There is another powerful edition that we have at our disposal
from the modules of Metasploit, and that's the different types
of scanners that are available.
While there are many different auxiliary modules that
have a variety of different scanners,
we'll look at an abstract concept with the scanners.
This concept will follow in line with our process of mapping the attack surface.
This process will fall in line with mapping the attack surface
in preparation for attacking machines and/or networks. Our first
step here is to locate the ports.
Remember, the ports are the open doors into the system.
We need to have some method, or more accurately,
a vector, to get access to the machine, and this all starts with the door,
which is represented by a port on the machine.
This door or port can either be TCP, Transmission Control Protocol,
or UDP, User Datagram Protocol, depending on the design and configuration,
and this is used to access the services on the machine.
These are represented by what is currently running on the
port that we discovered open on the machine.
These two main scanners allow us to map the attack surface, and from
there perform our different types of vulnerability analysis and look for
a weakness that will provide us access. But we also have the protocol,
and this has many options within it,
HTTP, MySQL, Microsoft SQL, NetBIOS, Secure Shell, Server Message Block,
you name it, we have different types of scanners that are protocol‑specific,
which gives us, again, a lot of capability within the tool.
But then we have another option that shows the extreme versatility
of the Metasploit tool, which provides us the capability to write
our own scanners, and that is the custom capability. With
Metasploit being written in Ruby,
it is extensible, and there are templates that provide us
the framework to create and write our own, not only
scanner module, but any module.
And again,
that's a powerful capability when you can custom and build your own modules
and scanners for your ongoing work and/or assessments.
This brings us to our demo.
In this demonstration,
we're going to look at the extensive type of scanners that we
have within the Metasploit tool. Enjoy the demo.