⚠️ AUTHORIZED USE ONLY > This skill is for educational purposes or authorized security assessments only. > You must have explicit, written permission from the system owner before using this tool. > Misuse of this tool is illegal and strictly prohibited.

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited. Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target: 1. Ask the user to state the exact target URL, IP, account, or resource. 2. Ask the user to confirm written authorization and the permitted scope. 3. Show the exact command(s) and explain their expected effect. 4. Wait for explicit confirmation in the current conversation. Without that confirmation, remain read only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab. Metasploit Framework Purpose Leverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation through post exploitation activities. Metasploit provides a unified platform for vulnerability exploitation, payload generation, auxiliary scanning, and maintaining access to compromised systems during authorized security assessments. Prerequisites Required Tools Installation varies by operating system and package source. Follow your platform's documented package manager or vendor installation process before using this skill. Do not rely on an unpinned remote installer script from inside this skill. If you want database backed features such as workspace tracking, initialize msfdb using the instructions for your local installation. This skill assumes Metasploit is already available and does not require sudo , systemctl , or other privileged host level setup steps. Required Knowledge Network and system fundamentals Understanding of vulnerabilities and exploits Basic programming concepts Target enumeration techniques Required Access Written authorization for testing Network access to target systems Understanding of scope and rules of engagement Before running exploit modules, ask the user to confirm the exact target host, scope, and authorization state. Outputs and Deliverables 1. Exploitation Evidence Screenshots and logs of successful compromises 2. Session Logs Command history and extracted data 3. Vulnerability Mapping Exploited vulnerabilities with CVE references 4. Post Exploitation Artifacts Credentials, files, and system information Core Workflow Phase 1: MSFConsole Basics Launch and navigate the Metasploit console: Phase 2: Module Types Understand the different module categories: Phase 3: Searching for Modules Find appropriate modules for targets: Phase 4: Configuring Exploits Set up an exploit for execution: Phase 5: Payload Types Select appropriate payload for the situation: Phase 6: Meterpreter Session Work with Meterpreter post exploitation: Phase 7: Auxiliary Modules Use auxiliary modules for reconnaissance: Phase 8: Post Exploitation Modules Run post modules on active sessions: Phase 9: Payload Generation with msfvenom Create standalone payloads: Phase 10: Setting Up Handlers Configure listener for incoming connections: Quick Reference Essential MSFConsole Commands Command Description search [term] Search for modules use [module] Select a module info Display module information show options Show configurable options set [OPT] [val] Set option value setg [OPT] [val] Set global option run / exploit Execute module check Verify target vulnerability back Deselect module sessions l List active sessions sessions i [N] Interact with session jobs l List background jobs db nmap Run nmap with database Meterpreter Essential Commands Command Description sysinfo System information getuid Current user getsystem Attempt privilege escalation hashdump Dump password hashes shell Drop to system shell upload/download File transfer screenshot Capture screen keyscan start Start keylogger migrate [PID] Move to another process background Background session portfwd Port forwarding Common Exploit Modules Constraints and Limitations Legal Requirements Only use on systems you own or have written authorization to test Document all testing activities Follow rules of engagement Report all findings to appropriate parties Technical Limitations Modern AV/EDR may detect Metasploit payloads Some exploits require specific target configurations Firewall rules may block reverse connections Not all exploits work on all target versions Operational Security Use encrypted channels (reverse https) when possible Clean up artifacts after testing Avoid detection by monitoring systems Limit post exploitation to agreed scope Troubleshooting Issue Solutions Database not connected Run sudo msfdb init , start PostgreSQL, then db connect Exploit fails/no session Run check ; verify payload architecture; check firewall; try different payloads Session dies immediately Migrate to stable process; use stageless payload; check AV; use AutoRunScript Payload detected by AV Use encoding e x86/shikata ga nai i 10 ; use evasion modules; custom templates When to Use This skill is applicable to execute the workflow or actions described in the overview.

metasploit-framework