#!/usr/bin/env python3
"""
Advanced Network Scanner
Author: Gaurav Singh
GitHub: https://github.com/GauravSingh-CyberSecurity/network-scanner
"""

import socket
import threading
import subprocess
import argparse
import json
import time
from concurrent.futures import ThreadPoolExecutor, as_completed
from datetime import datetime

class NetworkScanner:
    def __init__(self, target_range, threads=100, timeout=1):
        self.target_range = target_range
        self.threads = threads
        self.timeout = timeout
        self.open_ports = []
        self.services = {}
        self.scan_results = {}
        
    def scan_port(self, host, port):
        """Scan individual port on target host"""
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(self.timeout)
            result = sock.connect_ex((host, port))
            
            if result == 0:
                self.open_ports.append((host, port))
                # Attempt banner grabbing
                banner = self.grab_banner(host, port)
                self.services[(host, port)] = banner
                print(f"[+] {host}:{port} - {banner}")
                return True
                
            sock.close()
            return False
        except Exception as e:
            return False
    
    def grab_banner(self, host, port):
        """Attempt to grab service banner"""
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.settimeout(2)
            sock.connect((host, port))
            
            # Send different probes based on port
            if port == 80:
                sock.send(b'HEAD / HTTP/1.0\r\n\r\n')
            elif port == 21:
                pass  # FTP sends banner automatically
            elif port == 22:
                pass  # SSH sends banner automatically
            elif port == 25:
                sock.send(b'HELO test\r\n')
            else:
                sock.send(b'\r\n')
                
            banner = sock.recv(1024).decode().strip()
            sock.close()
            return banner[:100] if banner else "Unknown Service"
        except:
            return "Unknown Service"
    
    def os_fingerprint(self, host):
        """Perform OS fingerprinting using ping TTL analysis"""
        try:
            response = subprocess.run(['ping', '-c', '1', host], 
                                    capture_output=True, text=True, timeout=5)
            
            if 'ttl=64' in response.stdout.lower():
                return "Linux/Unix (TTL=64)"
            elif 'ttl=128' in response.stdout.lower():
                return "Windows (TTL=128)"
            elif 'ttl=255' in response.stdout.lower():
                return "Network Device (TTL=255)"
            else:
                return "Unknown OS"
        except:
            return "OS Detection Failed"
    
    def scan_host(self, host, port_range):
        """Scan all ports on a single host"""
        print(f"[*] Scanning {host}...")
        host_results = {'host': host, 'open_ports': [], 'os': self.os_fingerprint(host)}
        
        with ThreadPoolExecutor(max_workers=self.threads) as executor:
            futures = {executor.submit(self.scan_port, host, port): port 
                      for port in port_range}
            
            for future in as_completed(futures):
                port = futures[future]
                if future.result():
                    service = self.services.get((host, port), "Unknown")
                    host_results['open_ports'].append({
                        'port': port,
                        'service': service,
                        'status': 'open'
                    })
        
        self.scan_results[host] = host_results
        return host_results
    
    def scan_network(self, port_range=range(1, 1001)):
        """Scan entire network range"""
        print(f"[*] Starting network scan of {self.target_range}")
        print(f"[*] Port range: {port_range.start}-{port_range.stop-1}")
        print(f"[*] Threads: {self.threads}")
        print("-" * 50)
        
        # Parse target range
        hosts = self.parse_target_range(self.target_range)
        
        for host in hosts:
            self.scan_host(host, port_range)
        
        return self.scan_results
    
    def parse_target_range(self, target):
        """Parse different target formats"""
        hosts = []
        
        if '/' in target:  # CIDR notation
            import ipaddress
            network = ipaddress.ip_network(target, strict=False)
            hosts = [str(ip) for ip in network.hosts()]
        elif '-' in target:  # Range notation (e.g., 192.168.1.1-254)
            base_ip, end = target.rsplit('.', 1)
            start_range, end_range = end.split('-')
            for i in range(int(start_range), int(end_range) + 1):
                hosts.append(f"{base_ip}.{i}")
        else:  # Single host
            hosts = [target]
            
        return hosts
    
    def save_results(self, filename=None):
        """Save scan results to JSON file"""
        if not filename:
            timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
            filename = f"scan_results_{timestamp}.json"
        
        with open(filename, 'w') as f:
            json.dump(self.scan_results, f, indent=2)
        
        print(f"[+] Results saved to {filename}")

def main():
    parser = argparse.ArgumentParser(description="Advanced Network Scanner")
    parser.add_argument("target", help="Target IP, range, or CIDR (e.g., 192.168.1.1, 192.168.1.1-254, 192.168.1.0/24)")
    parser.add_argument("-p", "--ports", default="1-1000", help="Port range (e.g., 1-1000, 80,443,8080)")
    parser.add_argument("-t", "--threads", type=int, default=100, help="Number of threads")
    parser.add_argument("-o", "--output", help="Output file for results")
    parser.add_argument("--timeout", type=int, default=1, help="Socket timeout in seconds")
    
    args = parser.parse_args()
    
    # Parse port range
    if '-' in args.ports:
        start, end = map(int, args.ports.split('-'))
        port_range = range(start, end + 1)
    elif ',' in args.ports:
        port_range = [int(p.strip()) for p in args.ports.split(',')]
    else:
        port_range = [int(args.ports)]
    
    # Initialize scanner
    scanner = NetworkScanner(args.target, args.threads, args.timeout)
    
    # Start scanning
    start_time = time.time()
    results = scanner.scan_network(port_range)
    end_time = time.time()
    
    # Print summary
    print("\n" + "="*50)
    print("SCAN SUMMARY")
    print("="*50)
    print(f"Scan completed in {end_time - start_time:.2f} seconds")
    print(f"Total hosts scanned: {len(results)}")
    
    total_open_ports = sum(len(host_data['open_ports']) for host_data in results.values())
    print(f"Total open ports found: {total_open_ports}")
    
    # Save results
    if args.output:
        scanner.save_results(args.output)
    else:
        scanner.save_results()

if __name__ == "__main__":
    main()

# Custom vulnerability check example
def check_eternal_blue(host, port):
    """Check for EternalBlue vulnerability"""
    if port == 445:  # SMB port
        # Implementation for EternalBlue detection
        return run_eternal_blue_check(host)
    return False