Metasploit is an open-source penetration testing framework for identifying, validating, and demonstrating security vulnerabilities in authorized environments. It provides exploit modules, payloads, auxiliary scanners, and post-exploitation tooling under the MSFconsole interface.

Yes — the Metasploit Framework is free and open source. Rapid7 sells Metasploit Pro (commercial) with a web UI and automation; this guide covers only the free Framework.

Metasploit is legal security software. Using it against systems you own or have explicit written authorization to test is standard professional practice; using it otherwise may violate computer-misuse laws and terms of service.

MSFconsole is Metasploit’s primary interactive CLI. You search modules, configure options, launch exploits and scanners, manage sessions and jobs, and run Meterpreter commands from it.

Meterpreter is an in-memory, extendable Metasploit payload that communicates over an encrypted channel, avoids writing files to disk, and offers a rich post-exploitation command set.

Payloads are the code that executes on the target after exploitation. They vary by platform, architecture, staging (staged vs stageless), and connection type (reverse, bind).

Auxiliary modules perform non-exploit tasks: port scanning, service version detection, brute force, fuzzing, and information gathering. They never deliver a payload.

MSFvenom is Metasploit’s payload generator/encoder, replacing legacy msfpayload and msfencode. It produces payloads in 40+ formats (EXE, ELF, PS1, PHP, C, and more).

Yes, with the right sequence: learn networking and Nmap first, then auxiliary scanners, then simple exploits in an isolated lab, then Meterpreter and post-exploitation. Jumping straight to exploits creates bad habits.

OffSec’s OSCP and related courses, eJPT (INE Security), PNPT (TCM Security), and many vendor security certifications use Metasploit. Check each program’s current syllabus.

Linux (Kali, Debian/Ubuntu via Rapid7 apt repo), Windows, and macOS all have official support. The Framework is Ruby-based and runs on most Unix-like systems.

Nmap discovers hosts, ports, services, and OS. Metasploit validates findings with exploits and auxiliary modules. Typical flow: Nmap finds candidates → Metasploit confirms them.

No — core console use works without one. But the PostgreSQL database (msfdb init) adds hosts, services, vulns, creds, and loot, which professional workflows and reporting need.

Staged payloads send a small stager that downloads the main payload (small, needs a handler). Stageless payloads embed everything (larger, single connection). Names: meterpreter/reverse_tcp vs meterpreter_reverse_tcp.

-j runs the module as a background job so the console stays interactive while the exploit and its handler run.

A handler (exploit/multi/handler) is the listener that catches reverse connections from payloads you generated with MSFvenom. PAYLOAD/LHOST/LPORT must match the generated payload exactly.

They are aliases in MSFconsole — both launch the loaded module. Some consoles display run for auxiliary modules and exploit for exploit modules, but either works.

A .rc file containing MSFconsole commands that executes with resource file.rc (or msfconsole -r file.rc) — the standard way to automate repeatable setups like handlers.

A Meterpreter command that attempts to elevate the current Windows session to SYSTEM via known token-impersonation techniques. It fails when no viable path exists — then use local_exploit_suggester.

A post module (post/multi/recon/local_exploit_suggester) that inspects the session’s OS and suggests local privilege-escalation modules likely to work.

run post/windows/gather/hashdump dumps Windows SAM password hashes — requires SYSTEM or admin. In labs it demonstrates credential-access post-exploitation; the hashes are evidence for the report.

Pivoting routes traffic through an existing session to reach networks the attacker couldn’t otherwise access — via route add or Meterpreter portfwd. Lab-only: stay inside scope.

msfdb is the helper that manages Metasploit’s PostgreSQL database: msfdb init, msfdb run, msfdb status, msfdb stop, msfdb reinit.

Use db_nmap <args> — it runs Nmap and automatically stores hosts/services in the database, queryable via hosts and services.

From msfconsole: sessions -u <id> (auto-upgrade) or run post/multi/manage/shell_to_meterpreter with the session ID.

Four usual causes: wrong options, handler mismatch, firewall/AV interference, or the exploit actually failed silently. Check options → handler → target → network, in that order.

setg sets a global option that persists across module changes — ideal for LHOST, which every payload/handler needs.

search cve:2021-44228 or search cve:2021 for all 2021 CVEs. Combine with type: and rank: filters.

Encoders transform payload bytes to avoid bad characters (e.g., \x00) or to evade signature detection in AV-evasion labs. Encoding is not a guarantee of evasion — modern AV/EDR inspects behavior.

Yes. Modern EDR/AV products detect Meterpreter’s network signatures and behavior, and the default ports are well-known. Detection is expected in realistic exercises.

A bind shell listens on the target (you connect to it); a reverse shell connects back to you. Reverse shells are preferred because outbound connections usually pass firewalls more easily.

spool /path/file.log writes all console output to a file until you run spool off. Do this at the start of every engagement.

db_import file.xml imports Nmap XML, Nessus, OpenVAS, and other formats into the database for correlation.

loot lists files collected during post-exploitation — hash dumps, screenshots, downloaded documents — stored by post modules for evidence and reporting.

notes -a "text" stores free-form observations in the database, and notes displays them — the simplest structured documentation tool in Metasploit.

Yes, but cloud security groups and WAFs filter most scans, and scanning cloud providers’ shared infrastructure requires their authorization policies. Always validate scope first.

Kali (attacker) + intentionally vulnerable VMs (Metasploitable 2/3, DVWA, Windows VMs with known-bad patches) on an isolated NAT network. Snapshot before every exercise.

Metasploitable is a deliberately vulnerable Ubuntu VM maintained by Rapid7 for safe Metasploit practice. Version 2 is a legacy 32-bit target; version 3 has a hardened network stack that changes scan behavior — useful for realism.

Yes — SOC teams run known exploits in controlled labs to validate detection coverage and tune alerting. “Can we detect this?” is a legitimate Metasploit use case.

The exploit is the code that triggers the vulnerability; the payload is the code that runs afterward. One exploit can often pair with many payloads — hence show payloads.

Kali: sudo apt update && sudo apt install --only-upgrade metasploit-framework. Rapid7 repo users: same apt path. Updates deliver new modules and fixes.

The prompt shows the active module context: msf6 > (no module), msf6 auxiliary(...)>, msf6 exploit(...)>, or meterpreter > inside a session.

Type background or press Ctrl+Z to background the session. Type exit to terminate the session entirely.

check runs a module’s safe detection logic to test whether the target appears vulnerable — without exploitation. Results: vulnerable, safe, or unknown. Not all modules support it.

A session is an established connection to a target (shell or Meterpreter). A job is a backgrounded module — often a handler or an exploit running with -j.

It is a standard tool in many CTFs, but CTF machines are intentionally vulnerable and often require manual exploitation. Use Metasploit alongside manual techniques — never as the only hammer.