Metasploit Revealed: Secrets of the Expert Pentester

Attacking browsers with Metasploit browser autopwn

To conduct browser exploitation attack, we will use the browser_autopwn module in Metasploit as shown in the following screenshot:

We can see we loaded the browser autopwn module residing at auxiliary/server/browser_autpown successfully in Metasploit. In order to launch the attack, we need to specify LHOST, URIPATH, and SRVPORT. SRVPORT is the port on which our exploit server base will run. It is recommended to use port 80 or 443 since the addition of port numbers to the URL catches many eyes and look phishy. URIPATH is the directory path for the various exploits and should be kept in the ...