Metasploit中不仅能够使用第三方扫描器Nmap等，在其辅助模块中也包含了几款内建的端口扫描器。

查看Metasploit框架提供的端口扫描工具：

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
msf > search portscan
 
Matching Modules
================
 
   Name                                              Disclosure Date  Rank    Description
   ----                                              ---------------  ----    -----------
   auxiliary/scanner/http/wordpress_pingback_access                   normal  Wordpress Pingback Locator
   auxiliary/scanner/natpmp/natpmp_portscan                           normal  NAT-PMP External Port Scanner
   auxiliary/scanner/portscan/ack                                     normal  TCP ACK Firewall Scanner
   auxiliary/scanner/portscan/ftpbounce                               normal  FTP Bounce Port Scanner
   auxiliary/scanner/portscan/syn                                     normal  TCP SYN Port Scanner
   auxiliary/scanner/portscan/tcp                                     normal  TCP Port Scanner
   auxiliary/scanner/portscan/xmas                                    normal  TCP "XMas" Port Scanner

　使用Metasploit的SYN端口扫描器对单个主机进行一次简单的扫描：

?
1
msf > use scanner/portscan/syn

　　设定RHOST参数为192.168.119.132，线程数为50

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
RHOSTS => 192.168.119.132
msf  auxiliary(syn) > set THREADS 50
THREADS => 50
msf  auxiliary(syn) > run
 
[*]  TCP OPEN 192.168.119.132:80
[*]  TCP OPEN 192.168.119.132:135
[*]  TCP OPEN 192.168.119.132:139
[*]  TCP OPEN 192.168.119.132:1433
[*]  TCP OPEN 192.168.119.132:2383
[*]  TCP OPEN 192.168.119.132:3306
[*]  TCP OPEN 192.168.119.132:3389
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed