As the headline says, it’s all about port scanning today. When a computer sends SYN to another computer, the remote computer will usually answer with SYN + ACK or RST. By this fact, we can test if a port is open or not.
Different port scanners can be used to test whether a port is open or not. Or Test-NetConnection or a self-created script. Remember Test NetConnection:
But if you try to test multiple computers and multiple ports you are faced with an error message.
The following function addresses this issue. Test-OpenPort allows testing multiple computers and multiple ports at once.
Test-OpenPort
Before we get to the function itself, I would like to show my function in action. The function has two parameters: Target and Port.
Test-OpenPort -Target 192.168.0.1 -Port 80
These parameters are not named, so therefore you can omit the parameter names.
Test-OpenPort 192.168.0.1 80
You can also omit the Target. The default value for this parameter is localhost.
Test-OpenPort -Port 80,443
Running on multiple computers and ports requires the use of a comma.
Test-OpenPort 192.168.0.1,sid-500.com -Port 80,443
The screen’s output is an object. Therefore you are able to customize this object with Select-Object or the Format-Commands (Format-Table …)
Test-OpenPort 192.168.0.1,sid-500.com -Port 80,443,53 | Sort-Object Status
For a more sweeter view:
Test-OpenPort 192.168.0.1,sid-500.com -Port 80,443,53 | Sort-Object Status | Out-GridView
The Function
Copy this function into your PowerShell ISE session and press the green start button.
function Test-OpenPort { <# .SYNOPSIS Test-OpenPort is an advanced Powershell function. Test-OpenPort acts like a port scanner. .DESCRIPTION Uses Test-NetConnection. Define multiple targets and multiple ports. .PARAMETER Target Define the target by hostname or IP-Address. Separate them by comma. Default: localhost .PARAMETER Port Mandatory. Define the TCP port. Separate them by comma. .EXAMPLE Test-OpenPort -Target sid-500.com,cnn.com,10.0.0.1 -Port 80,443 .NOTES Author: Patrick Gruenauer Web: https://sid-500.com .LINK None. .INPUTS None. .OUTPUTS None. #> [CmdletBinding()] param ( [Parameter(Position=0)] $Target='localhost', [Parameter(Mandatory=$true, Position=1, Helpmessage = 'Enter Port Numbers. Separate them by comma.')] $Port ) $result=@() foreach ($t in $Target) { foreach ($p in $Port) { $a=Test-NetConnection -ComputerName $t -Port $p -WarningAction SilentlyContinue $result+=New-Object -TypeName PSObject -Property ([ordered]@{ 'Target'=$a.ComputerName; 'RemoteAddress'=$a.RemoteAddress; 'Port'=$a.RemotePort; 'Status'=$a.tcpTestSucceeded }) } } Write-Output $result }
Make it permanent
If you like my approach open PowerShell ISE. Copy the function into your ISE session. Create a folder in C:\Program Files\Windows PowerShell\Modules and save the code as psm1 file. Make sure that your file name and folder name match.
Close PowerShell. Open PowerShell again. The command is now available for all users. Have fun with Test-OpenPort!
Categories: Cyber Security, PowerShell
Thanks Patrick this worked well for me. One addition I made for our environment was to variablize the $Target input to a list of servers we needed to test with using the Get-Content variable syntax ${}. To do that I changed the following at line 45:
$Target= ${C:\Temp\yourListOfServers.txt},
This allowed us to run the command: “PS> Test-OpenPort -Port 135,139,445” and the script read a list of servers from a file yourListOfServers.txt.
yourListOfServers.txt was just a text file with each server name on a new line.
LikeLiked by 1 person