SID-500

Home » PowerShell » Test-Port: Use PowerShell as a Port Scanner

Test-Port: Use PowerShell as a Port Scanner

Long time ago I’ve created a small function that acts like a port scanner. It’s  not a replacement for enterprise scanners such as nmap, but it’s quite useful for quick tests when nmap is not at hand. The command Test-Port calls Test-NetConnection and enables you to specify more than one port number. It’s nothing special, but it’s worth sharing.

Quick glance at the TCP-Handshake

When a computer sends SYN to another computer, the remote computer will usually answer with SYN + ACK or RST. By this fact, we can test if a port is open or not.

Unbenannt.PNG

Unbenannt.PNG

Test-NetConnection

To test whether a port is open or not, different port scanners can be used. Or Test-NetConnection or a self-made script. Remember Test-NetConnection:

1.PNG

Seems that Port 80 of cnn.com is open (SYN + ACK).

Test-Port

Well, as announced, my modest little script which enables you to test multiple ports. This will only work with PowerShell 4.0 and above. (Thanks to the community who brought it to my attention)

Copy the following code to PowerShell or PowerShell ISE. Run it. The command Test-Port then becomes avaliable.

function Test-Port
{$computer=Read-Host "Computername | IP Address?"
 $port=Read-Host "Port Numbers? Separate them by comma"
 $port.split(',') | Foreach-Object -Process {If (($a=Test-NetConnection $computer -Port $_ -WarningAction SilentlyContinue).tcpTestSucceeded -eq $true) {Write-Host $a.Computername $a.RemotePort -ForegroundColor Green -Separator " ==> "} else {Write-Host $a.Computername $a.RemotePort -Separator " ==> " -ForegroundColor Red}}
 }

1.PNG

You will be asked to provide a destination and a port. It should look like the screenshot below. Open Ports are marked green, closed Ports red.

Unbenannt.PNG

Does anything seem strange to you? How can you read this article when the correspondending port (https ==> 443) of sid-500.com is closed? Don’t worry it’s neither a faked screenshot nor a bug or something magic. My Active Directory domain name is sid-500.com. In this screen my internal domain was tested. 😉

If you want to make Test-Port permanent for all user of all PowerShell Sessions save it as a Module. More about here:

PowerShell Functions: How to create your first PowerShell Module Command


2 Comments

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

GET-AUTHOR

My name is Patrick Grünauer. Microsoft MVP. I am from Austria. On sid-500 I write about Windows, Cisco and IT-Security in English and German. Have fun while reading!

Categories

Patrick Gruenauer
Follow SID-500 on WordPress.com