Metasploitable2
Type: Vulnerable Linux VM (Ubuntu-based, old packages)
Contains vulnerable services such as:
• VSFTPd backdoor
• UnrealIRCd backdoor
• Samba vulnerabilities (e.g., SMB RCE)
• Tomcat Manager weak creds
• Web apps like Mutillidae, DVWA, PHPMyAdmin, etc.
• Misconfigured NFS, MySQL, PostgreSQL
• Old kernels with privilege escalation flaws
DVWA (Damn Vulnerable Web App)
Type: Vulnerable PHP/MySQL web application
Includes vulnerabilities such as:
• SQL Injection
• Command Injection
• XSS (Reflected, Stored, DOM)
• CSRF
• File Upload
• Brute Force
• Weak CAPTCHA
• Security level switching (Low / Medium / High)
🎯 A. Metasploitable2 – Active Information Gathering
🔎 Brief Explanation
Metasploitable2 is a purposely vulnerable Linux server containing many insecure network
services (FTP, SSH, SMB, databases, web apps, SNMP, SMTP, etc.).
Active information gathering here aims to identify hosts, ports, services, versions,
configurations, and potential weaknesses by directly interacting with the machine.
This phase simulates what an attacker would do after discovering a target inside a network.
🧪 Metasploitable2 – Practice Activities
1. Network Discovery
Identify whether the target is alive and reachable.
nmap -sn [Link]/24
arp-scan -l
traceroute <target>
2. Port Scanning
Find open ports and exposed services.
nmap -p- <target>
nmap -sS <target>
nmap -sV <target>
nmap -A <target>
3. OS Fingerprinting
Determine the target operating system.
nmap -O <target>
4. Banner Grabbing
Interact with services to extract version information.
nc -nv <target> 21
nc -nv <target> 22
nc -nv <target> 80
curl -I [Link]
5. SMB Enumeration
SMB is often misconfigured on Metasploitable2 — great for discovery.
smbclient -L //<target> -N
smbclient //<target>/tmp
enum4linux -a <target>
nmap --script smb-os-discovery -p445 <target>
nmap --script smb-enum-shares -p445 <target>
6. FTP Enumeration
Check for anonymous login and service version.
ftp <target>
nmap --script ftp-anon -p21 <target>
nmap --script ftp-banner -p21 <target>
7. SSH Enumeration
Inspect SSH configuration and algorithms.
nc <target> 22
nmap --script ssh2-enum-algos -p22 <target>
8. SMTP Enumeration
Identify users on email server.
nmap --script smtp-enum-users -p25 <target>
nc <target> 25
9. DNS Enumeration
Used if DNS service is active.
nmap --script dns-service-discovery -p53 <target>
10. SNMP Enumeration
Extract system information via SNMP.
onesixtyone <target>
snmpwalk -v1 -c public <target>
11. Database Enumeration
Retrieve information from DB services.
MySQL:
nmap --script mysql-info -p3306 <target>
PostgreSQL:
nmap --script pgsql-info -p5432 <target>
12. Vulnerability Scanning
Identify known issues using automated scripts.
nmap --script vuln <target>
nikto -h [Link]
B. DVWA – Active Information Gathering
🔎 Brief Explanation
DVWA is a deliberately vulnerable web application.
Active information gathering here focuses on HTTP endpoints, directories, parameters,
cookies, sessions, headers, web technologies, SSL, and forms.
This phase is identical to what a web pentester does before exploitation (SQLi, XSS, etc.).
🧪 DVWA – Practice Activities
1. Web Server Detection
Identify server type, version, and basic headers.
curl -I [Link]
whatweb [Link]
2. Directory & File Enumeration
Find hidden directories, files, admin panels, etc.
gobuster dir -u [Link] -w /usr/share/wordlists/dirb/[Link]
3. Virtual Host Enumeration
Check for additional web applications.
gobuster vhost -u [Link] -w
/usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-
[Link]
4. Parameter Enumeration
Discover hidden GET/POST parameters.
wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/burp-parameter-
[Link] [Link]
5. Website Crawling
Download or visualize the entire application tree.
wget -r [Link]
6. Web Technology Fingerprinting
Identify framework, language, CMS, server modules, etc.
whatweb [Link]
7. SSL/TLS Enumeration (if HTTPS is used)
sslscan <dvwa-ip>
8. Cookie/Session/Header Inspection
Understand how the application handles authentication.
curl -I [Link]
9. Web Vulnerability Scan
Basic detection of common web issues.
nikto -h [Link]