Scanner

Msf::Auxiliary::Scanner provides multi-host scanning and threaded execution. Its implementation is lib/msf/core/auxiliary/scanner.rb.

include

include Msf::Auxiliary::Scanner

The main options it adds are:

Option	Meaning
RHOSTS	Target range
THREADS	Number of concurrent threads
ShowProgress	Show progress
ShowProgressPercent	Show percentage complete

Method to implement

def run_host(ip)
  # Called once per IP
end

The mixin provides the usual run method and runs a replicant for each host internally. It is more accurate to think in terms of multiple instances than just one.

Example

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::Tcp
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Example TCP Banner Scanner',
        'Description' => 'Grab a banner',
        'Author' => ['you'],
        'License' => MSF_LICENSE
      )
    )
    register_options([Opt::RPORT(21)])
  end

  def run_host(ip)
    connect
    banner = sock.get_once(1024, 5).to_s
    print_good("#{ip}:#{rport} #{banner.strip}") unless banner.empty?
    report_service(host: ip, port: rport, name: 'ftp', info: banner.strip)
  rescue Rex::ConnectionError
    vprint_error("#{ip}:#{rport} unreachable")
  ensure
    disconnect
  end
end

At runtime

use auxiliary/scanner/http/http_version
set RHOSTS 10.10.11.1-50
set THREADS 8
run

Cautions

• Do not define both run and run_host yourself.
• Shared state, such as class variables, is risky across threads. Keep host-specific state in local variables.
• To stop the entire scan on a fatal error, check the mixin’s fail_with(..., abort: true) behavior.