大体可以分为两种方式：
1.调用nmap进行端口扫描
msfconsole
nmap -v -sV www.cstc.org.cn
扫描结果(端口开放情况以及目标服务操作系统相关操作信息)
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
80/tcp open http Apache Tomcat/Coyote JSP engine 1.1
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows 98 netbios-ssn
445/tcp filtered microsoft-ds
514/tcp filtered shell
1025/tcp open msrpc Microsoft Windows RPC
1026/tcp open msrpc Microsoft Windows RPC
1038/tcp open msrpc Microsoft Windows RPC
3306/tcp open mysql MySQL 5.0.27-community-nt
3389/tcp open ms-wbt-server Microsoft Terminal Service
4444/tcp filtered krb524
8009/tcp open ajp13 Apache Jserv (Protocol v1.3)
8090/tcp open http Microsoft IIS httpd 6.0
Service Info: OSs: Windows, Windows 98; CPE: cpe:/o:microsoft:windows, cpe:/o:microsoft:windows_98
2.调用MSF模块进行端口扫描，扫描在一个网段中，有哪些机器活跃，且打开了445端口
msfconsole
search portscan
use auxiliary/scanner/portscan/syn
msf auxiliary(syn) > set INTERFACE eth0
INTERFACE => eth0
msf auxiliary(syn) > set PORTS 445
PORTS => 445
msf auxiliary(syn) > set RHOSTS 172.16.62.0/24
RHOSTS => 172.16.62.0/24
msf auxiliary(syn) > set THREADS 100
THREADS => 100
msf auxiliary(syn) > run
扫描结果：
[*] TCP OPEN 172.16.62.24:445
[*] TCP OPEN 172.16.62.70:445
[*] TCP OPEN 172.16.62.78:445
[*] TCP OPEN 172.16.62.144:445
[*] TCP OPEN 172.16.62.149:445
[*] TCP OPEN 172.16.62.178:445
[*] TCP OPEN 172.16.62.183:445
3.检测到活跃机器后，检测该机器打开了哪些端口
use auxiliary/scanner/portscan/tcp
msf auxiliary(tcp) > set RHOSTS 172.16.62.144
RHOSTS => 172.16.62.144
msf auxiliary(tcp) > set THREADS 100
THREADS => 100
msf auxiliary(tcp) > run
扫描结果为：
[*] 172.16.62.144:80 - TCP OPEN
[*] 172.16.62.144:135 - TCP OPEN
[*] 172.16.62.144:139 - TCP OPEN
[*] 172.16.62.144:445 - TCP OPEN
[*] 172.16.62.144:443 - TCP OPEN
[*] 172.16.62.144:1025 - TCP OPEN
[*] 172.16.62.144:1027 - TCP OPEN
[*] 172.16.62.144:1026 - TCP OPEN
[*] 172.16.62.144:1034 - TCP OPEN
[*] 172.16.62.144:1035 - TCP OPEN
[*] 172.16.62.144:1433 - TCP OPEN
[*] 172.16.62.144:2383 - TCP OPEN