Metasploit Writing Your Own Security Scanner omertawf, braindumpscom
Advanced Ethical Hacking Institute in Pune
There are times where you may need a specific network security scanner, or having scan activity conducted withinMetasploit would be easier for scripting purposes than using an external program. Metasploit has a lot of features that can come in handy for this purpose, like access to all of the exploit classes and methods, built in support for proxies, SSL, reporting, and built in threading. Think of instances where you may need to find every instance of a password on a system, or scan for a custom service. Not to mention, it is fairly quick and easy to write up your own custom scanner.
Some of the many Metasploit scanner features are:
Writing your own scanner module can also be extremely useful during security audits by allowing you to locate every instance of a bad password or you can scan in-house for a vulnerable service that needs to be patched. Using theMetasploit Framework will allow you to store this information in the database for organization and later reporting needs.
We will use this very simple TCP scanner that will connect to a host on a default port of 12345 which can be changed via the scanner module options at run time. Upon connecting to the server, it sends ‘HELLO SERVER’, receives the response and prints it out along with the IP address of the remote host.
We save the file into our ./modules/auxiliary/scanner/ directory as simple_tcp.rb and load up msfconsole. It’s important to note two things here. First, modules are loaded at run time, so our new module will not show up unless we restart our interface of choice. The second being that the folder structure is very important, if we would have saved our scanner under ./modules/auxiliary/scanner/http/ it would show up in the modules list as scanner/http/simple_tcp.
To test our security scanner, set up a netcat listener on port 12345 and pipe in a text file to act as the server response.
Next, you select your new scanner module, set its parameters, and run it to see the results.
As you can tell from this simple example, this level of versatility can be of great help when you need some custom code in the middle of a penetration test. The power of the framework and reusable code really shines through here.
The report mixin provides report_*(). These methods depend on a database in order to operate:
The database drivers are now autoloaded.
Then, call the report_note() method.
Learning to write your own network security scanners may seem like a daunting task, but as we’ve just shown, the benefits of creating our own auxiliary module to house and run our security scanner will help us in storing and organizing our data, not to mention help with our report writing during our pentests.