Pearson's OSCP Notebook

Auxiliary

Properties1
tagsmetasploit, auxiliary, scanner, brute-force, enumeration, smb, ftp, ssh, http

4 min read

Auxiliary Modules — Reference

What are Auxiliary Modules?

Auxiliary modules perform tasks that don’t require exploiting a vulnerability: scanning, enumeration, brute-forcing, fuzzing, sniffing, and service interaction. They return information — they don’t provide a shell on their own.

# Usage pattern
use auxiliary/<category>/<module>
show options
set RHOSTS <target>
run

📌 1) Port Scanning

# TCP port scan (multi-threaded)
use auxiliary/scanner/portscan/tcp
set RHOSTS 10.10.10.0/24
set PORTS 1-1024
set THREADS 50
run
 
# TCP SYN scan (faster, less noisy)
use auxiliary/scanner/portscan/syn
set RHOSTS 10.10.10.10
set PORTS 1-65535
set THREADS 100
run
 
# XMAS scan
use auxiliary/scanner/portscan/xmas
 
# ACK scan (firewall rule detection)
use auxiliary/scanner/portscan/ack
 
# UDP scan
use auxiliary/scanner/discovery/udp_sweep
set RHOSTS 10.10.10.10
run
 
# ARP host discovery (LAN only)
use auxiliary/scanner/discovery/arp_sweep
set RHOSTS 192.168.1.0/24
run

Port scan options

OptionDescription
RHOSTSTarget(s): IP, range, CIDR, or file
PORTSPort range (e.g. 1-1024, 80,443,8080)
THREADSConcurrent threads
TIMEOUTPer-connection timeout (ms)
CONCURRENCYMax simultaneous connections

📌 2) SMB Enumeration

# Check for EternalBlue (MS17-010)
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 10.10.10.10
run
 
# SMB version detection
use auxiliary/scanner/smb/smb_version
set RHOSTS 10.10.10.0/24
run
 
# Enumerate SMB shares
use auxiliary/scanner/smb/smb_enumshares
set RHOSTS 10.10.10.10
set SMBUser guest
run
 
# Enumerate users via SMB
use auxiliary/scanner/smb/smb_enumusers
set RHOSTS 10.10.10.10
run
 
# Enumerate users via SAMR
use auxiliary/scanner/smb/smb_lookupsid
set RHOSTS 10.10.10.10
run
 
# SMB null session / anonymous login
use auxiliary/scanner/smb/smb_enumshares
set SMBUser ""
set SMBPass ""
run
 
# Pipe auditor (accessible named pipes)
use auxiliary/scanner/smb/pipe_auditor
set RHOSTS 10.10.10.10
run

📌 3) SSH Enumeration & Brute Force

# Enumerate SSH version
use auxiliary/scanner/ssh/ssh_version
set RHOSTS 10.10.10.0/24
run
 
# SSH login brute force
use auxiliary/scanner/ssh/ssh_login
set RHOSTS 10.10.10.10
set USER_FILE /usr/share/wordlists/users.txt
set PASS_FILE /usr/share/wordlists/rockyou.txt
set THREADS 10
set STOP_ON_SUCCESS true
run
 
# SSH login — single cred
use auxiliary/scanner/ssh/ssh_login
set RHOSTS 10.10.10.10
set USERNAME admin
set PASSWORD password
run
 
# Enumerate supported auth methods
use auxiliary/scanner/ssh/ssh_enumusers
set RHOSTS 10.10.10.10
set USER_FILE /usr/share/wordlists/users.txt
run

📌 4) FTP Enumeration & Brute Force

# Check anonymous FTP
use auxiliary/scanner/ftp/anonymous
set RHOSTS 10.10.10.0/24
run
 
# FTP version
use auxiliary/scanner/ftp/ftp_version
set RHOSTS 10.10.10.10
run
 
# FTP brute force
use auxiliary/scanner/ftp/ftp_login
set RHOSTS 10.10.10.10
set USER_FILE /usr/share/wordlists/users.txt
set PASS_FILE /usr/share/wordlists/rockyou.txt
set THREADS 10
set STOP_ON_SUCCESS true
run

📌 5) HTTP / Web Enumeration

# HTTP version banner
use auxiliary/scanner/http/http_version
set RHOSTS 10.10.10.0/24
run
 
# Directory brute force (MSF's built-in — prefer gobuster)
use auxiliary/scanner/http/dir_scanner
set RHOSTS 10.10.10.10
set DICTIONARY /usr/share/wordlists/dirb/common.txt
run
 
# HTTP login brute force (basic auth)
use auxiliary/scanner/http/http_login
set RHOSTS 10.10.10.10
set AUTH_URI /admin
set USER_FILE /usr/share/wordlists/users.txt
set PASS_FILE /usr/share/wordlists/rockyou.txt
run
 
# SSL cert info
use auxiliary/scanner/http/cert
set RHOSTS 10.10.10.10
set RPORT 443
run
 
# Jenkins enumeration
use auxiliary/scanner/http/jenkins_enum
set RHOSTS 10.10.10.10
set TARGETURI /
run
 
# Tomcat manager enum
use auxiliary/scanner/http/tomcat_mgr_login
set RHOSTS 10.10.10.10
run

📌 6) RDP Enumeration & Brute Force

# Check if RDP is enabled
use auxiliary/scanner/rdp/rdp_scanner
set RHOSTS 10.10.10.0/24
run
 
# Check for BlueKeep (CVE-2019-0708)
use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
set RHOSTS 10.10.10.10
run
 
# RDP brute force
use auxiliary/scanner/rdp/rdp_login
set RHOSTS 10.10.10.10
set USERNAME Administrator
set PASSWORD password
run

📌 7) SNMP Enumeration

# SNMP community string brute force
use auxiliary/scanner/snmp/snmp_login
set RHOSTS 10.10.10.0/24
run
 
# Enumerate via SNMP (once you have community string)
use auxiliary/scanner/snmp/snmp_enum
set RHOSTS 10.10.10.10
set COMMUNITY public
run

📌 8) Database Enumeration & Brute Force

# MSSQL
use auxiliary/scanner/mssql/mssql_ping
use auxiliary/scanner/mssql/mssql_login
set RHOSTS 10.10.10.10
set USER_FILE /usr/share/wordlists/users.txt
set PASS_FILE /usr/share/wordlists/rockyou.txt
run
 
# MSSQL — execute command (if sa creds known)
use auxiliary/admin/mssql/mssql_exec
set RHOSTS 10.10.10.10
set USERNAME sa
set PASSWORD ""
set CMD "whoami"
run
 
# MySQL
use auxiliary/scanner/mysql/mysql_login
set RHOSTS 10.10.10.10
run
 
# PostgreSQL
use auxiliary/scanner/postgres/postgres_login
set RHOSTS 10.10.10.10
run

📌 9) SMTP Enumeration

# SMTP user enumeration (VRFY/EXPN/RCPT)
use auxiliary/scanner/smtp/smtp_enum
set RHOSTS 10.10.10.10
set USER_FILE /usr/share/wordlists/unix_users.txt
run
 
# SMTP version
use auxiliary/scanner/smtp/smtp_version
set RHOSTS 10.10.10.0/24
run

📌 10) VNC & Other Services

# VNC authentication check (no password required?)
use auxiliary/scanner/vnc/vnc_none_auth
set RHOSTS 10.10.10.0/24
run
 
# VNC login brute force
use auxiliary/scanner/vnc/vnc_login
set RHOSTS 10.10.10.10
set PASS_FILE /usr/share/wordlists/rockyou.txt
run
 
# Telnet
use auxiliary/scanner/telnet/telnet_version
use auxiliary/scanner/telnet/telnet_login

📌 11) Vulnerability-Specific Scanners

# EternalBlue MS17-010
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 10.10.10.0/24
run
 
# BlueKeep RDP CVE-2019-0708
use auxiliary/scanner/rdp/cve_2019_0708_bluekeep
set RHOSTS 10.10.10.10
run
 
# Log4Shell CVE-2021-44228
use auxiliary/scanner/http/log4shell_scanner
set RHOSTS 10.10.10.10
set RPORT 8080
run
 
# Heartbleed OpenSSL CVE-2014-0160
use auxiliary/scanner/ssl/openssl_heartbleed
set RHOSTS 10.10.10.10
set RPORT 443
run
 
# ShellShock CGI CVE-2014-6271
use auxiliary/scanner/http/apache_mod_cgi_bash_env
set RHOSTS 10.10.10.10
run

📌 Quick Reference: Aux Module Option Cheat Sheet

OptionDescription
RHOSTSTarget host(s), CIDR, range, or file:/path
RPORTTarget port
THREADSConcurrent scan threads
TIMEOUTConnection timeout
USERNAME / USER_FILESingle user / user wordlist
PASSWORD / PASS_FILESingle password / password wordlist
STOP_ON_SUCCESSStop brute-forcing after first valid cred
BLANK_PASSWORDSTry blank passwords
USER_AS_PASSTry username as password
VERBOSEShow all attempts

Graph View

Backlinks