因此，我想以我对 python 很陌生...我正在尝试从复杂对象中访问值来作为开头。在 for 循环中使用 for 循环时，我不断收到错误，例如...
TypeError：对象不支持赋值
或者
AtributeError：“str”对象没有属性“syn”
...我认为这是由于在第 #1 节中对 scan.results 对象的分配connect(packet.s或类的不正确构造。在方法connect_scan_exist的 #2 区域中，我们可以看到访问 value.flags.XX 的问题。我认为这是由于我构建字典中使用的支持类对象的方式。
方法
# determine if a connect scan takes place
def connect_scan_exist(packets):
s = scan()
# 1. 抓取所有 TCP syn
for key, value in packets.items():
# add tcp packets with syn that are not already entered
if ( value.packet_type == 'TCP'
and value.source_ip
and value.destination_ip
and value.destination_port
and value.flags.syn
and value.flags.ack == False
and value.flags.rst == False
and value.flags.fin == False):
s.results[str(value.source_ip) + '|'+ str(value.destination_ip) + '|' + str(value.destination_port)] = connect(packet.source_ip, packet.destination_ip, packet.destination_port, True, packet.timestamp, None, None, None, None)
# 2. 遍历所有 TCP syn 寻找匹配的 syn/ack
for skey, svalue in s.results.items():
for key, value in packets.items():
# print(len(value.flags))
if ( value.destination_ip == svalue.source_ip
and value.source_ip == svalue.destination_ip
and value.source_port == svalue.destination_port
# and value.scan_categories.is_null_scan ## <---this one works
and value.flags.syn
and value.flags.ack
and value.flags.rst == False
and value.flags.fin == False
and value.timestamp > svalue.source_syn_time
and svalue.destination_synack is None):
# update scan result with cooresponding syn/ack
s.results[str(value.source_ip) + '|' +
str(value.destination_ip) + '|' +
str(value.destination_port)].destination_synack = True
s.results[str(value.source_ip) + '|'+
str(value.destination_ip) + '|' +
str(value.destination_port)].destination_synack_time = value.timestamp
# 3. 遍历所有 TCP syn 寻找匹配的 ack
for skey, svalue in s.results.items():
for key, value in packets.items():
if ( value.source_ip == svalue.source_ip
and value.destination_ip == svalue.destination_ip
and value.destination_port == svalue.destination_port
and value.flags.syn == False
and value.flags.ack
and value.flags.rst == False
and value.flags.fin == False
and value.timestamp > svalue.source_synack_time
and svalue.source_ack is None):
# update scan result with cooresponding syn/ack
s.results[str(value.source_ip) + '|' +
str(value.destination_ip) + '|' +
str(value.destination_port)].source_ack = True
s.results[str(value.source_ip) + '|'+
str(value.destination_ip) + '|' +
str(value.destination_port)].source_ack_time = value.timestamp
# 4. remove all incomplete ? maybe
# 5. analysis
s.scanfound = (True if (len(s.results) > 10) else False)
s.description = 'Very primative observation. Found more than 10 entries starting with TCP Syn'
return s
课程
# define connect scan class
class connect(object):
def __init__(self, src_ip=None, dst_ip=None, dst_port=None, src_syn=None, src_syn_time=None, dst_synack=None, dst_synack_time=None,
src_ack=None, src_ack_time=None):
self.source_ip = src_ip
self.destination_ip = dst_ip
self.destination_port = dst_port
self.source_syn = src_syn
self.source_syn_time = src_syn_time
self.destination_synack = dst_synack
self.destination_synack_time = dst_synack_time
self.source_ack = src_ack
self.source_ack_time = src_ack_time
# define half open scan class
class scan(object):
def __init__(self, scan=False, desc=None):
self.scanfound = scan
self.description = desc
self.results = dict()
# define generic packet class
class generic_packet(object):
def __init__(self, packet_type=None, time=None, src_mac=None, src=None, src_port=None, dst_mac=None, dst=None,
dst_port=None, seq=None, ack=None, flags=None, options=None, data=None):
self.packet_type = packet_type
self.timestamp = time
self.scan_categories = scan_type()
self.source_mac = src_mac
self.source_ip = src
self.source_port = src_port
self.destination_mac = dst_mac
self.destination_ip = dst
self.destination_port = dst_port
self.sequence = seq
self.acknowledge = ack
self.flags = flags # tcp_flags(flags)
self.options = options
self.data = data