Metasploit Framework is the most widely used penetration testing platform in the world. Released as open source in 2003 by HD Moore, it has grown from a collection of exploit scripts into a complete penetration testing platform with over 2,300 exploits, 1,000+ auxiliary modules, 500+ payloads, and a full post-exploitation framework. Every major penetration testing methodology — PTES, OWASP, NIST SP 800-115 — references or builds on workflows that Metasploit implements.
For security professionals, Metasploit is not optional knowledge. It appears in OSCP, CEH, CompTIA PenTest+, and GPEN certification exams. It is the tool defenders need to understand deeply — because attackers use it daily, and because running Metasploit against your own infrastructure with defensive monitoring active is one of the most effective ways to test whether your EDR, SIEM, and network controls actually catch what they claim to catch.
This tutorial takes you from installation through the full penetration testing workflow: reconnaissance with auxiliary modules, exploitation, Meterpreter post-exploitation, pivoting, and reporting — with real commands at every stage and explanations of exactly what each command does and why.
- What is Metasploit Framework?
- Installation on Kali Linux and other platforms
- Metasploit architecture — modules, payloads, and database
- msfconsole — essential commands and workflow
- Reconnaissance with auxiliary modules
- Finding and running exploits
- Meterpreter — complete post-exploitation guide
- Pivoting and network tunnelling
- Evasion techniques and payload generation
- Complete pentest workflow — putting it all together
- Frequently asked questions
The Metasploit Framework (MSF) is an open-source penetration testing platform that provides a unified interface for discovering, exploiting, and post-exploiting vulnerabilities in target systems. It is maintained by Rapid7, available free on GitHub, and ships pre-installed in Kali Linux and Parrot OS.
Metasploit is not just an exploit launcher. Its value is the complete penetration testing workflow it enables: network scanning and service enumeration, vulnerability identification, exploit selection and configuration, payload delivery, post-exploitation including privilege escalation, credential harvesting, lateral movement and pivoting, and persistence. Each stage integrates with the next, with all results stored in a central database that tracks every host, service, credential, and note across the engagement.
Metasploit Framework (free, open source): The command-line tool available on GitHub and pre-installed in Kali Linux. Full exploit and payload capability, msfconsole interface, database integration, and all features covered in this tutorial. This is what OSCP tests you on and what most penetration testers use daily.
Metasploit Pro (commercial, Rapid7): Adds a web-based GUI, automated exploitation workflows, advanced reporting, phishing campaign management, and team collaboration features. Used by enterprise red teams and MSSPs. Starts at approximately $15,000/year. For individual learning and professional use, the free Framework is everything you need.
Metasploit Framework is pre-installed in Kali Linux. If it is not running or needs updating:
Before practising Metasploit, you need authorised target systems. The most common lab setups:
- Metasploitable 2 / 3 — deliberately vulnerable Linux VMs designed for Metasploit practice. Download from Rapid7's GitHub. Run in VirtualBox or VMware on a host-only network.
- TryHackMe / Hack The Box — legal cloud-based vulnerable machine platforms. TryHackMe has excellent beginner Metasploit rooms. Hack The Box has retired machines that are Metasploit-friendly.
- DVWA (Damn Vulnerable Web Application) — for practising web exploitation modules.
- Your own VMs — set up intentionally vulnerable configurations in an isolated VirtualBox host-only network that has no internet or production network access.
Everything in Metasploit is a module. Understanding the module types is fundamental — every command in msfconsole works by selecting, configuring, and running a module of a specific type.
| Payload type | How it works | Size | When to use | Example |
|---|---|---|---|---|
| Single (inline) | Self-contained — the entire payload is in one piece. Executes immediately without needing to contact the attacker machine first. | Larger | When you need a simple one-shot payload with no separate handler — adding a user, running a command | windows/shell_reverse_tcp |
| Stager | Small first-stage payload that establishes a connection back to the attacker's handler and downloads the second stage (Stage) from it. | Tiny (~250 bytes) | When exploit has size constraints — buffer is small, cannot fit a full payload. Stager fits in the buffer, then pulls the full Meterpreter. | windows/x64/meterpreter/reverse_tcp (stager part) |
| Stage | Full-featured payload downloaded by the Stager after the connection is established. Meterpreter is a Stage — it is the full interactive shell loaded into memory. | Large | Always used with a Stager. Loaded into target memory without touching disk — important for EDR evasion. | windows/x64/meterpreter (the stage) |
- Reverse shell (reverse_tcp, reverse_https): The target connects back to the attacker's IP and port. The attacker runs a listener (handler) waiting for the connection. Reverse shells work through NAT and most firewalls — the outbound connection from the target is usually permitted. Most commonly used.
- Bind shell (bind_tcp): The payload opens a listening port on the target. The attacker connects to the target. Requires the target's firewall to permit inbound connections to the listening port. Less common — blocked by most firewalls and perimeter controls.
- Reverse HTTPS: Reverse connection over HTTPS (port 443). The encrypted traffic blends with normal HTTPS and is harder to detect. Preferred for engagements where IDS/IPS might catch plain TCP. Requires an SSL certificate on the handler.
| Command | What it does | Example |
|---|---|---|
| search | Find modules by keyword, CVE, platform, or type | search type:auxiliary smb |
| use | Load and select a module | use auxiliary/scanner/smb/smb_ms17_010 |
| info | Show detailed info, description, and options for a module | info exploit/multi/handler |
| show options | Display all options for the current module | show options |
| show payloads | List payloads compatible with the current exploit | show payloads |
| set / setg | Set option value (setg = global across modules) | set RHOSTS 192.168.1.0/24 |
| unset | Clear an option value | unset RHOSTS |
| run / exploit | Execute the current module | run -j (run as background job) |
| check | Test if target appears vulnerable (module must support it) | check |
| back | Deselect current module, return to root prompt | back |
| sessions | List, interact with, or kill sessions | sessions -i 2 |
| jobs | List background jobs (handlers running in background) | jobs -K (kill all jobs) |
| db_nmap | Run Nmap and import results directly to MSF database | db_nmap -sV 10.0.0.0/24 |
| hosts / services | Query the database for discovered hosts and services | hosts -c address,os_name |
| vulns | List vulnerabilities recorded in the database | vulns |
| creds | List captured credentials in the database | creds -u admin |
| load | Load a plugin (e.g. load prism for event logging) | load aggregate |
| resource | Execute a file of msfconsole commands (script automation) | resource /path/to/setup.rc |
| spool | Log all console output to a file | spool /tmp/engagement.log |
| exit | Exit msfconsole (prompts to confirm if sessions active) | exit -y |
Before running any exploits, you need to know what is on the network and what services are running. Metasploit's auxiliary module library covers every major service and protocol. Combined with Nmap (which feeds results directly into the database via db_nmap), this gives you a comprehensive picture of the attack surface.
When multiple exploits target the same vulnerability, Metasploit ranks them by reliability:
| Rank | Meaning | Use it? |
|---|---|---|
| ExcellentRanking | Reliable exploit, will not crash or corrupt the service, clean return | Always prefer this rank |
| GreatRanking | Reliable default option, handles return address automatically | Good choice |
| GoodRanking | Works under common configurations, minor assumptions | Use if Excellent/Great unavailable |
| NormalRanking | Reliable but requires specific configuration, no automatic target | Use carefully, test in lab first |
| AverageRanking | May crash the service or require specific conditions | Last resort, lab only |
| LowRanking | Often crashes, inconsistent, significant conditions required | Avoid unless no alternative |
| ManualRanking | Denial of service or requires significant manual interaction | Rarely in production testing |
Meterpreter (Meta-Interpreter) is Metasploit's advanced payload and shell. Unlike a standard OS shell, Meterpreter runs entirely in memory — it is injected into a process on the target without writing to disk, making it harder for traditional antivirus to detect. It communicates over an encrypted channel and provides a rich set of built-in commands for post-exploitation.
Pivoting is using a compromised host as a relay to reach other network segments that are not directly accessible from your attacker machine. It is essential in internal network penetration tests where the initial foothold is in a DMZ or user VLAN, but the interesting targets (domain controllers, databases) are in a separate, firewalled segment.
msfvenom is Metasploit's standalone payload generator. It combines msfpayload and msfencode (both deprecated) into a single tool for generating payloads in virtually any format — executables, shellcode, scripts, documents, and more.
Here is a complete, end-to-end penetration test workflow using Metasploit against a lab environment. This mirrors the workflow used in real authorised engagements and in the OSCP exam.
⚡ Building real Metasploit skills
- Set up Metasploitable 2 in VirtualBox this week — download Metasploitable 2 from Rapid7's GitHub, run it in a host-only VirtualBox network, and work through each service systematically. This is the most important first hands-on step. The combination of Kali Linux attacker VM and Metasploitable 2 target gives you a safe, legal environment to practise every technique in this guide.
- Complete TryHackMe's Metasploit learning path — TryHackMe has a free, structured Metasploit learning path with guided rooms that take you from msfconsole basics through Meterpreter and post-exploitation. Recommended for complete beginners before attempting unguided machines.
- Practise on Hack The Box retired machines — HTB's retired machines have published walkthroughs that typically include Metasploit solutions. Start with "Blue" (MS17-010), "Legacy" (MS08-067), and "Lame" (vsftpd/Samba). These are classic Metasploit learning machines.
- Understand what you are exploiting — read the CVE description and original vulnerability research for every exploit you run. Understanding why an exploit works (buffer overflow mechanics, use-after-free, deserialization) makes you a better penetration tester and makes your reports more valuable to clients. CVE explained guide →
- Learn what defenders see when you run Metasploit — run Metasploit in your lab with your SIEM and EDR active and watch what they detect. This bidirectional understanding — attacker tool + defender visibility — is what separates junior penetration testers from senior ones. Cybersecurity career roadmap →
Metasploit Framework is used for penetration testing — the authorised, professional practice of testing an organisation's security by attempting to exploit vulnerabilities, exactly as a real attacker would. It is used by professional penetration testers, red teams, security researchers, and bug bounty hunters to discover and demonstrate vulnerabilities in networks, operating systems, web applications, and services. It is also used by defenders who run it against their own infrastructure to test whether their security controls (EDR, SIEM, network firewalls) detect and block real attacks. Unauthorised use against systems you do not own is illegal.
Metasploit itself is legal — it is an open-source tool with legitimate security research and professional use cases. Using Metasploit against systems you own or have explicit written permission to test is legal. Using it against any system without permission is illegal under the Computer Fraud and Abuse Act (US), Computer Misuse Act (UK), and equivalent legislation in virtually every other jurisdiction. Written authorisation — specifying the scope, dates, and permitted techniques — is required before beginning any penetration test with Metasploit or any other exploitation tool.
Metasploit Framework is the free, open-source command-line tool available on GitHub and pre-installed in Kali Linux. It includes all exploit modules, payloads, auxiliary modules, Meterpreter, and the database-backed workspace — everything a professional penetration tester needs. Metasploit Pro is a commercial product from Rapid7 that adds a web-based GUI, automated exploitation workflows, phishing campaign management, advanced reporting, and team collaboration features. It starts at approximately $15,000 per year. For learning and most professional use, the free Framework is complete and sufficient.
Meterpreter is Metasploit's advanced payload that runs entirely in memory on the target system — it is injected into a process without writing any files to disk, making it harder for traditional antivirus to detect. Unlike a standard operating system shell (cmd.exe, /bin/bash), Meterpreter provides built-in commands for file transfer, privilege escalation, credential harvesting, keylogging, screenshot capture, process migration, pivoting, and persistence — all over an encrypted channel. It also supports extension loading (like the kiwi extension for Mimikatz functionality). When you have a choice, Meterpreter is almost always preferable to a plain shell for post-exploitation activities.
A reverse shell has the target connect back to the attacker's listener. The attacker runs a handler waiting for connections — the target initiates the outbound connection when the payload executes. Reverse shells work through NAT and most firewalls because outbound connections are typically permitted. A bind shell opens a listening port on the target and the attacker connects to it. Bind shells require the target's firewall to permit inbound connections to the listening port, which is usually blocked. For this reason, reverse shells are used in almost all real penetration tests and reverse_tcp or reverse_https payloads are the default choice.
Standard Metasploit payloads without modification are detected by all major modern antivirus and EDR platforms — they are well-known signatures. Basic encoding (shikata_ga_nai) adds minimal value against modern detection. In authorised penetration tests designed to test realistic adversary capability, testers typically use Metasploit in combination with custom loaders, process injection techniques, or commercial C2 frameworks (Cobalt Strike, Brute Ratel) that implement more sophisticated evasion. For learning and lab practice, Metasploit payloads work perfectly against unprotected systems and against older AV. For testing modern EDR, understanding the evasion techniques required is part of advanced red team training.
OSCP (Offensive Security Certified Professional) is the most respected certification that tests Metasploit — with the important caveat that you can only use it against one machine in the exam and must compromise others manually. CompTIA PenTest+ includes Metasploit in its exam objectives and is a good entry-level certification. CEH (Certified Ethical Hacker) covers Metasploit theory and some practical usage. GPEN (GIAC Penetration Tester) also covers Metasploit as part of its methodology. For pure Metasploit skill development, completing TryHackMe and Hack The Box machines — tracking which ones you solved with Metasploit vs manually — is more valuable than any single certification.