这几天做ASP.Net追捕，也算是我入门吧。思路很简单，主要就是识别远程主机传回的Banner，判断远程主机服务器。这可能不够准确，因为合格的管理员可能会去修改Banner。
代码如下（从我的Web追捕里找出来的，用VB.Net）
DimswWriterAsStreamWriter
'用以向网络基础数据流传送数据
DimnsStreamAsNetworkStream
'创建发送数据的网络基础数据流
DimtcpClient2AsTcpClient
'通过它实现向远程主机提出TCP连接申请
DimsHostNameAsString
DimsrReadAsStreamReader
'从网络基础数据流中读取数据
'HTTP服务追捕
IfTcpConnect(ZSIP,80)="CG"Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：未知"
Try
'tcpClient=NewTcpClient(IPAddress,Port)
tcpClient2=NewTcpClient(ZSIP.ToString(),80)
tcpClient2.ReceiveTimeout=1000000
tcpClient2.SendTimeout=1000000
'对远程主机的8000端口提出TCP连接申请
nsStream=tcpClient2.GetStream()
'通过申请，并获取传送数据的网络基础数据流
swWriter=NewStreamWriter(nsStream)
swWriter.WriteLine("Get/index.htmHTTP/1.1")
swWriter.WriteLine("Host:"&IP.Text)
swWriter.WriteLine("Accept:*/*")
swWriter.WriteLine("Referer:")
swWriter.WriteLine()
'刷新当前数据流中的数据
swWriter.Flush()
srRead=NewStreamReader(nsStream,Encoding.Default)
'以得到的网络基础数据流来初始化StreamReader实例
DimLAsInteger=0
DoWhileNotsrRead.Peek=-1AndL<20
StrHttp=StrHttp&srRead.ReadLine()
L=L+1
Loop
IfInStr(StrHttp,"IIS")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：IIS版本未知"
SystemFW="WindowsNT/2000/XP/2003"
EndIf
IfInStr(StrHttp,"Apache")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Apache版本未知"
EndIf
IfInStr(StrHttp,"Netscape-Enterprise")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Netscape-Enterprise版本未知"
EndIf
IfInStr(StrHttp,"Microsoft-IIS/5.0")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：IIS5.0"
SystemFW="Windows2000"
EndIf
IfInStr(StrHttp,"Microsoft-IIS/5.1")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：IIS5.1"
SystemFW="Windows2000/XP"
EndIf
IfInStr(StrHttp,"Microsoft-IIS/6.0")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：IIS6.0"
SystemFW="Windows2003"
EndIf
IfInStr(StrHttp,"Apache/2")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Apache2.x"
EndIf
IfInStr(StrHttp,"Apache/2.0.54")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Apache2.0.54"
EndIf
IfInStr(StrHttp,"Apache/2.0.52")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Apache2.0.52"
EndIf
IfInStr(StrHttp,"Apache/2.1.6")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Apache2.1.6"
EndIf
IfInStr(StrHttp,"Apache/1.3.2")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Apache1.3.x"
EndIf
IfInStr(StrHttp,"Apache/1.3.20")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Apache1.3.20"
EndIf
IfInStr(StrHttp,"Apache/1.3.23")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Apache1.3.23"
EndIf
IfInStr(StrHttp,"Apache/1.3.26")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Apache1.3.26"
EndIf
IfInStr(StrHttp,"Apache/1.3.27")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Apache1.3.27"
EndIf
IfInStr(StrHttp,"Apache/1.3.33")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Apache1.3.33"
EndIf
IfInStr(StrHttp,"Netscape-Enterprise/4.1")>0Then
OppHTTP.Text="HTTP服务已开启！服务软件类型：Netscape-Enterprise4.1"
EndIf
IfInStr(StrHttp,"Unix")>0Then
SystemFW="类Unix/Linux系统"
EndIf
Catch
EndTry
因为是摘出来的，所以有的变量没有定义，大家自己去琢磨吧。
ZSIP：分析出的真实IP
