Metasploit for Beginners: Modules, Payloads and First Steps

The Metasploit Framework is an open-source collection of exploits and tools for penetration testing, maintained by Rapid7 and included in Kali Linux. It saves testers from writing every exploit by hand. Used without understanding, it teaches very little, so this guide focuses on how it is organized and how to use it carefully. Use it only against your own lab or with written authorization.

The Module Types

• Exploit: code that takes advantage of a specific vulnerability
• Payload: what runs on the target after a successful exploit, such as a command shell or Meterpreter
• Auxiliary: scanners, fuzzers and other tools that do not deliver a payload
• Post: actions after access, such as gathering system information
• Encoders and evasion: change how payloads look; mostly beyond beginner needs

The Basic Workflow in Msfconsole

• Start the console with "msfconsole"
• Find a module: "search" followed by a service or vulnerability name
• Select it: "use" followed by the module name or number
• See what it needs: "show options" and "info"
• Set values: "set RHOSTS" to the target address, "set LHOST" to your Kali address for payloads that connect back
• Run it: "run" or "exploit"

Read the module's information before running it. Some modules can crash services, and the description says so.

Payloads: Staged and Stageless

A reverse payload makes the target connect back to you; a bind payload opens a port on the target for you to connect to. Staged payloads send a small first piece that downloads the rest; stageless payloads send everything at once. In a lab, start with the default payload the module suggests.

Meterpreter

Meterpreter is Metasploit's advanced payload. It runs in memory and offers commands to explore the file system, see system information, move files and more. In a real test, use only what the rules of engagement allow, and record everything you do.

Use the Database

Metasploit can store hosts, services and findings in a database. Running Nmap through it ("db_nmap") or importing Nmap XML output keeps your results organized across a long test. See Nmap for beginners.

A Good First Lab

Metasploitable 2, a deliberately vulnerable Linux machine, has many services with known exploits. Scan it with Nmap, research each service version, find a matching module, and exploit it. Then write up what you did and how the administrator should fix it. Our home lab guide shows the setup.

Do Not Stop at Metasploit

Professional tests use Metasploit for some steps and manual techniques for many others, especially in web applications and Active Directory. Understand what each module does, and be able to explain the vulnerability without the tool. See penetration testing phases explained.

Learning with an Instructor

Metasploit is taught in our network and Active Directory course alongside Nmap, Nessus and Wireshark, before moving to Active Directory with NetExec, BloodHound and Impacket.