Metasploit Framework
The Metasploit Framework is a widely used penetration-testing platform containing exploit, auxiliary and post-exploitation modules.
Legal & ethical use. Exploitation tools must only be used against systems you have explicit written authorisation to test. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Validate that a patch removed a vulnerability in your lab
- Practise on intentionally vulnerable machines such as Metasploitable
- Learn the structure of exploit modules
Key features
- Large module library
- Payload generation (msfvenom)
- Database integration
- Meterpreter post-exploitation
Installation
See docs.metasploit.com for installers and Kali/Debian packages (Metasploit is preinstalled on Kali Linux).
Beginner usage guide
Use msfconsole, `search` for a module relevant to your lab target, read `info` before running, set RHOSTS to your lab machine and run `check` where supported.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Start the console and search
msfconsole -qStarts quietly; then run `search type:auxiliary name:smb_version` to find a module.
Show module information
info auxiliary/scanner/smb/smb_versionRun inside msfconsole to read options and references before using a module.
Keep learning
🎓 Learning path: Ethical Testing
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Commands were written from the official documentation and have not been executed on this site; test them in your lab.