看到了从0到1上面的一个扫描内网端口的脚本，实际上Nmap也能做到这件事情，拿过来抄抄改改了一下。

# encoding utf-8
import requests
import time

ports = ['80', '3306', '8080', '8000']
session = requests.session()
for i in range(255):
    ip = '192.168.xxx.%d' % i
    for port in ports:
        url = "http://example.com/?url=http://%s:%s" % (ip, port)
        # url = "http://%s:%s" % (ip, port)
        try:
            response = session.get(url, timeout=3)
            if len(response.content) > 0:
                print(ip, port, 'is open')
        except:
            continue
print('DONE')

常见端口：

21
22
23
25
69
80
110
443
1080
1158
1433
1434
1521
2100
3128
3306
3389
6379
7001
8080
8081
9080

当然nmap相对来说还是更香一点~