Metasploit basics (in the lab)

What Metasploit is

The Metasploit Framework is a free, open-source toolkit that collects many known exploits in one place, with a consistent way to configure and run them. Instead of writing exploit code from scratch, a tester can select a module for a known issue, set a few options, and verify whether a target is vulnerable. It is used to prove and demonstrate findings, carefully, on authorised targets.

The main ideas

A typical lab flow is: search for a module that matches a vulnerability you found, use it, set the target (RHOSTS) and other options, check them, and run it against your Metasploitable VM. The point is to confirm a finding you can then report with its fix — not to cause damage.

# Inside msfconsole, against your own Metasploitable VM only:
search type:exploit name:vsftpd     # find a matching module
use <module path shown by search>   # select it
set RHOSTS 192.168.56.102           # your lab target
show options                        # check what still needs setting
# run only against your authorised lab target

Detection and defence

Detection: many Metasploit exploits and payloads have known signatures that intrusion detection systems and endpoint protection recognise, and they create unusual network connections a SIEM can flag. Defence: patch the vulnerabilities the modules target (the single most effective step), run endpoint protection and IDS/IPS, segment the network, and monitor for the connections a payload makes. If there is no unpatched vulnerability, the matching exploit simply fails.