Practical Metasploit

Foundations

What Is Metasploit

1. Why Metasploit for penetration testers
2. How Metasploit works
3. The seven components
4. Glossary

Modules and Framework Architecture

1. Understanding the Metasploit module directory structure
2. Auxiliary modules
3. Payloads
4. Filesystem and libraries
5. Encoders
6. NOPs
7. ATT&CK metadata

Building Your Attack Lab

1. Installing the Metasploit Framework
2. Installing on Kali Linux
3. Launch msfconsole in Kali
4. DNS configuration
5. Keeping the lab current

The msfconsole Workflow

1. Metasploit commands
2. Getting help for msfconsole commands
3. Searching for exploits with keywords
4. Datastore
5. Finding modules
6. Understanding module options
7. Use, back, and exit commands

The Metasploit Database

1. Initialize the Metasploit PostgreSQL database
2. Database support
3. Database workspaces
4. Example workflow
5. Keep your Metasploit data safe
6. Using msfdb
7. Exploitation

Service Discovery and Scanning

1. Port scanning
2. Scanner HTTP auxiliary modules
3. Auxiliary module examples
4. Vulnerability scanning with Metasploit
5. A TCP port scanner
6. The Metasploitable scanning lab

Staged versus Stageless Payloads

1. How payloads work
2. What are staged payloads?
3. What are stageless payloads?
4. Staged versus stageless handlers
5. Connecting stageless payloads to staged handlers
6. Stageless mode
7. Working with payloads

Generating Payloads with msfvenom

1. Introducing msfvenom
2. How to use msfvenom
3. Output formats
4. Handlers
5. Advanced msfvenom payload generation
6. A worked example

Exploitation and Session Management

1. Working with exploits
2. Working with sessions
3. Checking target availability
4. Manage Meterpreter and shell sessions
5. Setting up a payload
6. Basic workflow
7. Meterpreter and Post-Exploitation

Meterpreter Fundamentals

1. What is Metasploit Meterpreter?
2. How Meterpreter works
3. Meterpreter flavors
4. Core commands
5. File system commands
6. Help
7. Meterpreter transport control
8. The lab

Migration and Privilege Escalation

1. Meterpreter getsystem
2. Migrate
3. priv_migrate
4. System commands
5. Other commands
6. The escalation lab

Pivoting and Routing

1. How pivoting works
2. Route-based pivoting
3. Port forwarding

Credentials, Persistence, and Lateral Movement

1. About post-exploitation
2. hashdump
3. Post-exploitation modules by category
4. Lateral movement and persistence
5. Extending the Framework

Resource Scripts and Automation

1. Resource scripts
2. Six ways to automate Metasploit
3. Automating the Metasploit console
4. Basic workflow

Writing Custom Auxiliary Modules

1. Writing an auxiliary module
2. How to add a third-party module
3. Running private modules
4. Navigating the codebase
5. Using Rex::Proto::Http::Client
6. The Exploit::Remote::Tcp mixin
7. Module documentation

Writing Your First Exploit

1. Building your first Metasploit exploit
2. Setting up a Metasploit development environment
3. Writing module documentation

Railgun and the Windows API

1. Using Railgun for Windows post-exploitation
2. Defining a DLL and its functions
3. MSF Meterpreter and Railgun
4. Evasion and Modern Context

Encoders and Evasion Limits

1. Encoders
2. AV bypass with Metasploit templates
3. A defender’s checklist
4. Detecting Metasploit attacks
5. Hardening and defensive takeaways

Keeping Modules Current

1. Metasploit 6 in development
2. Metasploit Framework 6.0 release notes
3. Metasploit Framework 6.4
4. The 6.5 MCP server
5. When the APT repo falls behind
6. Reading the release notes
7. Future trends and emerging considerations

Appendix A: Command and module cheat sheet

1. Console startup
2. Navigation and workflow
3. Module layout
4. Payloads and msfvenom
5. Database commands
6. Sessions, jobs, handlers
7. Meterpreter commands
8. Pivoting
9. Post module pick list
10. Ranks and check codes
11. Resource scripts

Appendix B: Framework release history

1. Major releases
2. Version numbering and release cadence
3. Module inventory over time
4. Compatibility breaks
5. Editions and licensing

Appendix C: Auxiliary and post module index

1. Auxiliary modules
2. Post modules

Glossary

References