‫So, as you may know.
‫And map is a great tool for scanning and enumeration, and thankfully, it integrates into MSF with
‫the command DB and map.
‫Now if you connect the MSF to a database, you can store the scan results for later use as well.
‫By using an map, you can practically detect host and services on your target network and map has various
‫features and scanning techniques.
‫I'm not going to cover all of them here, but here I will make a skin scan, TCP scan and service detection
‫on the target host.
‫And then after this, you can either use and map from MSF console or use the DB and map command with
‫almost all the options and MAP provides.
‫But whenever you run the DB in MAP command, the scan results will be stored in the database automatically.
‫However, you may also wish to import the scan results into another application, so you may want to
‫export the scan results into an XML file.
‫So let's open your terminal command and start the MSF console and to take advantage of the DB and MAP
‫Command at this point must be connected to a database and then the usage is quite similar with the map
‫actually and map.
‫I don't want to discount it.
‫It is a wonderful tool.
‫Integrating it with MSF closes a huge gap while using netas point.
‫So let's just simply use DBI and map as the command with and map as a parameters.
‫So and map, as I said before, has a variety of options and different skin types to be able to enumerate
‫the target.
‫And one of them is the skin scan as best parameter is running just stealthy DCPI scan over the network
‫and looks for TCP based open ports, but it doesn't complete the three way handshake.
‫And Matt, DCPI, Skåne s t parameter, this runs a TCP connection over the network and looks for TCP
‫based open ports as well.
‫This, however, completes the three way handshake.
‫And then the last one is service detection, it tries to detect the services on the target by sending
‫some network probes and MAP is really smart.
‫Number four, scanning all the hosts in a network it first identifies if the host is alive.
‫So the plan option means you don't have to use the ICMP ping command to determine if the host is alive
‫and the parameter specifies the port numbers.
‫In this case, I want all the ports to be scanned.
‫And we have the scan results for Métis Voidable two and three, see and Map did a good job and now everything
‫is saved in the database.
‫And now you can manage your hosts by using the hosts command and also you can view services by using
‫the services command.
‫Excellent syntax with a services command, you can actually go deeper.
‫So let's have a look at the help screen for this command.
‫You can perform specific searches and listings, enter the C parameter and then enter name and port
‫to get this information.
‫And you can search with the parameter.
‫And now this is the host's command help screen.
‫So like the services command, the C parameter will help you make specialist.
‫Nope, it's wrong here, so I'm going to delete this empty character.
‫OK, so now it's OK.
‫So I want to show you one more common.
‫It is the wall and s command.
‫So it helps you to list the vulnerabilities of the hosts, however, you don't import any vulnerability
‫scan as a result.
‫So in addition to running and MAP or other third party scanners, there are several port scanners that
‫are available in MSF for you as well.
‫They come in as auxiliary modules.
‫Now, besides using the DBE and Map Command, you can try one of these as well.
‫So let's have a look at one of them.
‫Let's list them with the search command.
‫And here are the court scan modules listed, so now I'm going to pick the sin port scanner.
‫The view, it's information that I get a short description and some variables, not much more.
‫Now I want to show you the options.
‫So I'm going to set our host to Métis, voidable two and three IP addresses, but let me say a couple
‫of things at this point.
‫You might remember I mentioned earlier that these variables define your targets, IP addresses or yours.
‫So it's a pretty good example of the ease of use for MSRA because these types of variables take IP ranges,
‫CEYDA ranges, multiple ranges separated by commas or lines, separated houseless files, then run the
‫module.
‫So if I don't change the default value for the port variable, the module is going to scan port numbers
‫between one and ten thousand.
‫It may take a few minutes.
‫Now we've got the result and as you see here, the module did a really good job for us.
‫So using these modules can come in really handy that you didn't know that, did you?