Metasploit › Module 8 › Lesson 2
Lab-Only Scans
Point scanners at $LAB IP — host-only net; log what defenders would see.
Visual · msf_lab_scans
Scan target = $LAB only. Original Cyberlium.
Opening
A scanner without scope is indistinguishable from harassment.
Lab-only means one or two IPs on YOUR isolated network — Metasploitable, DVWA VM, etc. set RHOSTS 10.0.2.15 style values from YOUR brief, not discovered neighbors. Rate-limit yourself; aux is not permission to hammer strangers.
1. Target pinning
Write RHOSTS in RoE file before msfconsole.
Double-check set RHOSTS before run — typos hit wrong hosts.
Command guide
Try these commands — Target pinning
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Lab-only scans — https://nmap.org/book/legal-issues.html portscan auxiliary — https://docs.rapid7.com/metasploit/running-module-auxiliary-scans/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Kali: preinstalled, or: sudo apt install metasploit-framework
Command — copy this
sudo apt install nmap
macOS: Prefer Kali/Linux VM — brew install metasploit (heavy)
Command — copy this
brew install nmap
Windows: Use Kali VM or WSL with metasploit-framework — not raw Windows host
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
nmap -sT -p 22,80 "${LAB_HOST:-127.0.0.1}" 2>/dev/null | head -15 || echo 'Nmap YOUR lab only'
msfconsole -q -x 'use auxiliary/scanner/portscan/tcp; set RHOSTS ${LAB_HOST:-127.0.0.1}; show options; exit' 2>/dev/null || truePrimary tools to practice this lesson: msfconsole, nmap. Reference sites: Lab-only scans (https://nmap.org/book/legal-issues.html); portscan auxiliary (https://docs.rapid7.com/metasploit/running-module-auxiliary-scans/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Host-only networking
VirtualBox/VMware host-only = traffic stays on your machine.
Bridged mode toward LAN requires explicit written approval — default refuse.
3. Evidence for defenders
Save timestamps, module name, RHOSTS, threads.
Note which logs would fire on a real SOC.
4. What you ship: lab scan RoE line
Pinned $LAB IP + host-only note + defender log idea.
5. What you record before the next lesson
RHOSTS value from YOUR brief.
6. Wrong vs right: stranger hosts vs YOUR lab VM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Scan 192.168.1.0/24 from a coffee shop.
Right
Lab scan rules. Next: aux ethics.
Mission: pin scan target
1) Write $LAB IP in RoE. 2) Name host-only vs bridged risk. 3) Name one log source aux would trigger.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Host-only vs NAT for MSF lab?”
Knowledge Check
APPLY: Default scan target:
Multiple choice
Knowledge Check
APPLY: True or False: Bridged LAN scans are default homework.
True or False
Knowledge Check
APPLY: Before run verify:
Multiple choice