#!/bin/bash
#=====================================================
# 端口扫描脚本 - 快速扫描目标主机开放端口
# 来源: 整合自 HariSekhon/DevOps-Bash-tools
# 用法: ./port-scanner.sh <IP/域名> [起始端口] [结束端口]
# 示例: ./port-scanner.sh 192.168.1.1 1 1024
#=====================================================

HOST=${1:-127.0.0.1}
START_PORT=${2:-1}
END_PORT=${3:-1024}

GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

if ! command -v nc &>/dev/null && ! command -v bash &>/dev/null; then
    echo "错误: 需要 nc (netcat) 或 bash /dev/tcp 支持"
    exit 1
fi

echo -e "${GREEN}========================================${NC}"
echo -e "${GREEN}  端口扫描: ${HOST} (${START_PORT}-${END_PORT})${NC}"
echo -e "${GREEN}========================================${NC}"
echo ""

OPEN_COUNT=0
START_TIME=$(date +%s)

# 常见端口服务映射
declare -A PORT_SERVICE=(
    [21]="FTP" [22]="SSH" [23]="Telnet" [25]="SMTP"
    [53]="DNS" [80]="HTTP" [110]="POP3" [143]="IMAP"
    [443]="HTTPS" [993]="IMAPS" [995]="POP3S"
    [3306]="MySQL" [5432]="PostgreSQL" [6379]="Redis"
    [27017]="MongoDB" [8080]="HTTP-Alt" [8443]="HTTPS-Alt"
    [9090]="WebUI" [9200]="Elasticsearch" [11211]="Memcached"
)

# 使用 /dev/tcp 扫描（bash内置，无需额外工具）
scan_port() {
    local host=$1 port=$2
    timeout 1 bash -c "echo >/dev/tcp/$host/$port" 2>/dev/null
}

echo "扫描中..."

for ((port=START_PORT; port<=END_PORT; port++)); do
    if scan_port "$HOST" "$port"; then
        OPEN_COUNT=$((OPEN_COUNT + 1))
        SERVICE="${PORT_SERVICE[$port]:-}"
        if [ -n "$SERVICE" ]; then
            echo -e "  ${GREEN}[开放]${NC} 端口 $port  ${YELLOW}($SERVICE)${NC}"
        else
            echo -e "  ${GREEN}[开放]${NC} 端口 $port"
        fi
    fi
done

END_TIME=$(date +%s)
DURATION=$((END_TIME - START_TIME))

echo ""
echo -e "${GREEN}========================================${NC}"
echo "  扫描完成: 发现 ${OPEN_COUNT} 个开放端口"
echo "  耗时: ${DURATION} 秒"
echo -e "${GREEN}========================================${NC}"