In this demonstration,
we're going to look at the power of scanners within Metasploit.
These scanners are located in the auxiliary module area.
Scanners and most other auxiliary modules use the RHOSTS option,
instead of RHOST, and RHOSTS can take IP ranges,
and this makes sense since when you think about it,
we're going to a scan look at multiple machines in most cases.
By default, all the scanner modules will have threads value set to one.
That threads value sets the number of concurrent tasks.
This is something you might want to increase to improve your scans as you'll
see as you start experimenting with the different scanners.
If it's a Windows system, keep it under 16.
On UNIX‑like operating systems, you can go as high as 256.
In our auxiliary module, we have different categories.
So if we actually do a search for auxiliary here,
we see all the different auxiliary modules and there are lots of them,
and you see under these modules,
they have different types and you see their auxiliaries,
code execution, buffer overflow, extractor so you get the idea.
So what we want to do is we just want to actually go into the actual folder for
the modules like we've done it before and take a look at it.
So we'll clear to get to the top of the screen,
the ls the modules,
so let's change our ls to cd here and put auxiliary on the end.
So we just put the auxiliary on the end and then we do our ls.
And we saw all our different auxiliary modules.
Now the modules we want, of course,
is the scanner so we just cd scanner and we see all
our different types of scanners.
Now there are lots of scanners in here,
way too many scanners for us to cover in any type of demonstration.
So we're just going to look at a couple here and then look at some powerful
ways you can integrate with other pretty popular tools.
So from here,
we'll do a cd portscan and then we look at our different types of
scans and you see here we've got a syn scan,
a tcp scan, and the xmas scan so different types of port scans that we can do.
But really the main thing we want to do is look at
some of the module capabilities.
So we do a search of portscan here, there is our different port scanners.
As you see here, we've got a bounce scanner and the different types of scans,
so we'll look first at the TCP scan.
So the TCP scan is use 5, so as always info and you see here this is actually a,
down here in the description,
Enumerate open TCP services by performing a full TCP connect on each port.
And it, very important here,
does not need administrative privileges on the source machine,
that might be useful in pivoting.
Now what pivoting is is when we get to one machine,
it might be connected to another network via another network card.
So if we're going to test that network,
we call it a pivot because we're pivoting from that first
machine and go into the next machine, and that's the concept of pivoting.
Okay.
So now what we want to do is, let's clear screen to get to the top,
show our options, and we see the RHOSTS is what we set.
So we're going to set RHOSTS, and we'll do it for our entire subnet here,
but remember, by scanning for a subnet, it's going to slow it down.
So we set the whole RHOST subnet, and then for our purposes,
we're going to lower the port range,
and we're going to lower the port range just so we get some
information back and it doesn't actually take as long,
so we said 135‑445 because we know 445 was that vector of attack.
It's still going to be slower than you're probably used to.
Now, you see the number of current threads is one.
So if we set the threads, we'll say 5 just as an example.
Once we've set those and we've looked at it,
we're pretty much ready to run the module and exactly the most common way to
do an actual module is just type run and then it runs.
Now remember, we're scanning an entire subnet,
even they'll reduce the actual number of ports and we actually
put the threads in and those types of things,
it's still not very efficient and that's why the first
step is to identify live systems.
Once you've identified the live systems, then you look for the ports.
So you see it's taken quite a bit of time here just to get started and stuff
like that and that's the way this process kind of works.
So what we'd rather do instead, as I said,
is find another method and that method is to identify specific machines.
So we'll give it a minute here or two just give you an idea of,
yes, I mean it is possible,
but it does take some time to run a scan for an
entire subnet and stuff like that.
So instead, what we recommend,
so we'll break it here and we'll clear it to the top,
we're going to set RHOSTS as one machine and we'll just
scan our one target because remember,
any time you have defensive and play stuff like that,
a scan like that across all subnets is going to get you alerted,
they'll alert and they'll catch you and all that type of stuff.
So now what we do is we set the RHOSTS and now we just run the
scan and you see immediately it comes back.
We wanted to show you how efficient it is when you find the live systems,
that's critical here.
Once you find the live systems,
now you just go in there and you look for the attack surface and
that's how you do it as a professional tester.
Now, as a reminder, that attack surface is always what we're looking for,
that attack surface are those doors or open ports and then
what services they are and stuff like that.
So these are different types of things.
So you see, if you find the live systems first, it works much better.
And then we have the send scan, you have other scans on there you can research,
but what we want to do now is show you the fact that nmap
you can run from within Metasploit, but also they have db_nmap.
So we're going to use nmap first.
So if we use nmap and we go ‑v ‑sV,
and then we do that subnet 192.168.177.0/24 ‑o for
output and we're going to say all, give us all output,
and then we're going to give it a name and this is important
when we start using databases here momentarily.
So we're going to give it a ClassC‑scan and then ‑n so it
doesn't do a DNS reverse lookup and there it goes.
Now we did verbose so it's going, it's giving us information,
showing us information that it's discovered,
open ports, information, stuff like that,
and it's going to give us information that we can use in our output,
and that output always is the deliverable,
that deliverable for the client,
that's a report and that's kind of how we always want to do this.
We want to make sure we're doing this to the point of a professional engagement.
This is a common method of actual scanning.
Now db_nmap works exactly the same way and you just run
db_nmap in the same command and it works the same way and
this is the process of how you do it.
So you see here, it's going doing different things.
Now nmap, by default,
is doing 1000 ports so that's going to actually
take a little bit of time as well.
But once you have the live systems as we said,
that's a much more efficient scan,
and once you have an efficient scan is you see here right now,
we have, of course, we had the 131, that was our Windows 7.
We also have .1 and .2, which is actually my host machine, but that's okay.
So we have three hosts here.
So once this gets done, we'll tune it and we'll do a comparison.
So you see there, it finished at 85.95 seconds.
Now we're going to clear that and we're going to do it again,
and this time, we're going to use our targets,
so 1,2,131, and now we're going to add this and call it tuned.
So now we're tuning our scan to specifically look,
so we had like 90 seconds roughly,
so now let's see how much faster it is when we give it
a specific actual range of target.
So it sees .1, but .1 has the firewall on as you noticed there.
See how it says host down, that's because nmap pings the target first,
unless we tell it not to ping the target,
in this case we didn't, so it's trying to ping the target,
it didn't ping the target so it's not going to scan the target.
And we see 61 seconds, but now it was a little bit better,
but what we want to show you now is because we've
been doing this type of scanning, we can actually import the XML file.
So when we did that ‑o output all, we have an XML file.
So if we do the hosts command and the help,
this shows you how you can set up different options and look at
specific information within the actual tool.
So if we do a db_import scan classC‑tuned,
we can do a hosts ‑R, we'll just bring them in that way.
So you see there we got the Windows 7 Professional,
we've got a Linux,
we've got different types of things so we got information there.
Now that we've cleared our screen, let's do our import.
So it's a db_import and then the name of the file .xml.
Don't forget your extension.
And there you see now it's imported to different machines,
Intellij successfully imported it.
So now if we do a hosts ‑, just a host,
there is all our host machines that we have now here and then we clear
it to get to the top and we do an actual services,
there is all the services and the IP address.
Now remember, it's important to understand that's the data,
that's the data that you're going to use to create your
deliverable report and that's how the process works.
And the last thing we'll do here is we'll do db_nmap to
just show you it's the same type of thing.
So we'll do a half open scan, a syn scan,
and we'll do it against the WannaCry box,
so the 192.168.177.131.
And as you see, it runs nmap the same exact way,
it's just a db_nmap, and by running db_nmap,
it's already put into the database and that's a powerful way to do it as well.
Everybody has different preferences, use which one works for you.
And with that,
we've accomplished our goal of showing you some of the scanning
capability and the scanners inside of Metasploit.
Remember, there is a lot more than this and you're encouraged to explore those.
And with that, we'll conclude the demonstration here.