = 100; $Timeout = 2500 }
|
|
2 {$nHosts=15; $Threads = 32; $Timeout = 3000 }
|
|
1 {$nHosts=10; $Threads = 32; $Timeout = 5000 }
|
|
|
|
```yaml
|
|
Type: Int32
|
|
Parameter Sets: (All)
|
|
Aliases:
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: 0
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -GrepOut
|
|
Greppable output file
|
|
|
|
```yaml
|
|
Type: String
|
|
Parameter Sets: (All)
|
|
Aliases: oG
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: None
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -XmlOut
|
|
output XML file
|
|
|
|
```yaml
|
|
Type: String
|
|
Parameter Sets: (All)
|
|
Aliases: oX
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: None
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -ReadableOut
|
|
output file in 'readable' format
|
|
|
|
```yaml
|
|
Type: String
|
|
Parameter Sets: (All)
|
|
Aliases: oN
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: None
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -AllformatsOut
|
|
output in readable (.nmap), xml (.xml), and greppable (.gnmap) formats
|
|
|
|
```yaml
|
|
Type: String
|
|
Parameter Sets: (All)
|
|
Aliases: oA
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: None
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -noProgressMeter
|
|
Suppresses the progress meter
|
|
|
|
```yaml
|
|
Type: SwitchParameter
|
|
Parameter Sets: (All)
|
|
Aliases:
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: False
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -quiet
|
|
supresses returned output and don't store hosts in memory - useful for very large scans
|
|
|
|
```yaml
|
|
Type: SwitchParameter
|
|
Parameter Sets: (All)
|
|
Aliases: q
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: False
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
### -ForceOverwrite
|
|
Force Overwrite if output Files exist.
|
|
Otherwise it throws exception
|
|
|
|
```yaml
|
|
Type: SwitchParameter
|
|
Parameter Sets: (All)
|
|
Aliases: F
|
|
|
|
Required: False
|
|
Position: Named
|
|
Default value: False
|
|
Accept pipeline input: False
|
|
Accept wildcard characters: False
|
|
```
|
|
|
|
## INPUTS
|
|
|
|
## OUTPUTS
|
|
|
|
## NOTES
|
|
|
|
## RELATED LINKS
|
|
|
|
[http://webstersprodigy.net](http://webstersprodigy.net)
|
|
|