Metasploit Review Lab
Octavious W.
Incident Response | Digital Forensics | Vulnerability Analysis | Security+ | CHFI | CEH | Cisco Certified CyberOps Associate | GFACT | GSEC (2025) | GCIH (2025)
TOPICS:
Getting Familiar with Metasploit
Vulnerability Scanning with WMAP
Configuring Exploits and Payloads
Getting Familiar with Metasploit:
Run the msfdb init command to initialize the Metasploit database
Run the service postgresql start command start the Postgres database server
Run the msfconsole command to launch the msfconsole
Once the console is launched, run the help command to learn about the basic Metasploit commands
Terminal commands like ifconfig can be used inside of the msfconsole
Run the connect command to use netcat within msfconsole to connect to services, and press CTRL-C to break the connection
Run the show all command to see all of the modules available in Metasploit
Run the show exploits command to see all of the exploits and payloads available in Metasploit
Run the show payloads command to see all of the payloads available in Metasploit
Vulnerability Scanning with WMAP:
WMAP is a web app vulnerability scanner in Metasploit
Run the load wmap command to load WMAP
Run the wmap_sites -h command to see options for managing the sites we want scan
Adding a site to scan
Run the wmap_sites -l command to confirm added sites
Run the wmap_targets -t command to select an available site as the target for the mutillidae module
Run the wmap_targets -l command to confirm added target site
Run the wmap_run -h command to see options for scanning the target site
领英推荐
Run the wmap_run -t command to see all the modules available to use against the target
Run the cat /root/profile command to see the profile that will be used in the WMAP scan
Use the wmap_run -e /root/profile command to run the scanner using the profile
Run the wmap_vulns -l command to list the vulnerabilities found during the scan
Configuring Exploits and Payloads
Use the search command to find exploits for a target software
Run the info command to learn how to use the specified exploit
Run the use command to load up the exploit
Run the show options command once the exploit is loaded to view and set up the available options
Run the set RHOST command to set the target for the exploit
Run the set payload command to choose the payload that will be delivered to the target server once the exploit is successful
Once the payload is selected, the show options command will include the payload options
Run the set LHOST command to set the listener for the attack machine
Once all the exploit options are set, run the exploit command to initiate the exploit
Resources:
Metasploit For Beginners - #1 - The Basics - Modules, Exploits & Payloads:
Use Metasploit's WMAP Module to Scan Web Applications for Common Vulnerabilities:
Information Security || Incident Response || PURPLE TEAM || Cyber-security || Cloud Security || Application Security || CSA || SOC || ISO 27001 || AZURE || AWS || DEVSECOP ||
1 年Great one ! Hoping to check it out, any pointers?
Cybersecurity & Education Specialist
1 年Why, praytell, are you starting up database servers when you messed around with Metasploit? Probably some next level stuff I’m unfamiliar with. I’m curious ??
Cloud Security & Compliance Leader | CEO @ Cyber Training Pro | YouTuber, Trainer, Career Coach, Mentor ?? | Developing Information Security Beginners Into Experts
1 年Awesome stuff Octavious! I encourage you to try and find a manual exploit of the vulnerability so you are also comfortable not having a tool at your disposal. Although we might not always go that far, it's likely to be a fun challenge to test your research skills!
Great refresher Octavious!