Port detection method, device and system

Abstract

The present application provides a port scanning method, device and system, which are applied to servers, and the method includes: creating a virtual object of the client; using the virtual object to perform interactive operations with the server through an open port, and obtaining feedback from the server the real data packet; determine the real service in the real data packet. In this embodiment, the server creates a virtual object of the client, obtains the real data message of the open port in the server through the virtual object interacting with the server, and learns the real service therein through the real data message. Compared with the prior art of obtaining the software version and analyzing the software version, this embodiment can simply, conveniently and quickly obtain the real service of the open port, and is suitable for high-efficiency port scanning on an enterprise scale.

Description

technical field [0001] The present application relates to the technical field of data security, in particular to a port detection method, device and system. Background technique [0002] The server has many ports, which can be opened for other terminals to use. While the server is opening the port, intruders can also use the port to attack the server. In order to avoid attacks, a scan operation is usually performed on the open ports of the server. [0003] At present, some scanning tools (for example, nmap, zmap) are usually used to scan the open ports of the server. At present, the scanning tool can use the semi-open scanning method nmap-sS to scan the open port and obtain the default service of the port. This method cannot detect the real service of the port (in some cases, the attacker will modify the port service) . [0004] The scanning tool can use the version detection method nmap-sV to scan the software version of the server, and obtain open ports and real servic...

AI Technical Summary

Problems solved by technology

At present, the scanning tool can use the semi-open scanning method nmap-sS to scan the open port and obtain the default service of the port. This method cannot detect the real service of the port (in some cases, the attacker will modify the port service)

[0004] The scanning tool can use the version detection method nmap-sV to scan the software version of the server, and obtain open ports and real services through parsing, but this method is slow and not suitable for efficient port scanning on an enterprise scale to obtain real services

Images