In this article, we will discuss combining Nmap and Metasploit together to perform port scanning and enumerate for vulnerabilities.

There certain cases where we can’t just go and run noisy scans with Nmap on our target due to various reasons among which you doing a black box test for your client and there is a firewall or IDS in place that would thwart or alert sysadmins about your Nmap scans.

So combining two of the most effective tools used in the arena of penetration testing becomes more sensible and plausible for us.

Let’s assume that we have a client machine assigned to us to perform port scanning and report vulnerabilities.

Scanning For open ports on the client machine with Metasploit

We start with launching Metasploit and using the port scanner module

msf 5> use auxiliary/scanner/portscan/tcp

Next we set the options for this module with ‘show options’

We set the RHOSTS with the IP/IP(s) of our client machine(s) and if we want to customize the scan for specific ports we can do that by changing PORTS

msf 5 >set PORTS 22,25,80,110,21

After running the scan, we will have an output displaying the open ports on the target client machine we specified earlier.

Combining Nmap with Metasploit for a more detailed and in-depth scan on the client machine

Once we get a clear vision on the open ports, we can start enumerating them to see and find the running services alongside their version.

msf 5> db_nmap -sV -p 80,22,110,25 192.168.94.134

and this is what we got

Scanning for vulnerabilities with Nmap and Metasploit

Once we are able to find the open ports and the corresponding services running on them, we can carry on our scan to look for detailed version numbers on every service running on each port so we can then try different auxiliary modules on Metasploit to find possible exploits.

msf 5> db_nmap -sV -A -p 80,22,110,25 192.168.94.134

and we would get the following

Our next step would be to use Searchsploit to find exploits for the services’ versions we have discovered or we can use the auxiliary modules built-in Metasploit.