Linux环境下OpenSSL如何进行端口扫描

在Linux环境下，OpenSSL本身并不直接提供端口扫描功能。它主要用于加密通信和生成证书等安全相关的任务。但是，你可以使用OpenSSL结合其他工具或脚本来实现端口扫描。

以下是几种使用OpenSSL进行端口扫描的方法：

方法一：使用openssl s_client命令

openssl s_client命令可以用来连接到远程服务器的指定端口，并显示连接过程中的信息。通过观察连接是否成功，可以判断端口是否开放。

openssl s_client -connect example.com:80

如果端口80开放，你会看到类似以下的输出：

CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify error:num=27:certificate not trusted
verify return:1
depth=0 CN = example.com
verify return:1
---
Certificate chain
 0 s:CN = example.com
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
---
Server certificate
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
subject=CN = example.com
issuer=C = US, O = Internet Security Research Group, CN = ISRG Root X1
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA PKCS#1
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3544 bytes and written 428 bytes
Verification error: self signed certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

如果端口未开放，你会看到类似以下的输出：

CONNECTED(00000003)
140735513065344:error:1408F10B:SSL routines:ssl3_get_record:wrong version number:s3_pkt.c:1277:SSL alert number 40
---
no peer certificate available
---
SSL handshake has read 3 bytes and written 3 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

方法二：使用nc（Netcat）和openssl结合

你可以使用nc命令来检查端口是否开放，然后使用openssl来进一步验证连接。

nc -zv example.com 80 && openssl s_client -connect example.com:80

如果端口80开放，你会看到类似以下的输出：

Connection to example.com 80 port [tcp/http] succeeded!
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify error:num=27:certificate not trusted
verify return:1
depth=0 CN = example.com
verify return:1
---
Certificate chain
 0 s:CN = example.com
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
---
Server certificate
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
subject=CN = example.com
issuer=C = US, O = Internet Security Research Group, CN = ISRG Root X1
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA PKCS#1
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3544 bytes and written 428 bytes
Verification error: self signed certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---

方法三：编写脚本自动化扫描

你可以编写一个简单的脚本来自动化上述过程。以下是一个示例脚本：

#!/bin/bash

HOST=$1
PORT=$2

echo "Scanning $HOST on port $PORT..."

if nc -zv $HOST $PORT; then
    echo "Port $PORT is open."
    openssl s_client -connect $HOST:$PORT
else
    echo "Port $PORT is closed."
fi

保存脚本为scan_port.sh，然后运行：

chmod +x scan_port.sh
./scan_port.sh example.com 80

这些方法可以帮助你在Linux环境下使用OpenSSL进行端口扫描。请注意，端口扫描可能会被目标服务器视为恶意行为，因此在进行扫描之前，请确保你有合法的权限。