Portscanning for Kazaa using C# Sockets

I recently discovered that the popular P2P file sharing app, known as Kazaa, runs on port 1214 (by default). Based on this information, one can write a program that attempts to connect to a host computer on port 1214, and based on the results, determines if the host IP is running Kazaa.

This is relatively easy to do If you have a basic understanding of the System.Net.Sockets namespace, and the associated objects (such as TCPClient, IPHostEntry, IPAdress, TCPListener, Socket, etc.)

Here is a program I came up with to attempt to access a host computer on port 1214:

KazaaScan.cs 

//////////////////////////////////////////////////////////////////////////////

// Program Scans if computer behind IP Adress is running Kazaa on port 1214  /

// By Jim Peterson, 2006                                                     /

//////////////////////////////////////////////////////////////////////////////

 

using System;

using System.Net.Sockets;

using System.IO;

using System.Text;

 

    class KazaaScan

    {

        public bool repeat = true;

        static void Main(string[] args)

        {

            bool sucess;

            String response = "";

 

                try {

                    TcpClient myTCPclient = new TcpClient();

                    Console.Write("Enter IP of Target: ");

                    String IP_Adress = Console.ReadLine(); Console.WriteLine("");

                    myTCPclient.Connect(IP_Adress, 1214);

                       

                        Stream outputStream1 = myTCPclient.GetStream();

 

                        ASCIIEncoding transEncoded = new ASCIIEncoding();

                        byte[] byte1 = transEncoded.GetBytes("Are You Kazaa?");

                        outputStream1.Write(byte1, 0, byte1.Length);

                      

                        byte[] byte2 = new byte[100];

                        int k = outputStream1.Read(byte2, 0, 100);

 

                        for (int i = 0; i < k; i++) {

                            response = response + Convert.ToChar(byte2[i]);

                        }

 

                    myTCPclient.Close();

 

                    if (response != "")

                    {

                        sucess = false;

                    } else {

                        sucess = true;

                    }

                   

                }

                catch {

                    sucess = false;

                }

 

            if (sucess) {

              Console.WriteLine("\nThe Target Is Running Kazaa");

            }

            else {

              Console.WriteLine("\nThe Target Is NOT Running Kazaa");

            }

 

            String waitForKey = Console.ReadLine();

       }

    }

 

So, lets test our program. To do this, I wrote a simple server that sits on port 1214, and receives a bunch of bytes, and then sends back some bytes as a response.

NOTE: The client program should not register this server as a computer running Kazaa, because it sends a reply. When you send a weird string to an instance of Kazaa running on port 1214, it immediately disconnects you. Hence, if you get a response, it is not Kazaa you connected to.

Here is the code I wrote for the fake Kazaa server:

FakeKazaa.cs

/////////////////////////////////////////////////////////////////////////////////////////

// A useless server to sit on port 1214 and wait for a connection, to fake the existance

// of Kazaa.

// I will attempt to make the client program realize it is fake, and not identify this

// server as Kazaa.

// Jim Peterson, 2006

/////////////////////////////////////////////////////////////////////////////////////////

 

using System;

using System.Text;

using System.Net;

using System.Net.Sockets;

 

public class FakeKazza

{

 

    public static void Main()

    {

 

        String IP_Adress = "";

        IPHostEntry localComputer = Dns.Resolve("localhost");

 

        IPAddress[] localIP = localComputer.AddressList;

 

        for (int i = 0; i < localIP.Length; i++) {

            IP_Adress = IP_Adress + localIP[i];

        }

 

        while (true) {

            try {

                IPAddress ipAd = IPAddress.Parse(IP_Adress);

                TcpListener listener1 = new TcpListener(ipAd, 1214);

 

                listener1.Start();

 

                Console.WriteLine("Fake Kazaa is running on portt 1214...");

 

                Socket s = listener1.AcceptSocket();

                Console.WriteLine("Connection accepted from this IP: " + s.RemoteEndPoint);

 

                byte[] b = new byte[100];

                int k = s.Receive(b);

                Console.WriteLine("Recieved a bunch of byytes:");

 

                    for (int i = 0; i < k; i++) {

                       Console.Write(Convert.ToChar(b[i]));

                    }

   

                ASCIIEncoding asen = new ASCIIEncoding();

                // Only send these bytes if you want the scanner to identify that

                // you are not Kazaa

                s.Send(asen.GetBytes("OK, I recieved your bytes"));

                Console.WriteLine("\nI sent the client aknowledgement");

 

                s.Close();

                listener1.Stop();

 

            }

 

            catch (Exception e) {

                Console.WriteLine("Ah, poo, an error: " + e);

            }

        }

    }

 

}

 

So, when we run the server, and then tell the client to scan "localhost", we should get the output:

The target is NOT running Kazaa.

Good! It works. Try commenting this line out of the server code:

s.Send(asen.GetBytes("OK, I recieved your bytes"));

And the result should be that the target is indeed running Kazaa.

Although this is not enough proof for law enforcement to convict people of stealing music, it is a good way to gather statistics about how many people use Kazaa.

To extend the functionality of this application, try having it scan a whole bunch of IP addresses, such as every IP in Massachusetts, and report back how many of them were running Kazaa in the form of a percentage.

(NOTE: be careful when scanning a large amount of IP addresses. Many ISPs will cancel your internet service, because they don't like that kind of thing.)

Have fun,