Invoke-Portscan
SYNOPSIS
Simple portscan module
PowerSploit Function: Invoke-Portscan
Author: Rich Lundeen (http://webstersProdigy.net)
License: BSD 3-Clause
Required Dependencies: None
Optional Dependencies: None
SYNTAX
cmdHosts
Invoke-Portscan -Hosts <String[]> [-ExcludeHosts <String>] [-Ports <String>] [-PortFile <String>]
[-TopPorts <String>] [-ExcludedPorts <String>] [-SkipDiscovery] [-PingOnly] [-DiscoveryPorts <String>]
[-Threads <Int32>] [-nHosts <Int32>] [-Timeout <Int32>] [-SleepTimer <Int32>] [-SyncFreq <Int32>] [-T <Int32>]
[-GrepOut <String>] [-XmlOut <String>] [-ReadableOut <String>] [-AllformatsOut <String>] [-noProgressMeter]
[-quiet] [-ForceOverwrite]
fHosts
Invoke-Portscan -HostFile <String> [-ExcludeHosts <String>] [-Ports <String>] [-PortFile <String>]
[-TopPorts <String>] [-ExcludedPorts <String>] [-SkipDiscovery] [-PingOnly] [-DiscoveryPorts <String>]
[-Threads <Int32>] [-nHosts <Int32>] [-Timeout <Int32>] [-SleepTimer <Int32>] [-SyncFreq <Int32>] [-T <Int32>]
[-GrepOut <String>] [-XmlOut <String>] [-ReadableOut <String>] [-AllformatsOut <String>] [-noProgressMeter]
[-quiet] [-ForceOverwrite]
DESCRIPTION
Does a simple port scan using regular sockets, based (pretty) loosely on nmap
EXAMPLES
-------------------------- EXAMPLE 1 --------------------------
Invoke-Portscan -Hosts "webstersprodigy.net,google.com,microsoft.com" -TopPorts 50
Description
Scans the top 50 ports for hosts found for webstersprodigy.net,google.com, and microsoft.com
-------------------------- EXAMPLE 2 --------------------------
echo webstersprodigy.net | Invoke-Portscan -oG test.gnmap -f -ports "80,443,8080"
Description
Does a portscan of "webstersprodigy.net", and writes a greppable output file
-------------------------- EXAMPLE 3 --------------------------
Invoke-Portscan -Hosts 192.168.1.1/24 -T 4 -TopPorts 25 -oA localnet
Description
Scans the top 20 ports for hosts found in the 192.168.1.1/24 range, outputs all file formats
PARAMETERS
-Hosts
Include these comma seperated hosts (supports IPv4 CIDR notation) or pipe them in
Type: String[]
Parameter Sets: cmdHosts
Aliases:
Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False
-HostFile
Input hosts from file rather than commandline
Type: String
Parameter Sets: fHosts
Aliases: iL
Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ExcludeHosts
Exclude these comma seperated hosts
Type: String
Parameter Sets: (All)
Aliases: exclude
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-Ports
Include these comma seperated ports (can also be a range like 80-90)
Type: String
Parameter Sets: (All)
Aliases: p
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-PortFile
Input ports from a file
Type: String
Parameter Sets: (All)
Aliases: iP
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-TopPorts
Include the x top ports - only goes to 1000, default is top 50
Type: String
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ExcludedPorts
Exclude these comma seperated ports
Type: String
Parameter Sets: (All)
Aliases: xPorts
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-SkipDiscovery
Treat all hosts as online, skip host discovery
Type: SwitchParameter
Parameter Sets: (All)
Aliases: Pn
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-PingOnly
Ping scan only (disable port scan)
Type: SwitchParameter
Parameter Sets: (All)
Aliases: sn
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-DiscoveryPorts
Comma separated ports used for host discovery. -1 is a ping
Type: String
Parameter Sets: (All)
Aliases: PS
Required: False
Position: Named
Default value: -1,445,80,443
Accept pipeline input: False
Accept wildcard characters: False
-Threads
number of max threads for the thread pool (per host)
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 100
Accept pipeline input: False
Accept wildcard characters: False
-nHosts
number of hosts to concurrently scan
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 25
Accept pipeline input: False
Accept wildcard characters: False
-Timeout
Timeout time on a connection in miliseconds before port is declared filtered
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 2000
Accept pipeline input: False
Accept wildcard characters: False
-SleepTimer
Wait before thread checking, in miliseconds
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 500
Accept pipeline input: False
Accept wildcard characters: False
-SyncFreq
How often (in terms of hosts) to sync threads and flush output
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 1024
Accept pipeline input: False
Accept wildcard characters: False
-T
[0-5] shortcut performance options. Default is 3. higher is more aggressive. Sets (nhosts, threads,timeout) 5 {$nHosts=30; $Threads = 1000; $Timeout = 750 } 4 {$nHosts=25; $Threads = 1000; $Timeout = 1200 } 3 {$nHosts=20; $Threads = 100; $Timeout = 2500 } 2 {$nHosts=15; $Threads = 32; $Timeout = 3000 } 1 {$nHosts=10; $Threads = 32; $Timeout = 5000 }
Type: Int32
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: 0
Accept pipeline input: False
Accept wildcard characters: False
-GrepOut
Greppable output file
Type: String
Parameter Sets: (All)
Aliases: oG
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-XmlOut
output XML file
Type: String
Parameter Sets: (All)
Aliases: oX
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-ReadableOut
output file in 'readable' format
Type: String
Parameter Sets: (All)
Aliases: oN
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-AllformatsOut
output in readable (.nmap), xml (.xml), and greppable (.gnmap) formats
Type: String
Parameter Sets: (All)
Aliases: oA
Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False
-noProgressMeter
Suppresses the progress meter
Type: SwitchParameter
Parameter Sets: (All)
Aliases:
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-quiet
supresses returned output and don't store hosts in memory - useful for very large scans
Type: SwitchParameter
Parameter Sets: (All)
Aliases: q
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False
-ForceOverwrite
Force Overwrite if output Files exist. Otherwise it throws exception
Type: SwitchParameter
Parameter Sets: (All)
Aliases: F
Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False