IDC资讯中心
这几天做asp.net追捕，也算是我入门吧。思路很简单，主要就是识别远程主机传回的banner，判断远程主机服务器。这可能不够准确，因为合格的管理员可能会去修改banner。
代码如下（从我的web追捕里找出来的，用vb.net）
dim swwriter as streamwriter
用以向网络基础数据流传送数据
dim nsstream as networkstream
创建发送数据的网络基础数据流
dim tcpclient2 as tcpclient
通过它实现向远程主机提出tcp连接申请
dim shostname as string
dim srread as streamreader
从网络基础数据流中读取数据
http服务追捕
if tcpconnect(zsip, 80) = “cg” then
opphttp.text = “http服务已开启！服务软件类型：未知”
try
tcpclient = new tcpclient(ipaddress, port)
tcpclient2 = new tcpclient(zsip.tostring(), 80)
tcpclient2.receivetimeout = 1000000
tcpclient2.sendtimeout = 1000000
对远程主机的8000端口提出tcp连接申请
nsstream = tcpclient2.getstream()
通过申请，并获取传送数据的网络基础数据流
swwriter = new streamwriter(nsstream)
swwriter.writeline(“get /index.htm http/1.1”)
swwriter.writeline(“host:” & ip.text)
swwriter.writeline(“accept:*/*”)
swwriter.writeline(“referer:”)
swwriter.writeline()
刷新当前数据流中的数据
swwriter.flush()
srread = new streamreader(nsstream, encoding.default)
以得到的网络基础数据流来初始化streamreader实例
dim l as integer = 0
do while not srread.peek = -1 and l < 20
strhttp = strhttp & srread.readline()
l = l + 1
loop
if instr(strhttp, “iis”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：iis 版本未知”
systemfw = “windowsnt/2000/xp/2003”
end if
if instr(strhttp, “apache”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：apache 版本未知”
end if
if instr(strhttp, “netscape-enterprise”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：netscape-enterprise 版本未知”
end if
if instr(strhttp, “microsoft-iis/5.0”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：iis 5.0”
systemfw = “windows2000”
end if
if instr(strhttp, “microsoft-iis/5.1”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：iis 5.1”
systemfw = “windows2000/xp”
end if
if instr(strhttp, “microsoft-iis/6.0”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：iis 6.0”
systemfw = “windows2003”
end if
if instr(strhttp, “apache/2”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：apache 2.x”
end if
if instr(strhttp, “apache/2.0.54”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：apache 2.0.54”
end if
if instr(strhttp, “apache/2.0.52”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：apache 2.0.52”
end if
if instr(strhttp, “apache/2.1.6”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：apache 2.1.6”
end if
if instr(strhttp, “apache/1.3.2”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：apache 1.3.x”
end if
if instr(strhttp, “apache/1.3.20”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：apache 1.3.20”
end if
if instr(strhttp, “apache/1.3.23”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：apache 1.3.23”
end if
if instr(strhttp, “apache/1.3.26”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：apache 1.3.26”
end if
if instr(strhttp, “apache/1.3.27”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：apache 1.3.27”
end if
if instr(strhttp, “apache/1.3.33”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：apache 1.3.33”
end if
if instr(strhttp, “netscape-enterprise/4.1”) > 0 then
opphttp.text = “http服务已开启！服务软件类型：netscape-enterprise 4.1”
end if
if instr(strhttp, “unix”) > 0 then
systemfw = “类unix/linux系统”
end if
catch
end try
因为是摘出来的，所以有的变量没有定义，大家自己去琢磨吧。
zsip：分析出的真实ip
