MSF RCP: Information Gathering and Scanning

Information gathering and scanning tests whether you can enumerate hosts and services safely, choose the right auxiliary scanner, and move results into the database for later exploitation. Expect questions on db_nmap, scanner naming, RHOSTS formats, and threading.

Core rules

• db_nmap wraps Nmap and stores hosts, services, and notes. Use -sV for version detection and -p for ports; avoid -A unless the engagement permits intrusive scripts.
• Auxiliary scanners follow auxiliary/scanner/<protocol>/<action>: for example smb/smb_version, ssh/ssh_version, http/http_version, http/http_enum, mysql/mysql_version, mssql/mssql_ping, snmp/snmp_enum, and vnc/vnc_none_auth.
• RHOSTS accepts a single address, CIDR, range, comma list, or file:/path/list.txt. THREADS controls concurrency; high values speed scans but increase false negatives, packet loss, and IDS alerts.
• hosts -R and services -R can populate RHOSTS from database records, reducing transcription errors.
• An open port is a fact; a vulnerability is a validated conclusion. Scanning proves reachability and version, not exploitability.

Worked example

Run db_nmap -sV -p 22,80,445 10.10.10.0/24, then services to review versions. Suppose 10.10.10.23 shows SMB. Run hosts -R or set RHOSTS 10.10.10.23, use auxiliary/scanner/smb/smb_version, and run with THREADS 5. Reasoning: Nmap establishes reachable services; the SMB scanner fingerprints the SMB stack; low threads reduce disruption. You record the banner and move to vulnerability validation, not straight to an exploit.

Traps

• Reporting every open port as a finding.
• Setting THREADS 100 on a fragile service or production network.
• Scanning a CIDR outside the signed scope, including a cloud metadata range or a client-owned subnet discovered mid-test.
• Forgetting RPORT when the service is not on its default port.
• Using an exploit module as a scanner and crashing the service.