不多说，直接上干货！
为什么要这么做？
答： 方便我们将扫描不同的目标或目标的不同段，进行归类。为了更好的后续工作！
前期博客
Kali linux 2016.2（Rolling）里Metasploit连接（包括默认和自定义）的PostgreSQL数据库
注意啦：
我这里，是已经切换到了自定义的PostgreSQL数据库postgres，不是默认的PostgreSQL数据库msf。
那么，工作空间是属于数据库里的。
也就是说，下面，我是在自定义数据库postgres里操作的。
可以看到，默认的工作空间是default
msf > workspace * default ( 默认的） msf > workspace -h Usage: workspace List workspaces workspace [name] Switch workspace workspace -a [name] ... Add workspace(s) （创建） workspace -d [name] ... Delete workspace(s) （删除） workspace -D Delete all workspaces workspace -r <old> <new> Rename workspace （重命名） workspace -h Show this help information msf >
好的，然后呢，我现在带领大家，来创建自定义的工作空间，
然后，再Kali linux 2016.2（Rolling）里Metasploit连接（包括默认和自定义）的PostgreSQL数据库之后的切换到指定的工作空间
msf > workspace * default msf > workspace -h Usage: workspace List workspaces workspace [name] Switch workspace workspace -a [name] ... Add workspace(s) workspace -d [name] ... Delete workspace(s) workspace -D Delete all workspaces workspace -r <old> <new> Rename workspace workspace -h Show this help information msf > workspace -a 001 [*] Added workspace: 001 msf > workspace -a 002 [*] Added workspace: 002 msf > workspace default 001 * 002 msf >
msf > workspace default 001 * 002 msf > workspace 001 [*] Workspace: 001 msf >
成功链接到我们刚自定义创建好的数据库postgres后，可以用db_nmap命令，这个命令能够在MSF终端中运行db_nmap，并自动将扫描后的结果，存储到对应的数据库下的工作空间下。（我这里是存储在自定义数据库postgres的工作空间001下）
msf > workspace 001
[*] Workspace: 001
msf > db_nmap -sV -O -v -T 5 202.193.58.13
[*] Nmap: Starting Nmap 7.31 ( https://nmap.org ) at 2017-05-20 11:31 CST
[*] Nmap: NSE: Loaded 39 scripts for scanning.
[*] Nmap: Initiating ARP Ping Scan at 11:31
[*] Nmap: Scanning 202.193.58.13 [1 port]
[*] Nmap: Completed ARP Ping Scan at 11:31, 0.01s elapsed (1 total hosts)
[*] Nmap: Initiating Parallel DNS resolution of 1 host. at 11:31
[*] Nmap: Completed Parallel DNS resolution of 1 host. at 11:31, 0.02s elapsed
[*] Nmap: Initiating SYN Stealth Scan at 11:31
[*] Nmap: Scanning 13.58.193.202.in-addr.arpa (202.193.58.13) [1000 ports]
[*] Nmap: Discovered open port 139/tcp on 202.193.58.13
[*] Nmap: Discovered open port 22/tcp on 202.193.58.13
[*] Nmap: Discovered open port 21/tcp on 202.193.58.13
[*] Nmap: Discovered open port 445/tcp on 202.193.58.13
[*] Nmap: Discovered open port 23/tcp on 202.193.58.13
[*] Nmap: Discovered open port 80/tcp on 202.193.58.13
[*] Nmap: Discovered open port 5900/tcp on 202.193.58.13
[*] Nmap: Discovered open port 3306/tcp on 202.193.58.13
[*] Nmap: Discovered open port 25/tcp on 202.193.58.13
[*] Nmap: Discovered open port 53/tcp on 202.193.58.13
[*] Nmap: Discovered open port 111/tcp on 202.193.58.13
[*] Nmap: Discovered open port 8180/tcp on 202.193.58.13
[*] Nmap: Discovered open port 5432/tcp on 202.193.58.13
[*] Nmap: Discovered open port 512/tcp on 202.193.58.13
[*] Nmap: Discovered open port 8009/tcp on 202.193.58.13
[*] Nmap: Discovered open port 514/tcp on 202.193.58.13
[*] Nmap: Discovered open port 2121/tcp on 202.193.58.13
[*] Nmap: Discovered open port 6000/tcp on 202.193.58.13
[*] Nmap: Discovered open port 6667/tcp on 202.193.58.13
[*] Nmap: Discovered open port 513/tcp on 202.193.58.13
[*] Nmap: Discovered open port 1099/tcp on 202.193.58.13
[*] Nmap: Discovered open port 2049/tcp on 202.193.58.13
[*] Nmap: Discovered open port 1524/tcp on 202.193.58.13
[*] Nmap: Completed SYN Stealth Scan at 11:31, 0.99s elapsed (1000 total ports)
[*] Nmap: Initiating Service scan at 11:31
[*] Nmap: Scanning 23 services on 13.58.193.202.in-addr.arpa (202.193.58.13)
[*] Nmap: Completed Service scan at 11:32, 16.06s elapsed (23 services on 1 host)
[*] Nmap: Initiating OS detection (try #1) against 13.58.193.202.in-addr.arpa (202.193.58.13)
[*] Nmap: Retrying OS detection (try #2) against 13.58.193.202.in-addr.arpa (202.193.58.13)
[*] Nmap: NSE: Script scanning 202.193.58.13.
[*] Nmap: Initiating NSE at 11:32
[*] Nmap: Completed NSE at 11:32, 2.43s elapsed
[*] Nmap: Initiating NSE at 11:32
[*] Nmap: Completed NSE at 11:32, 1.13s elapsed
[*] Nmap: Nmap scan report for 13.58.193.202.in-addr.arpa (202.193.58.13)
[*] Nmap: Host is up (0.0022s latency).
[*] Nmap: Not shown: 977 closed ports
[*] Nmap: PORT STATE SERVICE VERSION
[*] Nmap: 21/tcp open ftp vsftpd 2.3.4
[*] Nmap: 22/tcp open ssh OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
[*] Nmap: 23/tcp open telnet Linux telnetd
[*] Nmap: 25/tcp open smtp Postfix smtpd
[*] Nmap: 53/tcp open domain?
[*] Nmap: 80/tcp open http?
[*] Nmap: 111/tcp open rpcbind?
[*] Nmap: 139/tcp open netbios-ssn?
[*] Nmap: 445/tcp open microsoft-ds?
[*] Nmap: 512/tcp open exec netkit-rsh rexecd
[*] Nmap: 513/tcp open login?
[*] Nmap: 514/tcp open shell Netkit rshd
[*] Nmap: 1099/tcp open rmiregistry?
[*] Nmap: 1524/tcp open shell Metasploitable root shell
[*] Nmap: 2049/tcp open nfs?
[*] Nmap: 2121/tcp open ccproxy-ftp?
[*] Nmap: 3306/tcp open mysql MySQL 5.0.51a-3ubuntu5
[*] Nmap: 5432/tcp open postgresql?
[*] Nmap: 5900/tcp open vnc VNC (protocol 3.3)
[*] Nmap: 6000/tcp open X11?
[*] Nmap: 6667/tcp open irc Unreal ircd
[*] Nmap: 8009/tcp open ajp13?
[*] Nmap: 8180/tcp open unknown
[*] Nmap: MAC Address: 84:AD:58:82:49:5C (Unknown)
[*] Nmap: Device type: firewall
[*] Nmap: Running (JUST GUESSING): Fortinet embedded (87%)
[*] Nmap: OS CPE: cpe:/h:fortinet:fortigate_100d
[*] Nmap: Aggressive OS guesses: Fortinet FortiGate 100D firewall (87%)
[*] Nmap: No exact OS matches for host (test conditions non-ideal).
[*] Nmap: Network Distance: 1 hop
[*] Nmap: Service Info: Hosts: metasploitable.localdomain, irc.Metasploitable.LAN; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
[*] Nmap: Read data files from: /usr/bin/../share/nmap
[*] Nmap: OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
[*] Nmap: Nmap done: 1 IP address (1 host up) scanned in 31.42 seconds
[*] Nmap: Raw packets sent: 1149 (56.556KB) | Rcvd: 1024 (42.297KB)
msf >
msf > hosts
Hosts
=====
address mac name os_name os_flavor os_sp purpose info comments
------- --- ---- ------- --------- ----- ------- ---- --------
202.193.58.13 84:ad:58:82:49:5c 13.58.193.202.in-addr.arpa embedded device
msf > creds
Credentials
===========
host origin service public private realm private_type
---- ------ ------- ------ ------- ----- ------------
msf >
msf > loot
Loot
====
host service type name content info path
---- ------- ---- ---- ------- ---- ----
msf > notes
[*] Time: 2017-05-20 03:32:19 UTC Note: host=202.193.58.13 type=host.os.nmap_fingerprint data={:os_vendor=>"Fortinet", :os_family=>"embedded", :os_version=>nil, :os_accuracy=>87}
msf >
msf > notes [*] Time: 2017-05-20 03:32:19 UTC Note: host=202.193.58.13 type=host.os.nmap_fingerprint data={:os_vendor=>"Fortinet", :os_family=>"embedded", :os_version=>nil, :os_accuracy=>87} msf > workspace 002 [*] Workspace: 002 msf > notes msf > hosts Hosts ===== address mac name os_name os_flavor os_sp purpose info comments ------- --- ---- ------- --------- ----- ------- ---- -------- msf >