What Metasploit is
The Metasploit Framework is the most widely used exploitation framework in the world. It is open-source, maintained by Rapid7, and it ships by default on every offensive-security distribution — which makes it the de facto standard platform people learn exploitation on. When someone says they are "firing up Metasploit," they almost always mean the main interface, msfconsole: an interactive command-line shell that drives the entire framework.
The cleanest way to picture Metasploit is as a structured library of attack code plus the plumbing to configure and deliver it. On its own, a public exploit is a fragile script with hard-coded addresses and assumptions. Metasploit takes thousands of those scripts, wraps each in a common interface, and hands you a consistent set of controls: pick the attack you want, fill in a handful of parameters, choose what should happen on success, and pull the trigger. The framework handles the messy middle — encoding, networking, session management — so you can focus on which attack and against what.
The module taxonomy
Everything in Metasploit is a module — a self-contained unit of code with a defined job. Understanding the six module types is the single most useful mental model you can build, because every action you take is really just selecting a module and feeding it options. The two you will reach for most are exploits (the code that breaks in) and payloads (the code that runs once you are in). The rest support, automate, or disguise those two.
| Module type | What it does | Example |
|---|---|---|
| Exploit | Code that triggers a specific vulnerability to gain a foothold — the actual "break-in." Selecting one is the start of most engagements. | exploit/windows/smb/ms17_010_eternalblue |
| Payload | What runs after the exploit succeeds. Defines the access you get back — a shell, a callback, or a full Meterpreter session. | windows/x64/meterpreter/reverse_tcp |
| Auxiliary | Scanners, fuzzers, and probes that do work without delivering a payload. Used for discovery, enumeration, and brute-forcing. | auxiliary/scanner/smb/smb_version |
| Post | Post-exploitation modules that run on an already-compromised host — harvesting credentials, gathering data, escalating, or pivoting. | post/windows/gather/hashdump |
| Encoder | Rewrites a payload into an equivalent form to dodge bad characters or naive signature matching, without changing what it does. | x86/shikata_ga_nai |
| NOP | Generates "no-operation" instruction sleds that pad a payload and keep its length and alignment stable — classic for memory-corruption exploits. | x86/single_byte |
Hold onto the pairing at the top of that table: an exploit gets you in, a payload decides what you get. Auxiliary modules do reconnaissance-style work with no payload at all, post modules pick up after a host has fallen, and encoders and NOPs are low-level helpers that shape a payload before it goes out the door. Once the taxonomy clicks, the entire workflow below reads as nothing more than choosing modules in order.
The core workflow
Almost every exploitation session in Metasploit follows the same handful of steps. Learn this rhythm once and it transfers to nearly every module in the framework:
- Find a module — use search to locate one by name, CVE, platform, or service. For example, search eternalblue surfaces the matching exploit and its full path.
- Select it — use followed by the module path loads it. Your prompt changes to show the active module, and from here every command applies to it.
- Inspect the parameters — run show options to list every setting the module needs, which are required, and which already have defaults.
- Set the parameters — fill in the blanks. The common ones are set RHOSTS (the target's address), RPORT (the target port), and LHOST (your machine's address, where a reverse connection comes back).
- Choose a payload — set payload picks what runs on success. If you don't choose, Metasploit selects a sensible default for the target.
- Fire — run exploit (or its alias run). The framework launches the attack, delivers the payload, and — if it works — hands you back a session.
Sessions and Meterpreter
When an exploit succeeds, the result is a session — a live, interactive channel back to the compromised host. Metasploit tracks every session by number, lets you background one and resume it later, and lets you juggle several at once across multiple targets. A session is your foothold; what you can do through it depends entirely on the payload you chose.
The payload that makes Metasploit so powerful is Meterpreter. Unlike a plain command shell, Meterpreter is an advanced, in-memory payload — it loads into the target's memory and, by default, never touches disk, which keeps it stealthier than dropping an executable. It exposes a rich, consistent post-exploitation command set: browsing and pulling files, dumping credentials, capturing screenshots, logging keystrokes, migrating between processes, and pivoting — using the compromised machine as a launch point to reach networks you could not touch directly.
- msfvenom — a companion tool that generates standalone payloads (executables, scripts, and one-liners) you can deliver outside an exploit, for instance in a phishing attachment or a manual drop. It is covered fully in a later lesson; for now, just know it is how you produce a payload to carry by hand.
- The database and workspaces — Metasploit can back itself with a database that records every host, open port, credential, and loot file it discovers. Workspaces let you keep separate engagements cleanly partitioned, so results from one target never bleed into another.
Strengths and the big limitation
For two jobs, Metasploit is essentially unbeatable. The first is learning: nothing else lets you go from "I read about a vulnerability" to "I have a session on a host" as quickly, with as gentle a ramp, while teaching the universal exploit-payload-session model along the way. The second is known exploits: when a vulnerability is public and a module exists, Metasploit weaponizes it reliably and consistently. For lab work, for CTFs, and for the broad class of unpatched, known-CVE targets, it is the right tool and often the fastest one.
But there is a catch that defines the rest of the offensive toolkit. Metasploit is loud, and its default payloads are heavily signatured. Stock Meterpreter is one of the most-studied pieces of code in security history — every modern antivirus and EDR product is tuned to spot it on sight. Fire a default payload at a defended host and it is flagged, killed, and alerted on almost immediately. Encoders help with crude signature matching, but they do not meaningfully fool behavior-based EDR; the underlying payload is simply too well known.
Use Metasploit for what it is best at, and recognize when you have outgrown it. When the target has real defenses and getting caught means failing the engagement, the next step is the Command & Control Frameworks lesson. And as always: everything here is for authorized targets only — explicit written permission and a target in scope are the line between a penetration test and a crime.