Metasploit

Metasploit is a widely used platform for pentesting (penetration testing) + vulnerability search. In other words today we are talking about a powerful framework with an elaborate architecture and good functionality.

The tool is interesting for many reasons, but we are interested in the practical side of its use. It can be useful for system administrators, cyber-security specialists and novice hackers (but we won't mention it here).

The frameworks include Metasploit and their commercial versions: Metasploit Pro, Express, Community, Nexpose Ultimate. We are interested in the first one because it is quite widespread and of course convenient for creating ∕-testing ∕-debugging exploits.

Metasploit Framework

The framework has a smart and intuitive interface, open source code, a large number of services and modules that are constantly being added and improved, as well as a number of features:

• fast plugin development + qualitatively optimized multiplatform;
• wide support for multiple network options and protocols;
• work with extensible utilities and libraries;
• full development and product support by the developer community.

In essence, we have here an excellent basic toolkit, the complete environment for writing and using the exploits code, as well as creating custom security tools.


The core of the tool is Rex library (for working with protocols). It has MSF Core integrated with it and then MSF Base, which is used to provide the API for the user interface (graphical ∕ console), as well as modules which are divided into categories:

1. Exploit - the code of the particular vulnerability;
2. Payload;
3. Post;
4. Encoder - obfuscation tools;
5. NOP - generators of NOP.

Install Metasploit

It does not take long to install because it is pretty standard and easy to understand.
For your reference: it works on Windows, on all Linux distributions.


To install on Linux:


To install on Windows link is at the end of the article.


The platform itself consists of 4 working environments:

• msfconsole - the console interface, the main working environment in which various commands are used (here are examples of basic and some network commands);
  
• msfcli - console with the ability to create resource scripts;
• msfgui - not so popular, so skip it;
• msfweb.

We won't go into details on how to work with the tools and tests - this is a topic for a separate tutorial article (you can find similar materials freely available on many forums, read them if you want).

Download Metasploit for free from the official site - just click the direct link below.