针对性扫描是指寻找目标网络中存在的已知可利用漏洞或能够轻松获取后门的特定操作系统、服务、软件以及配置缺陷。举例来说，在目标网络中快速地扫描存在MS08-067漏洞的主机是非常普遍的活动，因为MS08-067（仍然）是一个普遍存在的安全漏洞，并且能够让你很快地取得System的访问权限，比起扫描整个网络中所有漏洞后再攻击要容易的多。
1.服务器消息块协议扫描
Metasploit可以利用他的smb_version模块来遍历一个网络，并获取Windows系统的版本号
执行模块、列出参数并对RHOSTS参数进行设定后开始扫描：

msf > use scanner/smb/smb_version
msf  auxiliary(smb_version) > show options

Module options (auxiliary/scanner/smb/smb_version):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   RHOSTS                      yes       The target address range or CIDR identifier
   SMBDomain  WORKGROUP        no        The Windows domain to use for authentication
   SMBPass                     no        The password for the specified username
   SMBUser                     no        The username to authenticate as
   THREADS    1                yes       The number of concurrent threads

msf  auxiliary(smb_version) > set RHOSTS 192.168.119.132
RHOSTS => 192.168.119.132
msf  auxiliary(smb_version) > run

[*] 192.168.119.132:139 is running Windows XP Service Pack 3 (language: Chinese - Traditional) (name:PC-201403241103) (domain:WORKGROUP)
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

　　

2.搜索配置不当的Microsoft SQL Server
配置不当的Microsoft SQL Server（MS SQL）通常是竟如目标系统的第一个后门
MS SQL安装后，它默认监听在TCP端口1433上或使用随机的动态TCP端口。如果在随机的TCP端口上进行MS SQL监听，只需要简单的对UDP端口１４３４进行查询，便能或缺这个随机的TCP端口号。Metasploit有一个模块mssql_ping可以实现该操作

msf > use scanner/mssql/mssql_ping
msf  auxiliary(mssql_ping) > show options

Module options (auxiliary/scanner/mssql/mssql_ping):

   Name                 Current Setting  Required  Description
   ----                 ---------------  --------  -----------
   PASSWORD                              no        The password for the specified username
   RHOSTS                                yes       The target address range or CIDR identifier
   THREADS              1                yes       The number of concurrent threads
   USERNAME             sa               no        The username to authenticate as
   USE_WINDOWS_AUTHENT  false            yes       Use windows authentification (requires DOMAIN option set)

msf  auxiliary(mssql_ping) > set RHOSTS 192.168.119.132
RHOSTS => 192.168.119.132
msf  auxiliary(mssql_ping) > set THREADS 255
THREADS => 255
msf  auxiliary(mssql_ping) > run

[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

　　

我安装的是SQL Server版本如下：
Microsoft SQL Server Management Studio						9.00.1399.00
Microsoft Analysis Services 客户端工具						2005.090.1399.00
Microsoft 数据访问组件 (MDAC)						2000.085.1132.00 (xpsp.080413-0852)
Microsoft MSXML						2.6 3.0 5.0 6.0 
Microsoft Internet Explorer						8.0.6001.18702
Microsoft .NET Framework						2.0.50727.42
操作系统						5.1.2600

　　

3.SSH服务器扫描
如果在扫描过程中遇到一些主机运行着SSH（安全 Shell），你应该对SSH的版本进行识别SSH是一种安全的协议，但是这里的安全仅数据传输的加密，很多SSH的实现版本中均被发现了安全漏洞。不要认为你永远不会遇到一台没哟安装补丁的老机器，这种幸运的事很哟可能就会落在你的头上。可以用Metasploit框架的ssh_version模块来识别目标服务器上运行的SSH版本。

msf > use scanner/ssh/ssh_version
msf  auxiliary(ssh_version) > show options

Module options (auxiliary/scanner/ssh/ssh_version):

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOSTS                    yes       The target address range or CIDR identifier
   RPORT    22               yes       The target port
   THREADS  1                yes       The number of concurrent threads
   TIMEOUT  30               yes       Timeout for the SSH probe

msf  auxiliary(ssh_version) > set RHOSTS 192.168.119.144
RHOSTS => 192.168.119.144
msf  auxiliary(ssh_version) > run

[*] 192.168.119.144:22, SSH server version: SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf  auxiliary(ssh_version) >

　４.FTP扫描

　　　FTP是一种复杂且缺乏安全性的应用层协议，FTP服务器经常是进入一个目标网络最便捷的途径

msf  auxiliary(anonymous) > use scanner/ftp/ftp_version
msf  auxiliary(ftp_version) > show options

Module options (auxiliary/scanner/ftp/ftp_version):

   Name     Current Setting      Required  Description
   ----     ---------------      --------  -----------
   FTPPASS  mozilla@example.com  no        The password for the specified username
   FTPUSER  anonymous            no        The username to authenticate as
   RHOSTS   192.168.119.141      yes       The target address range or CIDR identifier
   RPORT    21                   yes       The target port
   THREADS  1                    yes       The number of concurrent threads

msf  auxiliary(ftp_version) > set RHOSTS 192.126.119.48
RHOSTS => 192.126.119.48
msf  auxiliary(ftp_version) > run

[*] 192.126.119.48:21 FTP Banner: '220 Microsoft FTP Service\x0d\x0a'
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed