快捷導(dǎo)航

基于C#實現(xiàn)一個簡單的漏洞掃描器

更新時間：2026年04月10日 09:16:51 作者：JQLvopkk

本文介紹了使用C#開發(fā)一個簡單的漏洞掃描器,具備端口掃描和基礎(chǔ)Web漏洞檢測功能,如SQL注入和XSS檢測,文章提供了項目創(chuàng)建方法、完整代碼、使用說明以及功能說明,還提到了局限性和改進(jìn)方向,最后建議了功能拓展方向,需要的朋友可以參考下

1. 項目創(chuàng)建與依賴

建議使用 .NET 6/8 控制臺應(yīng)用。

dotnet new console -n SimpleVulnScanner cd SimpleVulnScanner

無需額外 NuGet 包，僅使用內(nèi)置 System.Net.Sockets、System.Net.Http。

2. 完整代碼

using System.Net.Sockets;
using System.Net;
using System.Text;
using System.Text.RegularExpressions;
namespace SimpleVulnScanner;
class Program
{
    static async Task Main(string[] args)
    {
        Console.WriteLine("=== 簡單漏洞掃描器 (C#) ===");
        string target = GetTarget(args);
        int startPort = 1, endPort = 1024; // 默認(rèn)掃描常見端口
        // 解析端口范圍
        if (args.Length >= 2)
        {
            var portParts = args[1].Split('-');
            if (portParts.Length == 2 && int.TryParse(portParts[0], out int p1) && int.TryParse(portParts[1], out int p2))
            {
                startPort = p1;
                endPort = p2;
            }
            else if (int.TryParse(args[1], out int singlePort))
            {
                startPort = singlePort;
                endPort = singlePort;
            }
        }
        Console.WriteLine($"目標(biāo): {target}");
        Console.WriteLine($"端口范圍: {startPort}-{endPort}");
        Console.WriteLine("開始端口掃描...\n");
        var openPorts = await PortScanner.ScanPortsAsync(target, startPort, endPort);
        Console.WriteLine("\n端口掃描完成。");
        if (openPorts.Count == 0)
        {
            Console.WriteLine("未發(fā)現(xiàn)開放端口。");
            return;
        }
        Console.WriteLine("開放端口列表:");
        foreach (var port in openPorts)
        {
            string service = PortScanner.GuessService(port);
            Console.WriteLine($"  {port}/tcp  ({service})");
        }
        // 對常見 Web 端口進(jìn)行漏洞檢測
        var webPorts = openPorts.Where(p => p == 80 || p == 443 || p == 8080 || p == 8443).ToList();
        if (webPorts.Any())
        {
            Console.WriteLine("\n開始 Web 漏洞檢測...");
            foreach (var port in webPorts)
            {
                string scheme = port == 443 || port == 8443 ? "https" : "http";
                string baseUrl = $"{scheme}://{target}:{port}";
                await WebVulnScanner.ScanAsync(baseUrl);
            }
        }
        Console.WriteLine("\n掃描結(jié)束。按任意鍵退出...");
        Console.ReadKey();
    }
    static string GetTarget(string[] args)
    {
        if (args.Length > 0 && !string.IsNullOrEmpty(args[0]))
            return args[0];
        Console.Write("請輸入目標(biāo) IP 或域名: ");
        return Console.ReadLine()?.Trim() ?? "127.0.0.1";
    }
}
// ---------- 端口掃描模塊 ----------
public static class PortScanner
{
    private const int TimeoutMs = 1000;
    private const int MaxConcurrency = 100;
    public static async Task<List<int>> ScanPortsAsync(string host, int startPort, int endPort)
    {
        var openPorts = new List<int>();
        var semaphore = new SemaphoreSlim(MaxConcurrency);
        var tasks = new List<Task>();
        for (int port = startPort; port <= endPort; port++)
        {
            await semaphore.WaitAsync();
            int currentPort = port;
            tasks.Add(Task.Run(async () =>
            {
                try
                {
                    if (await IsPortOpenAsync(host, currentPort))
                    {
                        lock (openPorts)
                        {
                            openPorts.Add(currentPort);
                            Console.WriteLine($"[+] 開放: {currentPort}/tcp");
                        }
                    }
                }
                finally
                {
                    semaphore.Release();
                }
            }));
        }
        await Task.WhenAll(tasks);
        openPorts.Sort();
        return openPorts;
    }
    private static async Task<bool> IsPortOpenAsync(string host, int port)
    {
        try
        {
            using var client = new TcpClient();
            var connectTask = client.ConnectAsync(host, port);
            var timeoutTask = Task.Delay(TimeoutMs);
            var completedTask = await Task.WhenAny(connectTask, timeoutTask);
            if (completedTask == timeoutTask)
                return false;
            return client.Connected;
        }
        catch
        {
            return false;
        }
    }
    public static string GuessService(int port)
    {
        return port switch
        {
            21 => "FTP",
            22 => "SSH",
            23 => "Telnet",
            25 => "SMTP",
            80 => "HTTP",
            110 => "POP3",
            143 => "IMAP",
            443 => "HTTPS",
            3306 => "MySQL",
            3389 => "RDP",
            5432 => "PostgreSQL",
            8080 => "HTTP-Proxy",
            _ => "未知"
        };
    }
}
// ---------- Web 漏洞檢測模塊 ----------
public static class WebVulnScanner
{
    private static readonly HttpClient _httpClient;
    static WebVulnScanner()
    {
        var handler = new HttpClientHandler
        {
            ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true // 忽略證書錯誤
        };
        _httpClient = new HttpClient(handler);
        _httpClient.Timeout = TimeSpan.FromSeconds(10);
        _httpClient.DefaultRequestHeaders.Add("User-Agent", "SimpleVulnScanner/1.0");
    }
    public static async Task ScanAsync(string baseUrl)
    {
        Console.WriteLine($"\n[*] 掃描 Web 服務(wù): {baseUrl}");
        // 1. 檢測 SQL 注入（基于錯誤回顯）
        await TestSqlInjectionAsync(baseUrl);
        // 2. 檢測反射型 XSS
        await TestReflectedXssAsync(baseUrl);
    }
    private static async Task TestSqlInjectionAsync(string baseUrl)
    {
        string[] sqlPayloads = { "'", "\"", "' OR '1'='1", "\" OR \"1\"=\"1", "' OR 1=1--", "\" OR 1=1--" };
        var errorPatterns = new[]
        {
            "SQL syntax", "mysql_fetch", "ORA-", "PostgreSQL", "SQLite", "Microsoft OLE DB",
            "Unclosed quotation mark", "You have an error in your SQL syntax"
        };
        foreach (var payload in sqlPayloads)
        {
            string testUrl = $"{baseUrl}/?id={Uri.EscapeDataString(payload)}";
            try
            {
                var response = await _httpClient.GetAsync(testUrl);
                string content = await response.Content.ReadAsStringAsync();
                foreach (var pattern in errorPatterns)
                {
                    if (content.Contains(pattern, StringComparison.OrdinalIgnoreCase))
                    {
                        Console.WriteLine($"  [!] 可能存在 SQL 注入 (錯誤回顯) - Payload: {payload}");
                        return; // 僅報告一次
                    }
                }
            }
            catch (Exception ex)
            {
                // 忽略網(wǎng)絡(luò)錯誤
            }
        }
    }
    private static async Task TestReflectedXssAsync(string baseUrl)
    {
        string xssPayload = "<script>alert('XSS')</script>";
        string testUrl = $"{baseUrl}/?q={Uri.EscapeDataString(xssPayload)}";
        try
        {
            var response = await _httpClient.GetAsync(testUrl);
            string content = await response.Content.ReadAsStringAsync();
            // 檢查 payload 是否原樣反射在響應(yīng)中
            if (content.Contains(xssPayload))
            {
                Console.WriteLine($"  [!] 可能存在反射型 XSS - Payload 已回顯");
            }
        }
        catch
        {
            // 忽略
        }
    }
}

3. 使用說明

命令行參數(shù)

dotnet run <目標(biāo)IP/域名> [端口范圍]

示例：

# 掃描 127.0.0.1 的 1-1024 端口
dotnet run 127.0.0.1
# 掃描 192.168.1.1 的 80-100 端口
dotnet run 192.168.1.1 80-100
# 掃描單個端口 443
dotnet run example.com 443

若未提供參數(shù)，程序會交互式詢問目標(biāo)。

運(yùn)行截圖示意

=== 簡單漏洞掃描器 (C#) ===
目標(biāo): 192.168.1.1
端口范圍: 1-1024
開始端口掃描...
[+] 開放: 80/tcp
[+] 開放: 443/tcp
[+] 開放: 22/tcp
端口掃描完成。
開放端口列表:
  22/tcp  (SSH)
  80/tcp  (HTTP)
  443/tcp  (HTTPS)
開始 Web 漏洞檢測...
[*] 掃描 Web 服務(wù): http://192.168.1.1:80
  [!] 可能存在 SQL 注入 (錯誤回顯) - Payload: '
  [!] 可能存在反射型 XSS - Payload 已回顯
[*] 掃描 Web 服務(wù): https://192.168.1.1:443
掃描結(jié)束。按任意鍵退出...

4. 功能說明與局限性

功能	實現(xiàn)方式	說明
端口掃描	TCP Connect 異步掃描	超時 1 秒，并發(fā) 100，速度快且準(zhǔn)確
服務(wù)猜測	靜態(tài)映射表	根據(jù)常見端口號推測服務(wù)名稱
SQL 注入檢測	發(fā)送 `'` 等 payload，匹配錯誤關(guān)鍵詞	僅檢測錯誤回顯型，不適用于盲注
XSS 檢測	發(fā)送 `<script>alert('XSS')</script>` 并檢查回顯	僅檢測反射型，不適用于 DOM 型