MSF内网探测

整理不易，转载请加原文链接：https://www.cnblogs.com/Yang34/p/12343672.html

补充下msf与数据库连接

结合nmap如下：

发现内网服务

use auxiliary/scanner/http/http_version  发现http服务

use auxiliary/scanner/http/title

use scanner/smb/smb_version  发现smb服务

use scanner/ftp/ftp_version  发现ftp服务（这里没配ftp）

use auxiliary/scanner/ssh/ssh_version 发现ssh服务

use auxiliary/scanner/mysql/mysql_version 发现mysql服务

发现内网存活主机及端口

use auxiliary/scanner/portscan/ack

use auxiliary/scanner/portscan/tcp

use auxiliary/scanner/portscan/syn

use auxiliary/scanner/netbios/nbname

use scanner/discovery/arp_sweep 

use scanner/discovery/udp_sweep 

use auxiliary/scanner/discovery/udp_probe

use auxiliary/scanner/dns/dns_amp

use auxiliary/scanner/rdp/rdp_scanner

在被控端上线时的一些探测

run windows/gather/arp_scanner RHOSTS= 192.168.5.125-132 THREADS=20

发现域存活主机可使用：