What is Metasploit?

Metasploit is a powerful and widely-used penetration testing framework that allows security professionals to identify and exploit vulnerabilities in various systems. Whether you are a security enthusiast or a cybersecurity professional, mastering Metasploit can significantly enhance your skills in identifying potential risks and securing your own systems. In this comprehensive tutorial, we'll walk you through the basics of Metasploit and provide hands-on examples to demonstrate how to perform penetration testing effectively.

Getting Started

To begin, launch the Metasploit console by opening a terminal in your Kali Linux and typing:

msfconsole

Once the console loads, you'll see the Metasploit banner and a command prompt. We'll start by updating Metasploit's database using the following command:

msf> db_update

This ensures you have the latest module information and exploit data.

Example: Exploiting a Vulnerable Web Application

For this example, we'll use Metasploitable 2, a purposely vulnerable virtual machine designed for penetration testing practice. You can download it from here.

Step 1: Identify the Target

First, ensure that both your Kali Linux and Metasploitable 2 virtual machines are running and connected to the same network. Identify the target's IP address using the following command:

msf> ifconfig

Look for the IP address associated with the network interface of the Metasploitable 2 machine.

Step 2: Search for Exploits

Next, we need to search for relevant exploits in the Metasploit database. For this example, let's assume we are targeting a vulnerable version of the "DVWA" (Damn Vulnerable Web Application) running on the Metasploitable 2 machine. Search for related exploits using the following command:

msf> search dvwa

Step 3: Select an Exploit

From the search results, identify a suitable exploit. Let's use the "exploit/multi/http/dvwa_file_upload" exploit for this demonstration. To select the exploit, use the following command (replace 'exploit/multi/http/dvwa_file_upload' with the name of the exploit you chose):

msf> use exploit/multi/http/dvwa_file_upload

Step 4: Set the Exploit Options

Before launching the exploit, we need to set the required options, such as the target IP address and the port number. Use the following commands to configure the exploit accordingly (replace 'RHOSTS' and 'RPORT' with the target IP address and port, respectively):

msf> set RHOSTS <target_ip>
msf> set RPORT <target_port>

Step 5: Exploit the Vulnerability

With the options set, we are now ready to launch the exploit. Type the following command:

msf> exploit

If successful, Metasploit will exploit the vulnerability and provide you with access to the remote system.

Congratulations! You've successfully exploited a vulnerable web application using Metasploit. Remember, Metasploit is a potent tool, and it should only be used for ethical and legal purposes, such as penetration testing with proper authorization. Stay vigilant and continually practice your skills to become proficient in using Metasploit for securing systems and networks.

Here is a great youtube playlist to master Metasploit