Today we will have a look at Metasploit which is one of the be | Ethical Hacking Tutorials
Today we will have a look at Metasploit which is one of the best Exploitation framework owned by Rapid7 and is integrated with many exploits to completely destroy our target. Metasploit is written in Ruby Language and comes pre-packaged with many exploits, scanners, encoders which can perform different tasks. Metasploit has a large database which has more than 2000 exploits related to all the protocol versions and also related to Windows, Linux and much more.
Features: 1. It comes pre-packaged with Kali Linux and parrot OS . 2. It is constantly updated and new exploits are added to it in every 2 to 3 days. 3. It also has the capability to scan the target for open ports and also for vulnerabilities.They are called auxillary modules. 4. Whenever an interesting exploit is discovered it is soon added to the Metasploit Framework. 5. It also has an additional functionality called as meterpreter which is a kind of shell with very advance functionalities. 6. It can be used for both exploitation and post-exploitation. 7. It also include exploit related to Android devices and also related to voip and other attacks. 8. It also has capability to attack various IOT devices. 9. With msfvenom we can create a malacious payload which when executed cam be used to gain access to our target machine
Some Important Terms:
Exploit: It is a piece of code which triggers the vulnerability and successfully exploit it
Payload: It is the preice of code which is run after the exploit has successfully executed on the victim. The payload can be made to gain shell or to perform malacious tasks.
How to Use ?
To launch Metasploit you can type the command "msfconsole" on your terminal.
>>msfconsole
#Now we would see that the Metasploit has loaded and we are greeted with a banner
To change the banner we can use the banner command on the msf terminal. msf> banner
To make the loading of Metasploit even faster we can start postgresql service.
>>service postgresql start
How to Use ?
1. search utility - search is used to search for strings such as msf>search exploits - search for all the exploits search MySQL - search for all exploit and auxillary with keyword MySQL . search ftp - Search for all modules having word ftp
@ Like this we can search for exploits and auxillary modules related to our needs
2. Now when you have selected which exploit you want to use now we have to select that exploit . We can do that by 'use' command. msf>use exploit/ftp/vsftpd2.3.4 This will load the specified exploit and you will notice that the exploit name is shown in red color. This is a indication that the exploit was successfully loaded.
3. Now we have to set some options which we need to run the exploit. The options may include the RHOST, LHOST, LPORT and sometimes password or hashes or even wordlists.
