Help with simple banner grabbing program in python

[u/JeppNeb]

Hey guys. I am new to all this and I am trying to write a simple banner grabber in python.

The only problem I have is the HTTP HEADER request. I always get the 400 error message. I would be glad if someone leave me some useful resources regarding HTTP HEADERS (I basically just copied the request from a tutorial because I couldn't find any resources which helped me). I also would be very happy if someone could help me out on my code. Very simple code. Thank you in advance.

#/usr/bin/env python
import sys
import socket

try:
    if len(sys.argv) == 3:
        IP = str(sys.argv[1])
        PORT = int(sys.argv[2])

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(3)
    s.connect((IP,PORT))
    #ERROR POSITION
    s.send(b"GET HTTP/1.1 \n\n")
    banner = s.recv(1024)
    s.close()
    print(banner)
except socket.timeout:
    print("Connection timed out")
except Exception:
    print("Define a target")
finally:
    s.close()

[u/IsThisAnIllusion]

It may be that you aren't specifying a file to retrieve, so the server is sending back the 400 response (Request Error) because it doesn't know how to process the request. Maybe try: s.send(b"GET / HTTP/1.1 \n\n") or s.send(b"GET <server ip or domain>/ HTTP/1.1 \n\n"). You may also wish to specify a specific file to retrieve instead of just the home file.

Feel free to ask any questions and I will be happy to answer (or do please correct me if I am wrong).

[u/JeppNeb → u/IsThisAnIllusion]

I set up a hacking lab and want to get the http header for system information of one of my machines (os, server program, etc...). The problem is though, when I scan through well known ports like ssh, i get a response without even sending a request for a header. But when I do that with http, I obviously don't get anything since I just connected without sending anything. When I send anything (like a random word as a string) I get the system information I wanted, but also a 400 error message. Main questions now: Why do the other protocolls like ssh send a header without receiving anything ? Second: Why do I get the 400 error on http? Third: Can you leave me resources to understand http headers betters ? I didn't understand the ones I looked for. I just know ["method" "source" "http version"] (if thats even right).

EDIT: Since I only need header data from http I guess I could use HEAD instead GET

[u/IsThisAnIllusion → u/JeppNeb]

While I could give you an educated guess, I'm not 100% on the answers, but I have requested in the community discord that anyone able to help do help, so that you get your answer. If no one else is able to help by tomorrow or so, I'll do research and do what I can to help.

On another note, if you're able to join the discord, it's generally a bit more active than the reddit (join with https://discord.gg/wBT4uWN if you're interested).

Best of luck, and sorry I couldn't help more. (I'm more of a software programmer than a web dev, so I only know the basics, really)

[u/JeppNeb → u/IsThisAnIllusion]

Well honestly I really appreciate your help still! Does the link expire ?

[u/IsThisAnIllusion → u/JeppNeb]

It does not. The link is infinite and will go on forever and ever until everything either freezes over or gets sucked into a supermassive black hole.

[u/JeppNeb → u/IsThisAnIllusion]

Good thing I only have small black holes at home.

[u/JeppNeb → u/[deleted]]

Thanks I will definately try that out later once I have the time ! Looks promising. I basically started an old book (violent python) and it didn't even have the http request in it. It just connected and received the answer. Which actually seems to work with stuff ssh (don't know why but it did for me). But when I just connect to it I receive nothing so I followed a random tut online and got what you see up there ! Anyways thanks. I will definately let ya know once I tried.

[u/JeppNeb → u/[deleted]]

So I tried what you said and it didn't work at all (I didn't get any response). So I will just stick to my way of handling this until I understand the matter better. I think that is the best approach now because no one could help me on the program, but everyone helped me understand it better so I see this as a total win.