Ethical Hacking Metasploit Basics
Metasploit is a popular framework that security professionals use to test whether known weaknesses are real. It bundles hundreds of ready-made test modules in one place. Use it only on lab machines or on systems with written approval.
What Metasploit Does
A scanner reports that a weakness might exist. Metasploit helps confirm the weakness with a controlled test. The confirmation lets the team prove the risk and justify the fix.
Core Building Blocks
| Part | Plain Meaning |
|---|---|
| Exploit | The method that uses a weakness |
| Payload | The action that runs after the weakness is used |
| Auxiliary | Helper modules such as scanners |
| Post | Modules that run after access is gained |
| Encoder | Changes the payload's form |
Think of a delivery truck. The exploit is the key that opens the gate, and the payload is the package carried inside.
The Metasploit Workflow
[Pick Module]
|
v
[Set Options: target address, port]
|
v
[Choose Payload]
|
v
[Run Test]
|
v
[Check Result + Record Proof]
Starting the Console
The command msfconsole opens the Metasploit prompt. The first launch may take a minute because the database loads.
Basic Commands
- search name: finds modules that match a word.
- use module: selects a module.
- show options: lists the settings the module needs.
- set RHOSTS address: sets the target machine.
- run or exploit: starts the module.
- back: leaves the current module.
Lab Example
Students practice on Metasploitable, a deliberately weak virtual machine built for learning. The lab uses two machines on a private network.
[Kali Linux VM] ---- private lab network ---- [Metasploitable VM] (tester) (practice target)
The tester scans the practice machine, finds an old file service, searches Metasploit for a matching module, sets the target address, and runs the test. A successful result shows a session, which proves the old service is unsafe.
Understanding Sessions
A session is a live connection between the tester and the target after a successful test. The sessions command lists all active connections. Testers record what the session proves and close it. Leaving sessions open is careless and risky.
Meterpreter in Simple Words
Meterpreter is a payload that gives a tester a toolbox on the target. It runs in memory and offers commands to view system details, browse files, and capture proof. In a legal lab, learners use it to understand what an attacker could do, which helps them write better defenses.
Metasploit Limits
Modules target known weaknesses only. A fully patched system often resists them. Real tests need manual thinking and other tools as well.
Responsible Use
- Test only systems you own or have written approval for.
- Back up fragile systems before testing, since some modules crash services.
- Record every step for the final report.
- Close sessions and remove test files when finished.
Defense Lessons
Every successful module teaches a fix. Apply patches quickly, close unused services, and watch logs for strange connections. Blue teams often run Metasploit in their own labs to learn which alerts their tools raise.
Reading Module Rankings
Metasploit labels each exploit module with a reliability rank, such as excellent, great, good, or normal. An excellent rank means the module rarely crashes the target. Testers prefer higher ranks on real client systems, since a crash can interrupt business work.
Keeping Notes
Testers log the module name, the settings, the time, and the outcome of each run. Clear notes allow another team member to repeat the test and confirm the fix later.