[No audio]
Let's move on to talk about another scripting
environment. In fact, the next environment, Ruby
is much more than just a scripting environment. It
is a full blown high level language. It was
originally developed and designed in the 1990s,
and it has gained a lot of popularity. It's object
oriented, and it gives us way more functionality
than we'll ever need as pen testers. But it does
make it possible to create a very nice and elegant
level of shell scripting that's very powerful, and
very, very compact. As with other languages, many
of the constructs we use are similar, and
we'll line them up side by side to see what the
minute differences may be. But the best way to talk
about Ruby is to jump right in, let's take a port
scanner written in Ruby, and see what it looks
like. We'll run some real Ruby code. So here is our
port scanner written in Ruby. It's very similar
to the other port scanners that we've already
looked at. But it's written of course, in a
different language. The very first line is this
shebang line, similar in some ways to the shebang
line from bash, but this time, it tells the
interpreter to use ruby to interpret this code.
The next line is require socket, now this is a
nice feature that we can just import a socket
library. So we don't have to write all the
functionality or assume that it's native in the
language. We can simply import a library and
then use whatever that library maintains. Then we
assign three variables, TARGET, MINPORT, AND MAXPORT,
and actually, in Ruby, any variable that
starts with a capital is a constant. So once we
set it, we're not going to change it. we're going
to say that TARGET is equal to ARGV 0, that
simply means it's the first argument that was
passed in on the command line. Most languages are
zero based, so when you deal with arrays, the
first element is zero, it's the zeroth element.
The second element is elements of one. So you have
to be careful when you're dealing with any type of
array whether your language is zero based, or one
based, because you can be off by one and count
wrong if you're not careful. But in this case, ARGV 0
is the TARGET, is the IP address. The two
vertical bars tell us, if ARGV 0 is blank,
let's assign it a value, a default value of
10.10.1.10, and the same thing, our minimum port, if
ARGV 1 is blank, we're going to give it a seed
value or default value of 22, and MAXPORT is 80,
if we don't provide anything. Then we go into our
loop. First thing we do is we sign on a variable i
is equal to MINPORT, but what's this to_i?
MINPORT by default becomes a character variable. Ruby
does use data typing, so you've got to be careful
about what data type you use. Since we assign MINPORT
to be a character variable, because user
typed something into the terminal, we have to
actually convert it to an integer, and that's what
the to_i method actually does. Also, notice that
Ruby is an object oriented environment, that means
that everything is pretty much an object. So
instead of running commands to modify things, we
actually invoke attributes or methods. So that's
kind of a really big, deep topic. But be aware
that when you get into languages like Ruby, you're
going to start seeing things, such as a data item dot
something, and most of the times the dot
something is probably a method, which is a
function that operates on the object. So what this
really means is, I have an object, I have a
variable called MINPORT. When I say '.to_i', I'm
going to run the to_i or the to integer function
on MINPORT, and all that does is it converts the
value of MINPORT into an integer value and stores
the result in the variable i, and that let's us
loop through while i is less than or equal to MAXPORT integer
do and so we're just looping through
for MINPORT to MAXPORT. We grab a new socket. If
we get a new socket, the status is open, and then
we're going to output the fact that it is open,
and that's what puts does. puts says or actually
stands for put string. So we get down to line 14,
puts string would actually output to the terminal
Port i is status and status is open at this
point. rescue is what happens if there's an error.
See this is a little bit different than what we saw
in earlier scripts. We didn't have much error
processing. In this case, we say what if the
connection refused? Well, the connection is refused,
I can really just do nothing, but I'm gonna go
ahead and assign status equals closed, and then I
increment i and move on. Now, you'll notice that
there's no reason to say status is closed because
I never use it, which is true. I just did it, just
to show you that the status is closed. All right,
all that's left is to run this thing. So let's
type in ruby
[No audio]
portscan.rb, and what do I need to pass it?
Let's say 10.10.1.10 22 and 80. Those
are the defaults, and we're done pretty fast,
and we can actually change these values and
not use the defaults. So let's try 20, and I'm
actually going to hit another machine, and there
we go. So for Port 10, or for IP address 10.10.1.11,
Ports 21, 22, and 80 are open. But we didn't see
23, 25, and 53, like we did on the .10 machine. So
that's a high level lightning round look at Ruby.
Ruby is a pretty cool language. I wouldn't
recommend it to be the first language because it's
elegant, it's object oriented, and there's a lot
of functionality that you may not need. My
suggestion would be pick one of the languages out
of these four that is most comfortable for you,
the one you like and really focus on that one is
the language you use, and then just be aware of
how to read scripts written in other languages.
You always want to be able to open up a ruby
script and understand what it's trying to do.
That's really the whole key, not to be a Ruby
developer, but to be able to understand what the
ruby script developer was trying to do in the first place.
[No audio]