Metasploit中不仅能够使用第三方扫描器Nmap等，在其辅助模块中也包含了几款内建的端口扫描器。
查看Metasploit框架提供的端口扫描工具：
msf > search portscan Matching Modules ================ Name Disclosure Date Rank Description ---- --------------- ---- ----------- auxiliary/scanner/http/wordpress_pingback_access normal Wordpress Pingback Locator auxiliary/scanner/natpmp/natpmp_portscan normal NAT-PMP External Port Scanner auxiliary/scanner/portscan/ack normal TCP ACK Firewall Scanner auxiliary/scanner/portscan/ftpbounce normal FTP Bounce Port Scanner auxiliary/scanner/portscan/syn normal TCP SYN Port Scanner auxiliary/scanner/portscan/tcp normal TCP Port Scanner auxiliary/scanner/portscan/xmas normal TCP "XMas" Port Scanner
使用Metasploit的SYN端口扫描器对单个主机进行一次简单的扫描：
msf > use scanner/portscan/syn
设定RHOST参数为192.168.119.132，线程数为50
RHOSTS => 192.168.119.132 msf auxiliary(syn) > set THREADS 50 THREADS => 50 msf auxiliary(syn) > run [*] TCP OPEN 192.168.119.132:80 [*] TCP OPEN 192.168.119.132:135 [*] TCP OPEN 192.168.119.132:139 [*] TCP OPEN 192.168.119.132:1433 [*] TCP OPEN 192.168.119.132:2383 [*] TCP OPEN 192.168.119.132:3306 [*] TCP OPEN 192.168.119.132:3389 [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed