目前常见的端口扫描技术一般有如下几类： TCP  Connect、TCP SYN、TCP ACK、TCP FIN。

Metasploit中的端口扫描器

　　Metasploit的辅助模块中提供了几款实用的端口扫描器。可以输入search portscan命令找到相关的端口扫描器。如下

root@kali:~# msfconsole

......

msf > search portscan

Matching Modules

================

   Name                                              Disclosure Date  Rank    Description

   ----                                              ---------------  ----    -----------

   auxiliary/scanner/http/wordpress_pingback_access                   normal  Wordpress Pingback Locator

   auxiliary/scanner/natpmp/natpmp_portscan                           normal  NAT-PMP External Port Scanner

   auxiliary/scanner/portscan/ack                                     normal  TCP ACK Firewall Scanner

   auxiliary/scanner/portscan/ftpbounce                               normal  FTP Bounce Port Scanner

   auxiliary/scanner/portscan/syn                                     normal  TCP SYN Port Scanner

   auxiliary/scanner/portscan/tcp                                     normal  TCP Port Scanner

   auxiliary/scanner/portscan/xmas                                    normal  TCP "XMas" Port Scanner

   auxiliary/scanner/sap/sap_router_portscanner                       normal  SAPRouter Port Scanner

msf >

Metasploit中ack扫描模块的使用过程

msf > use auxiliary/scanner/portscan/ack

msf auxiliary(ack) > set RHOSTS 202.193.58.13

RHOSTS => 202.193.58.13

msf auxiliary(ack) > set THREADS

THREADS =>

msf auxiliary(ack) > run

Metasploit中ftpbounce扫描模块的使用过程

msf > use auxiliary/scanner/portscan/ftpbounce

msf auxiliary(ftpbounce) > set RHOSTS 202.193.58.13

RHOSTS => 202.193.58.13

msf auxiliary(ftpbounce) > set THREADS

THREADS =>

msf auxiliary(ftpbounce) > run

[-] Auxiliary failed: Msf::OptionValidateError The following options failed to validate: BOUNCEHOST.

msf auxiliary(ftpbounce) >

Metasploit中tcp扫描模块的使用过程

msf > use auxiliary/scanner/portscan/tcp

msf auxiliary(tcp) > set RHOSTS 202.193.58.13

RHOSTS => 202.193.58.13

msf auxiliary(tcp) > set THREADS

THREADS =>

msf auxiliary(tcp) > run

[*] 202.193.58.13:        - 202.193.58.13: - TCP OPEN

[*] 202.193.58.13:        - 202.193.58.13: - TCP OPEN

[*] 202.193.58.13:        - 202.193.58.13: - TCP OPEN

[*] 202.193.58.13:        - 202.193.58.13: - TCP OPEN

Metasploit中xmas扫描模块的使用过程

msf > use auxiliary/scanner/portscan/xmas

msf auxiliary(xmas) > set RHOSTS 202.193.58.13

RHOSTS => 202.193.58.13

msf auxiliary(xmas) > set THREADS

THREADS =>

msf auxiliary(xmas) > run

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

[*]  TCP OPEN|FILTERED 202.193.58.13:

Metasploit中syn扫描模块的使用过程

　　在一般的情况下，推荐使用syn端口扫描器，因为它的扫描速度较快、结果准确切不容易被对方察觉。下面是针对网关服务器（Ubuntu Metasploitable）主机的扫描结果，可以看出与Nmap的扫描结果基本一致。如下。

msf > use auxiliary/scanner/portscan/syn

msf auxiliary(syn) > set RHOSTS 202.193.58.13

RHOSTS => 202.193.58.13

msf auxiliary(syn) > set THREADS 20

THREADS => 20

msf auxiliary(syn) > run

[*]  TCP OPEN 202.193.58.13:21

[*]  TCP OPEN 202.193.58.13:22

[*]  TCP OPEN 202.193.58.13:23

[*]  TCP OPEN 202.193.58.13:25

[*]  TCP OPEN 202.193.58.13:53

[*]  TCP OPEN 202.193.58.13:80

[*]  TCP OPEN 202.193.58.13:111

[*]  TCP OPEN 202.193.58.13:139

[*]  TCP OPEN 202.193.58.13:445

[*]  TCP OPEN 202.193.58.13:512

[*]  TCP OPEN 202.193.58.13:513

 

　　当然，大家也可以拿下面的主机来扫描

Metasploit中sap_router_portscanner扫描模块的使用过程

msf > use  auxiliary/scanner/sap/sap_router_portscanner

msf auxiliary(sap_router_portscanner) > set RHOSTS 202.193.58.13

RHOSTS => 202.193.58.13

msf auxiliary(sap_router_portscanner) > set THREADS

THREADS =>

msf auxiliary(sap_router_portscanner) > run

[-] Auxiliary failed: Msf::OptionValidateError The following options failed to validate: RHOST, TARGETS.

msf auxiliary(sap_router_portscanner) > 


Metasploit中也可以使用namp


常用nmap扫描类型参数：


　　-sT:TCP connect扫描


　　-sS:TCP syn扫描


　　-sF/-sX/-sN:通过发送一些标志位以避开设备或软件的检测


　　-sP:ICMP扫描


　　-sU:探测目标主机开放了哪些UDP端口


　　-sA:TCP ACk扫描


扫描选项：


　　-Pn:在扫描之前，不发送ICMP echo请求测试目标是否活跃


　　-O:辨识操作系统等信息


　　-F:快速扫描模式


　　-p<端口范围>：指定端口扫描范围






msf auxiliary(syn) > nmap -sS -Pn 202.193.58.13

[*] exec: nmap -sS -Pn 202.193.58.13

Starting Nmap 7.31 ( https://nmap.org ) at 2017-05-17 22:17 CST

Nmap scan report for 13.58.193.202.in-addr.arpa (202.193.58.13)

Host is up (.0014s latency).

Not shown:  closed ports

PORT     STATE SERVICE

/tcp   open  ftp

/tcp   open  ssh

/tcp   open  telnet

/tcp   open  smtp

/tcp   open  domain

/tcp   open  http

/tcp  open  rpcbind

/tcp  open  netbios-ssn

/tcp  open  microsoft-ds

/tcp  open  exec

/tcp  open  login

/tcp  open  shell

/tcp open  rmiregistry

/tcp open  ingreslock

/tcp open  nfs

/tcp open  ccproxy-ftp

/tcp open  mysql

/tcp open  postgresql

/tcp open  vnc

/tcp open  X11

/tcp open  irc

/tcp open  ajp13

/tcp open  unknown

MAC Address: :AD::::5C (Unknown)

Nmap done:  IP address ( host up) scanned in 1.49 seconds

msf auxiliary(syn) >








msf auxiliary(syn) > nmap -sV -Pn 202.193.58.13

[*] exec: nmap -sV -Pn 202.193.58.13

Starting Nmap 7.31 ( https://nmap.org ) at 2017-05-17 22:18 CST

Nmap scan report for 13.58.193.202.in-addr.arpa (202.193.58.13)

Host is up (.0016s latency).

Not shown:  closed ports

PORT     STATE SERVICE       VERSION

/tcp   open  ftp           vsftpd 2.3.

/tcp   open  ssh           OpenSSH .7p1 Debian 8ubuntu1 (protocol 2.0)

/tcp   open  telnet        Linux telnetd

/tcp   open  smtp          Postfix smtpd

/tcp   open  domain?

/tcp   open  http?

/tcp  open  rpcbind?

/tcp  open  netbios-ssn?

/tcp  open  microsoft-ds?

/tcp  open  exec          netkit-rsh rexecd

/tcp  open  login?

/tcp  open  shell         Netkit rshd

/tcp open  rmiregistry?

/tcp open  shell         Metasploitable root shell

/tcp open  nfs?

/tcp open  ccproxy-ftp?

/tcp open  mysql         MySQL 5.0.51a-3ubuntu5

/tcp open  postgresql?

/tcp open  vnc           VNC (protocol 3.3)

/tcp open  X11?

/tcp open  irc           Unreal ircd

/tcp open  ajp13?

/tcp open  unknown

MAC Address: :AD::::5C (Unknown)

Service Info: Hosts:  metasploitable.localdomain, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done:  IP address ( host up) scanned in 22.50 seconds

msf auxiliary(syn) > 




　　可以，与下面进行对比。


kali 2.0 linux中的Nmap的端口扫描功能


　　当然，大家也可以拿下面的主机来扫描








												


											
Kali linux 2016.2（Rolling）中metasploit的端口扫描的更多相关文章
	

    
						
  1. MetaSploit攻击实例讲解------社会工程学set攻击（kali linux 2016.2(rolling)）（详细）
		
    不多说,直接上干货! 首先,如果你是用的BT5,则set的配置文件是在 /pentest/exploits/set/set_config下. APACHE_SERVER=ONSELF_SIGNED_A ...
    
		
    2. 
						
  2. MetaSploit攻击实例讲解------Metasploit自动化攻击（包括kali linux 2016.2(rolling) 和 BT5）
		
    不多说,直接上干货! 前期博客 Kali linux 2016.2(Rolling)里Metasploit连接(包括默认和自定义)的PostgreSQL数据库 Kali linux 2016.2(Ro ...
    
		
    3. 
						
  3. MetaSploit攻击实例讲解------终端下PostgreSQL数据库的使用（包括kali linux 2016.2(rolling)  和  BT5）
		
    不多说,直接上干货! 配置msf连接postgresql数据库 我这里是使用kali linux 2016.2(rolling)   用过的博友们都知道,已经预安装好了PostgreSQL. 1. p ...
    
		
    4. 
						
  4. MetaSploit攻击实例讲解------工具Meterpreter常用功能介绍（kali linux 2016.2(rolling)）（详细）
		
    不多说,直接上干货! 说在前面的话 注意啦:Meterpreter的命令非常之多,本篇博客下面给出了所有,大家可以去看看.给出了详细的中文 由于篇幅原因,我只使用如下较常用的命令. 这篇博客,利用下面 ...
    
		
    5. 
								
  5. MetaSploit攻击实例讲解------攻击445端口漏洞（kali linux 2016.2(rolling)）（详细）
		
    不多说,直接上干货! 大家,相信最近的这个事件,对于445端口已经是非常的小心了.勒索病毒 445端口是一个毁誉参半的端口,有了它我们可以在局域网中轻松访问各种共享文件夹或共享打印机,但也正是因为有了 ...
    
		
    6. 
						
  6. Kali linux 2016.2 的 plyload模块之meterpreter plyload详解
		
    不多说,直接上干货! 前期博客 Kali linux 2016.2(Rolling)中的payloads模块详解 当利用成功后尝试运行一个进程,它将在系统进程列表里显示,即使在木马中尝试执行系统命令, ...
    
		
    7. 
						
  7. Kali linux 2016.2（Rolling）中的Metasploit如何更新与目录结构初步认识
		
    如何更新MSF 1.Windows平台 方法1: 运行msfupdate.bat 在msfconsole里执行命令svn update 或者 方法2:  2.unix/linux平台 方法1: 运行m ...
    
		
    8. 
						
  8. Kali linux 2016.2（Rolling）中的payloads模块详解
		
    不多说,直接上干货! 前期博客 Kali linux 2016.2(Rolling)中的Exploits模块详解 payloads模块,也就是shellcode,就是在漏洞利用成功后所要做的事情.在M ...
    
		
    9. 
						
  9. Kali linux 2016.2（Rolling）里Metasploit连接（包括默认和自定义）的PostgreSQL数据库之后的切换到指定的工作空间
		
    不多说,直接上干货! 为什么要这么做? 答: 方便我们将扫描不同的目标或目标的不同段,进行归类.为了更好的后续工作! 前期博客 Kali linux 2016.2(Rolling)里Metasploi ...
    
		
    10. 
		

	


随机推荐
	

    
									
  1. UESTC 1143 数据传输     网络流 最大流 Dinic
			
    数据传输 Time Limit: 3000/1000MS (Java/Others)     Memory Limit: 65535/65535KB (Java/Others) Submit  Sta ...
    
			
    2. 
						
  2. 纯粹的K12精髓 - 名师指导整理《20以内加法口诀表》
			
    纯粹的K12精髓 - 名师指导整理<20以内加法口诀表> 太阳火神的漂亮人生 (http://blog.csdn.net/opengl_es) 本文遵循"署名-非商业用途-保持一 ...
    
			
    3. 
						
  3. 如何比较Keras, TensorLayer, TFLearn ？——如果只是想玩玩深度学习，想快速上手 -- Keras  如果工作中需要解决内部问题，想快速见效果 -- TFLearn 或者 Tensorlayer  如果正式发布的产品和业务，自己设计网络模型，需要持续开发和维护 -- Tensorlayer
			
    转自:https://www.zhihu.com/question/50030898/answer/235137938 如何比较Keras, TensorLayer, TFLearn ? 这三个库主要 ...
    
			
    4. 
						
  4. nyoj--37--回文字符串（动态规划）
			
    回文字符串 时间限制:3000 ms  |  内存限制:65535 KB 难度:4 描述 所谓回文字符串,就是一个字符串,从左到右读和从右到左读是完全一样的,比如"aba".当然, ...
    
			
    5. 
						
  5. 接入gitment为hexo添加评论功能
			
    title: 接入gitment为hexo添加评论功能 toc: false date: 2018-04-16 10:59:56 categories: methods tags: hexo gitm ...
    
			
    6. 
						
  6. direct2d: antialiasing and drawing a line with a 1 pixel stroke
			
    http://xboxforums.create.msdn.com/forums/t/61448.aspx I'm currently porting a number of custom MFC C ...
    
			
    7. 
						
  7. 【转载】Reactor模式和NIO
			
    当前分布式计算 Web Services盛行天下,这些网络服务的底层都离不开对socket的操作.他们都有一个共同的结构:1. Read request2. Decode request3. Proc ...
    
			
    8. 
						
  8. Failed to connect to server
			
    设置LR浏览器代理解决Failed to connect to server,Connection timed out问题. 虚拟机中,接口测试简单的Get请求,一直提示Failed to conne ...
    
			
    9. 
						
  9. Vrtualbox虚拟机中共享文件夹配置
			
    虚拟机装的是ubuntu 16.0.4版本的linux,本机是macOs 10.12.1版本 Vrtualbox进行如下配置 在Vrtualbox-->设置-->共享文件夹-->添加 ...
    
			
    10. 
						
  10. red hat linux之Samba、DHCP、DNS、FTP、Web的安装与配置
			
    本教程是在red hat linux 6.0环境下简单测试!教程没有图片演示,需要具有一定Linux基础知识,很多地方的配置需要根据自己的情况修改,照打不一定可以配置成功.(其他不足后续修改添加) y ...
    
			
    11.