Check your own ports and IP reputation

1.Ground rules

Only check computers you own or have written permission to test. Probing other people's systems can be against the law, even out of curiosity. Everything below points at your own machine (127.0.0.1) or looks addresses up in public services.

2.Understand an address

Before looking anything up, work out what kind of address you have. These helpers are pure maths, so they run here too.

import net

for ip in ["192.168.1.20", "203.0.113.42", "127.0.0.1"] {
  say(ip, "private:", net.is_private(ip), "loopback:", net.is_loopback(ip))
}
say(net.in_cidr("10.20.30.40", "10.0.0.0/8"))
say(net.cidr_info("192.168.1.0/24").size, "addresses in a /24")

3.Which ports are open on my computer?

net.check_ports tries to connect to each port and gives back a map of port to true or false. net.common_ports knows what usually runs where.

Desktop code: save it as a .tb file and run it with the TB app.

import net

let ports = [22, 80, 443, 3306, 5432, 8000, 8080]
let open = net.check_ports("127.0.0.1", ports, 0.5)
for port in ports {
  if open[port] {
    say(f"{port} open ({net.common_ports.get(port, "unknown")})")
  }
}

4.What is listening?

Many services say hello when you connect. net.banner reads that first line.

Desktop code: save it as a .tb file and run it with the TB app.

import net

if net.tcp_check("127.0.0.1", 22) {
  say(net.banner("127.0.0.1", 22))
}

5.Look up an address's reputation

AbuseIPDB and VirusTotal keep track of addresses that attack people. Get a free API key from each and set it as the ABUSEIPDB_API_KEY or VT_API_KEY environment variable; intel.key_help() explains how.

Desktop code: save it as a .tb file and run it with the TB app.

import intel

let ip = "203.0.113.42"
if intel.has_key("abuseipdb") {
  let r = intel.abuseipdb(ip)
  say(f"AbuseIPDB: {r.verdict}, score {r.score}")
}
if intel.has_key("virustotal") {
  let v = intel.virustotal_ip(ip)
  say(f"VirusTotal: {v.verdict}, score {v.score}")
}
if not intel.has_key("abuseipdb") and not intel.has_key("virustotal") {
  say(intel.key_help())
}

Where next

The Port check app wraps steps 3 and 4 with safety checks built in, and IP reputation looks up any mix of IPs, domains, URLs and hashes. See the net, http and intel references.