Stop Being a Script Kiddie: building a Port Scanner with Python 🐍

We all start somewhere.

When I first got into cybersecurity, I was fascinated by tools like Nmap. I would type a command, watch the green text scroll by, and feel like a hacker in a movie. But eventually, I realized something important: running tools doesn't make you a hacker; understanding how they work does.

If you rely 100% on tools other people wrote, you are just a "Script Kiddie."

So, I decided to open the hood and see how network scanning actually works. Today, I want to share a simple Python script I wrote to understand the TCP Handshake process.

It’s not as fast as Nmap (yet!), but it’s mine. And building it taught me more than running nmap -sS ever did.

The Logic: How does it work?

The concept is surprisingly simple. A port scanner is just a program that knocks on doors.

1. We pick a target (IP Address).
2. We try to connect to a specific port (like Port 80 for Web).
3. If the door opens (Connection Accepted) -> The Port is Open.
4. If the door is locked or no one answers -> The Port is Closed.

We can do this easily using Python’s built-in socket library.

The Code

Here is the script. I kept it simple and added some error handling so it doesn't crash if I press Ctrl+C.

import socket
import sys
from datetime import datetime

# 1. Input Validation
if len(sys.argv) == 2:
    # Translate hostname to IPv4
    target = socket.gethostbyname(sys.argv[1]) 
else:
    print("Invalid amount of arguments.")
    print("Syntax: python scanner.py <ip>")
    sys.exit()

# 2. Adding a Banner (Because it looks cool)
print("-" * 50)
print(f"Scanning target: {target}")
print(f"Time started: {str(datetime.now())}")
print("-" * 50)

try:
    # 3. Scanning Ports
    # I'm scanning 1 to 1000, but you can change this range
    for port in range(1, 1000): 
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        socket.setdefaulttimeout(1) # Don't wait forever

        # connect_ex returns 0 if the connection is successful
        result = s.connect_ex((target, port)) 

        if result == 0:
            print(f"Found Open Port: {port}")
        s.close()

except KeyboardInterrupt:
    print("\nExiting program.")
    sys.exit()

except socket.gaierror:
    print("Hostname could not be resolved.")
    sys.exit()

except socket.error:
    print("Could not connect to server.")
    sys.exit()

Breaking it Down

If you are new to Python networking, here is what the weird lines mean:

socket.AF_INET: This tells Python we are using IPv4 addresses.

socket.SOCK_STREAM: This means we are using TCP (Connection-based protocol), not UDP.

s.connect_ex(): This is the secret sauce. Unlike the normal connect() function which crashes your program if a connection fails, connect_ex() just gives you an error code. If it returns 0, we know we got in!

How to Run It
Save the code as scanner.py and run it in your terminal:

Bash
python scanner.py 192.168.1.1
(Make sure to test it on your own router or local machine first!)

What's Next?
This is just V1. The current version is "single-threaded," which means it checks one port at a time. It's a bit slow.

My next goal is to implement Threading to scan hundreds of ports simultaneously.

I hope this encourages you to stop just running commands and start writing your own tools. If you have any tips on how to optimize this code, drop a comment below!

Happy Hacking! 💻🛡️