Discover Open Ports Using Metasploit's Built-in Port Scanner
One of the first steps in reconnaissance is determining the open ports on a system. Nmap is widely considered the undisputed king of port scanning, but certain situations call for different tools. Metasploit makes it easy to conduct port scanning from directly inside the framework, and we'll show you three types of port scans: TCP, SYN, and XMAS.
About Port Scanning
What Is Port Scanning?
Port scanning is the process of probing a range of ports in order to determine the state of those ports — generally open or closed. There are 65,536 available ports on a host, with the first 1,024 ports being reserved for well-known services. Ports can communicate using the TCP protocol, UDP, or both.
The first type of scan we will be covering is the TCP scan, also known as TCP connect. This type of scan utilizes a system call to establish a connection, much like web browsers or other networked applications. When a port is open, the TCP scan will initiate and complete a full three-way handshake, and then close the connection. This type of scan is effective, but noisy since the IP address can be logged.
The second type of scan is the SYN scan. This is the default Nmap scan and is considered the most popular type of port scan. In contrast to the TCP connect scan, an SYN scan uses raw packets to connect to ports rather than a system call. This is advantageous because the connection is never fully completed, making it relatively stealthy and more likely to evade firewalls. There is also more control over the requests and responses since there is access to raw networking.
The third type of scan we will be going over is the XMAS scan. This scan sets the FIN, PSH, and URG flags on the packet, which is said to light it up like a Christmas tree (hence the name). XMAS scans can be even stealthier than SYN scans, although modern intrusion detection systems can still detect them. Regardless, it is worth trying out if other scanning methods fail.
In this guide, we've covered how to do three types of port scan — TCP, SYN, and XMAS — right from Metasploit's interactive console. These scanners are quick and dirty, but can accomplish the objective of finding open ports with relative ease. This just goes to show that Metasploit is packed full of features that make it easier for white hat hackers to do what they best.
TCP Scan
The first thing we need to to before conducting any scans is start Metasploit by typing msfconsole in the terminal. A random banner will be displayed, as well as version information and the number of modules currently loaded.
Scanners are a type of auxiliary module in Metasploit, and to locate the port scanners, we can type search portscan at the prompt.
Auxiliary module in Metasploit
This returns a few results, including the three types of port scans we will be looking at. Let's start with a simple TCP scan. Type use auxiliary/scanner/portscan/tcp to load the module. We can now take a look at the module settings by typing options:
Here, we can the current settings and their descriptions. Unlike many exploit modules, this scanner can take a range of target addresses in addition to a single IP address. In this case, since we only have one target machine, a single address will do.
The number of threads can also be increased to help the scan run faster. It's recommended to keep this value under 256 for Unix systems and under 16 for native Win32 systems. To be safe, we can set this to something like 8. All the other options can be left as default for now.
Now we're ready to start the scan. In Metasploit, the run command is simply an alias for exploit, so it will do the exact same thing. Given we are only conducting scans, run seems more appropriate, though it really doesn't matter.
The TCP scan will run pretty quickly, and once it's complete, we can see that there are many open ports on the target.
SYN Scan
Next, we'll move on to a SYN scan. Type back to return to the main prompt, followed by use auxiliary/scanner/portscan/syn to load the module. Again, we can type options to view the current settings for this module:
There are a few different options here compared to the TCP scan, but for the most part, it's very similar, including the option to accept a range of target addresses and the number of threads to set.
When performing a number of scans or exploits on a singular target, it can get tiring setting the same options over and over again. Luckily, there is a command that will set an option globally, meaning it won't have to be re-entered when using a different module. Use setg to set a global option.
Now, type run to start the scan.
The SYN scan will take a little longer to complete compared to the TCP scan, but once it's done, we can see that we obtained similar results compared to the previous scan.
XMAS Scan
The third type of scan we'll do is the XMAS scan. Again, type back to exit the current module, and then use auxiliary/scanner/portscan/xmas to load the module. Since we previously set global options for the remote host and threads, we should see these settings already populated when we view options now.
The other options are pretty much identical to the SYN scan, so we can leave these as default. Feel free to play around with the other settings and see how it affects the timing and accuracy. Now we can run the scan.
Once again, we obtained similar results to the other scans, with additional information about whether the port is filtered or not. Depending on the target (or targets) and the type of environment in place, these scans can sometimes yield different results, so it certainly doesn't hurt to try out multiple scans.
These Find Open Ports with Ease
In this guide, we've covered how to do three types of port scan — TCP, SYN, and XMAS — right from Metasploit's interactive console. These scanners are quick and dirty, but can accomplish the objective of finding open ports with relative ease. This just goes to show that Metasploit is packed full of features that make it easier for white hat hackers to do what they best.