The Metasploit Framework can be used in scanning assets on a target network.
You can utilize the included auxiliary modules for
both broad and targeted scanning.
There are also third‑party scanning tools that integrate with the framework.
First,
the Metaploit Framework includes auxiliary modules
for a variety of scanning needs.
In my version of the framework, there are 573 scanning modules,
so there are a lot of options. To identify live systems on a
local network, you can use the arp_sweep module to send ARP
requests or ipv6_neighbor module,
which uses the IPv6 Neighbor Solicitation Protocol. Network port scanning
identifies what network service ports are open on a target system.
Metasploit includes the syn scan module to send probe packets with the
synchronize flag set, the tcp scan module to use the TCP three‑way
handshake to identify open ports, and the udp_sweep module to find common
and more interesting UDP ports in use. Metasploit can also scan network
services. Here are just a few of the service scanning modules for
identifying software versions.
There are FTP, HTTP, SMB, and SSH version scanners.
These are protocol specific.
There are also many software‑specific scanning modules as well.
While there are auxiliary modules for scanning included with the Metasploit
Framework, Nmap is a tool outside of Metasploit that does a better job at
network scanning. Nmap can run separately from Metasploit,
and its data can be imported into the Metasploit database. Nmap
can also be used from inside the console.
There's a special command that executes Nmap and directly
incorporates the scanned data into the database.
Once the Nmap scanned data is in the Metasploit database,
it becomes very useful to us.
We can search the database for detected hosts and services.
We can craft very specific queries to find the data we need.