Rapid7 Metasploit

What is Metasploit?

Metasploit is the world’s most popular penetration testing framework. Rapid7 offers Metasploit Pro for enterprise with advanced automation and reporting features.

Metasploit Versions:

• Metasploit Framework - open source, command-line
• Metasploit Pro - enterprise, GUI, automation, support

Metasploit Pro vs Framework

Feature	Framework (Free)	Pro (Commercial)
Exploit modules	✅	✅
GUI interface	❌	✅
Automated exploitation	❌	✅
Social engineering	❌	✅
Reporting	Basic	Professional
Collaboration	❌	✅
InsightVM integration	❌	✅
Support	Community	Enterprise

Metasploit Architecture

graph TB
    subgraph "Metasploit Pro"
        A[Web UI] --> B[Metasploit Engine]
        B --> C[Exploit Modules]
        B --> D[Payload Modules]
        B --> E[Auxiliary Modules]
        B --> F[Post Modules]
    end

    subgraph "Targets"
        G[Networks]
        H[Systems]
        I[Applications]
        J[Users]
    end

    C --> G
    C --> H
    C --> I
    D --> H
    E --> G
    F --> H

Metasploit Modules

Exploits

Modules exploiting vulnerabilities:

• Remote exploits - remote attacks
• Local exploits - privilege escalation
• Client-side - client application attacks
• Web exploits - web application attacks

Statistics (2024):

• 2,300+ exploits
• 600+ payloads
• 1,100+ auxiliary modules
• 500+ post-exploitation modules

Payloads

Payloads executed after exploitation:

• Meterpreter - advanced payload with many features
• Shell - classic shell
• VNC - graphical remote access
• Command execution - single command execution

Auxiliary

Helper modules:

• Scanners - port, service scanning
• Fuzzers - protocol fuzzing
• DoS - denial of service tests
• Sniffers - traffic capture

Post-Exploitation

Actions after gaining access:

• Privilege escalation - privilege escalation
• Credential harvesting - credential collection
• Pivoting - lateral movement
• Persistence - access maintenance

Metasploit Pro Features

Automated Exploitation

[Vulnerability Scan] --> [Exploit Matching] --> [Auto-Exploit] --> [Session]
                              |
                    [InsightVM Integration]

Automation benefits:

• Fast testing of multiple systems
• Prioritization of exploitable vulnerabilities
• InsightVM results validation

Social Engineering

Phishing and social engineering campaigns:

• Email campaigns - phishing campaigns
• Landing pages - phishing pages
• USB attacks - USB payloads
• Credential harvesting - password collection

Web Application Testing

• Web scanner - web application scanning
• Bruteforce - brute force attacks
• SQL injection - automatic SQLi
• WMAP - web application assessment

Reporting

Professional reports:

• Executive summary - for management
• Technical details - for IT
• Compliance - PCI DSS, HIPAA
• Custom templates - custom templates

Integration with InsightVM

Powerful combination:

[InsightVM Scan] --> [Vulnerabilities] --> [Metasploit Import] --> [Validate Exploitability]
                                                   |
                                           [Prioritized List]

Workflow:

1. InsightVM detects vulnerabilities
2. Metasploit imports results
3. Automatic exploitability validation
4. Report with confirmed vulnerabilities

Meterpreter

Advanced Metasploit payload:

Capabilities:

• File system - file browsing
• Process - process management
• Network - pivoting, port forwarding
• Keylogger - keystroke capture
• Screenshot - screenshots
• Webcam - camera access
• Hashdump - password dump
• Mimikatz - Mimikatz integration

Who is it for?

Metasploit Pro is for:

• Pentesters - professional penetration testing
• Red Teams - attack simulation
• Security Teams - vulnerability validation
• Auditors - security audits

Ethical Use

IMPORTANT: Metasploit should only be used:

• With written permission from system owner
• As part of authorized penetration tests
• In compliance with law and regulations

Training and Certifications

Rapid7 offers:

• Metasploit Unleashed - free online course
• Penetration Testing with Metasploit - official course
• Certification - Metasploit Pro Certified

Deployment with nFlo

1. Licensing - Metasploit Pro licensing
2. Installation - installation on dedicated system
3. InsightVM Integration - InsightVM connection
4. Workflow Setup - test workflow configuration
5. Training - pentester training
6. Ongoing Support - support and updates