Penetration Testing

Chapter 4. Using the Metasploit Framework

In subsequent chapters, we’ll take an in-depth look at the phases of penetration testing, but in this chapter, we’ll dive right in and get some hands-on experience with exploitation. Though the information-gathering and reconnaissance phases often have more bearing on a pentest’s success than exploitation does, it’s more fun to gather shells (a remote connection to an exploited target) or trick users into entering their company credentials into your cloned website.

In this chapter we’ll work with the Metasploit Framework, a tool that has become the de facto standard for penetration testers. First released in 2003, Metasploit has reached cult status in the security community. Though Metasploit is now owned ...