Once a target system is scanned and services have been identified,
we need to understand more about the vulnerabilities it may contain.
Vulnerability scanning techniques help identify those vulnerabilities
for later stages in the testing process.
Because the Metasploit Framework is primarily an exploitation framework,
there aren't specific modules in Metasploit for general vulnerability scanning.
However, there are still ways to find vulnerabilities.
Auxiliary modules can detect if a specific service does not require
authentication. These are wide‑open services that could reveal lots of
interesting data or access into a system.
Acquired user credentials can be tested using several auxiliary login modules.
Some of the exploit modules have check functions that determine
if the target has a specific vulnerability.
Metasploit integrates with third‑party vulnerability
scanners. Metasploit can import scan data,
create and configure scans, and manage, start, and stop those scans.
So not only can Metasploit take advantage of the data produced by these tools,
it can also interact with them directly from the Metasploit
console. The Metasploit Framework includes integration with open
source vulnerability scanning tools.
Sqlmap is a penetration testing tool for finding exploiting SQL injection
and take over database systems. WMAP is a derivative of sqlmap and is
focused on web application security vulnerabilities.
OpenVAS is a vulnerability scanning platform.
Each of these tools has a community of developers, contributors, and users.
The integration with Metasploit makes them easy to take
advantage of their capabilities and enhance our testing work.
In the vulnerability scan tool market,
there are several big players. Metasploit integrates with two of them today.
Tenable Security has their Nessus platform.
Rapid7 has their Nextpose platform.
Both of these tools can be integrated with Metasploit to gather
vulnerability information on target systems.