Metasploit Fundamentals
One console, a few thousand modules, and a mental model that makes all of it click.
What you will learn
- -Start msfconsole and read its module counts
- -Load a module, set its options, and inspect them
- -Organize hosts and loot with workspaces
Metasploit is the single tool people mean when they say "just fire it off in msf." It bundles thousands of , , scanners, and -exploitation tools behind one console, and it keeps track of every and you touch. The is huge, but the mental model is small. Learn the model and the is lookup.
Start the database first, then the console. On Kali the database is PostgreSQL, and Metasploit uses it to store hosts, services, and loot across sessions.
$sudo msfdb init$msfconsole -q$db_statusEverything is a module
The whole framework is organized into module types, and every command you run is really "pick a module, configure it, run it." Five types cover almost everything you'll do:
- exploit takes advantage of a specific to code running.
- payload is the code that runs after the exploit lands, like a reverse .
- auxiliary does everything that is not exploitation: scanners, fuzzers, login brute-forcers.
- post runs against a session you already have, for looting and pivoting.
- encoder reshapes a payload's bytes, usually to dodge a bad character.
When msfconsole starts it prints the counts, something like 2300 exploits, 1200 auxiliary, 400 post. Those numbers are your library.
Load one and read it
You select a module with use, and your prompt changes to show what you're holding. Then info tells you what it does and options tells you what it needs.
$use auxiliary/scanner/ssh/ssh_version$info$options$set RHOSTS 10.10.10.5$runOptions with yes in the Required column must be filled before the module will run. RHOSTS is the remote target, RPORT its , LHOST your address for callbacks, LPORT your listening port. Get in the habit of running options right before run so you catch a blank RHOSTS before it wastes your time.
Some settings apply to every module in the session. Set your own IP once with setg LHOST 10.10.14.7 (the g is for global) and you won't retype it for the rest of the engagement. Clear one with unset, or wipe all globals with unsetg.
Workspaces keep engagements apart
By default everything lands in the default workspace. On a real assessment you want each or box separated so hosts and loot don't blur together. Workspaces are how you do that, and it takes two commands.
$workspace -a acme_internal$workspace$db_nmap -sV 10.10.10.5$hostsdb_nmap is regular with its output piped into the database, so after a scan the hosts and services tables fill themselves. That is the payoff of running the database: your recon becomes queryable instead of scrolling back through terminal history.
Metasploit throws real exploits at real machines. Only point it at systems you own or have explicit written permission to test, like Hack The Box, a local lab VM, or a scoped engagement. Running an exploit module against a host you are not authorized to touch is a crime in most places, full stop.
You have a Meterpreter session on a box and want to dump its saved credentials. Which module type do you reach for?