Lab-Only Scans

Point scanners at $LAB IP — host-only net; log what defenders would see.

Lab-Only Scans• Audio Walkthrough

00:00/02:27

Visual · msf_lab_scans

Scan target = $LAB only. Original Cyberlium.

A scanner without scope is indistinguishable from harassment.

Lab-only means one or two IPs on YOUR isolated network — Metasploitable, DVWA VM, etc. set RHOSTS 10.0.2.15 style values from YOUR brief, not discovered neighbors. Rate-limit yourself; aux is not permission to hammer strangers.

1. Target pinning

Write RHOSTS in RoE file before msfconsole.

Double-check set RHOSTS before run — typos hit wrong hosts.

Command guide

Try these commands — Target pinning

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Lab-only scans — https://nmap.org/book/legal-issues.html portscan auxiliary — https://docs.rapid7.com/metasploit/running-module-auxiliary-scans/

═══ INSTALL ═══

Linux (Debian/Ubuntu): Kali: preinstalled, or: sudo apt install metasploit-framework

Command — copy this

sudo apt install nmap

macOS: Prefer Kali/Linux VM — brew install metasploit (heavy)

Command — copy this

brew install nmap

Windows: Use Kali VM or WSL with metasploit-framework — not raw Windows host

Command — copy this

choco install nmap  # or download https://nmap.org/download.html

═══ LINUX / macOS ═══

Command — copy this

nmap -sT -p 22,80 "${LAB_HOST:-127.0.0.1}" 2>/dev/null | head -15 || echo 'Nmap YOUR lab only'
msfconsole -q -x 'use auxiliary/scanner/portscan/tcp; set RHOSTS ${LAB_HOST:-127.0.0.1}; show options; exit' 2>/dev/null || true

Primary tools to practice this lesson: msfconsole, nmap. Reference sites: Lab-only scans (https://nmap.org/book/legal-issues.html); portscan auxiliary (https://docs.rapid7.com/metasploit/running-module-auxiliary-scans/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.