Introduction
Welcome to the Information Gathering & Auxiliary Modules lab!
When most people think of the Metasploit Framework, they immediately think of exploitation—launching payloads to compromise vulnerable systems. However, Metasploit is also a powerful tool for the reconnaissance and information-gathering phases of a penetration test.
Metasploit features a category of modules known as Auxiliary modules. Unlike exploit modules, auxiliary modules do not execute a payload on the target system. Instead, they are designed to perform tasks such as port scanning, service identification, fuzzing, and vulnerability scanning.
This distinction matters because it reinforces that exploitation is only one stage of an engagement. Good offensive work also depends on structured reconnaissance, enumeration, and validation.
In this lab, you will learn how to navigate the Metasploit console, search for specific auxiliary modules, configure their parameters, execute network scans against a local target, and view the results stored automatically in Metasploit's database.
Search Auxiliary Modules
In this step, you will launch the Metasploit Framework console and learn how to search for auxiliary modules.
Metasploit contains thousands of modules. To find what you need, you can use the built-in search command. The search command allows you to filter by module type, name, platform, and more.
First, open your terminal and launch the Metasploit console. We will use the -q flag to start it in "quiet" mode, which skips the large ASCII art banner and starts the console faster.
Searching well is a practical skill in Metasploit. The framework is too large to browse manually every time, so learning how to narrow the module set is part of using it effectively.
Type the following command in your terminal:
msfconsole -q
You will see the Metasploit prompt appear, which looks like msf6 >. This indicates that you are now inside the Metasploit interactive shell. If this is the first time you have launched Metasploit in the current environment, it may briefly ask whether you want to set up a new database. Answer yes and wait for the initialization to finish.
Next, let's search for a module that can perform a basic TCP port scan. A simple keyword search is more reliable across Metasploit versions than using multiple search filters.
Execute the following command inside the Metasploit console:
search portscan
You should see an output similar to this:
Matching Modules
================
## Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 auxiliary/scanner/portscan/ack normal No TCP ACK Firewall Scanner
1 auxiliary/scanner/portscan/ftpbounce normal No FTP Bounce Port Scanner
2 auxiliary/scanner/portscan/syn normal No TCP SYN Port Scanner
3 auxiliary/scanner/portscan/tcp normal No TCP Port Scanner
4 auxiliary/scanner/portscan/xmas normal No TCP "XMas" Port Scanner
The search results display a list of matching modules. Each module has a specific path (for example, auxiliary/scanner/portscan/tcp), a rank, and a brief description. In the next step, we will select one of these modules to use.
Configure Target Parameters (RHOSTS)
In this step, you will select a specific port scanning module and configure its settings.
To tell Metasploit which module you want to work with, you use the use command followed by the module's path. We will use the standard TCP port scanner.
Run the following command in your Metasploit console:
use auxiliary/scanner/portscan/tcp
Notice that your prompt changes to msf6 auxiliary(scanner/portscan/tcp) >. This indicates that the module is now active.
Before running a module, you must configure its parameters. You can view all available parameters for the current module using the show options command:
show options
The output will display a table of options. Pay attention to the Required column. Any option marked as yes must have a value before the module can run.
Module options (auxiliary/scanner/portscan/tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
CONCURRENCY 10 yes The number of concurrent ports to check per host
DELAY 0 yes The delay between connections, per thread, in milliseconds
JITTER 0 yes The delay jitter factor (maximum value by which to +/- DELAY) in milliseconds.
PORTS 1-10000 yes Ports to scan (e.g. 22-25,80,110-900)
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
THREADS 1 yes The number of concurrent threads (max one per host)
TIMEOUT 1000 yes The socket connect timeout in milliseconds
The most important setting is RHOSTS (Remote Hosts), which specifies the target IP address or network range. For this lab, we will scan our own local machine, which is hosting several services.
Set the target IP address to 127.0.0.1 (localhost) using the set command:
set RHOSTS 127.0.0.1
By default, this module scans ports from 1 to 10000. To make our scan finish quickly, let's restrict the scan to a few specific ports where we know services are expected to be running in this lab setup: FTP on 21, HTTP on 80, and PostgreSQL on 5432.
Set the PORTS option to scan only these specific ports:
set PORTS 21,80,5432
You can run show options again to verify that your settings have been applied correctly.
Execute Scans and Store Results
In this step, you will execute the configured port scan.
Once the scan runs under Metasploit, the value is not only the immediate output. The value is also that the findings become part of the database and can feed later modules and decisions.
One of the greatest advantages of using Metasploit for information gathering is its built-in database integration. When a database is connected, Metasploit automatically stores the results of your scans, keeping your reconnaissance data organized.
First, let's verify that Metasploit is connected to its PostgreSQL database. Run the following command:
db_status
You should see an output confirming the connection, such as:
[*] Connected to msf. Connection type: postgresql.
Now that we have confirmed the database is active and our module options are configured, it is time to launch the scan. You can start the module by typing either run or exploit. For auxiliary modules, run is the standard convention.
Execute the scan:
run
Metasploit will now attempt to connect to the specified ports on the target IP address. Because we limited the scan to three ports, it should complete almost instantly.
You will see output similar to the following, indicating which ports are open:
[+] 127.0.0.1 - 127.0.0.1:21 - TCP OPEN
[+] 127.0.0.1 - 127.0.0.1:80 - TCP OPEN
[+] 127.0.0.1 - 127.0.0.1:5432 - TCP OPEN
[*] 127.0.0.1: - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
The [+] symbol indicates a successful finding (an open port). Behind the scenes, Metasploit has taken this information and saved it directly into its database.
View Hosts and Services in Database
In this final step, you will learn how to retrieve and view the information that Metasploit automatically saved to its database during the scan.
When managing a large penetration test, you might scan dozens of networks and hundreds of hosts. Remembering every open port is impossible, which is why the database commands are incredibly useful.
To view a list of all the target systems Metasploit has discovered and saved, use the hosts command:
hosts
The output will display a table of known hosts. You should see the localhost IP address we just scanned:
Hosts
=====
address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- --------
127.0.0.1 Unknown device
To see the specific open ports and services discovered on those hosts, use the services command:
services
This command queries the database and lists all the open ports we found during our scan:
Services
========
host port proto name state info resource parents
---- ---- ----- ---- ----- ---- -------- -------
127.0.0.1 21 tcp open {}
127.0.0.1 80 tcp open {}
127.0.0.1 5432 tcp open {}
At this stage, the basic TCP port scanner records that these ports are open, but it may not fill in detailed service names or version information. As you run more advanced auxiliary modules later, this table can be enriched with additional details.
You have successfully completed the lab objectives! To exit the Metasploit console and return to your standard Linux terminal, type:
exit
Summary
Congratulations! You have successfully completed the Information Gathering & Auxiliary Modules lab.
In this lab, you learned that Metasploit is a versatile framework that extends far beyond exploitation. You practiced navigating the Metasploit console, searching for specific auxiliary modules, and configuring essential parameters like RHOSTS and PORTS. Furthermore, you executed a network port scan and utilized Metasploit's powerful database integration to automatically store and review your reconnaissance data using the hosts and services commands.
These foundational skills are critical for organizing your workflow during the information-gathering phase of any security assessment.
