Typorithm · hard

Metasploit Framework

metasploitpentestexploitmeterpreter

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Metasploit Framework

Exploitation

Metasploit is the standard exploitation framework. In an authorized test you search for and use a module, set options like RHOSTS and the payload, then run it to obtain a session (often Meterpreter) — validating that a known vulnerability is actually exploitable, not just theoretical. The fix is patching.

Metasploit is the industry-standard framework for validating exploitability during authorized engagements. msfconsole gives you a searchable database of exploit modules; search filters it by type and platform so you can match a module to a confirmed finding.

use selects a module, then set configures its options — most importantly RHOSTS (the in-scope target) and the payload. run executes the module against that target, and on success it opens a session, frequently a Meterpreter session that supports post-exploitation tasks.

The point is impact validation: a CVSS score on a scanner report is a hypothesis, but a returned session is proof. That evidence drives the real remediation — patch the host (MS17-010 was fixed years ago) and reduce exposure of the vulnerable service.

search/use load an exploit module by type and platform.

set RHOSTS and the payload configure the module before run.

run returns a session (often Meterpreter); remediation is patching.

msfconsole -q
search type:exploit platform:windows
use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS 10.0.0.5
run

Read the implementation

Connect each part of the code to the concept before you type.

1. Launch the console

msfconsole starts the Metasploit Framework; -q suppresses the banner for a quiet start in an authorized engagement.

msfconsole -q

2. Find a module

search filters the module database by type and platform so you can locate an exploit matching a confirmed finding.

search type:exploit platform:windows

3. Select a module

use loads a specific exploit module into the active context so its options can be configured.

use exploit/windows/smb/ms17_010_eternalblue

4. Set the target

RHOSTS names the in-scope target host; it must always be inside the authorized engagement's defined scope.

set RHOSTS 10.0.0.5

5. Launch the module

run fires the exploit; on success it returns a session, often Meterpreter, proving the vulnerability is genuinely exploitable.

run

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.