CHAPTER 03 · FRAMEWORKS

Metasploit

Metasploit is a framework for authorised security testing, validation, and lab learning. It does not replace understanding the target, scope, or impact.

Core vocabulary

Module: a component for a defined task, such as auxiliary scanning or validation.
Options: configuration values required by a module.
Workspace: a separate area for organising assessment data.

Responsible workflow

Confirm written scope and a safe test window.
Enumerate and verify the service independently.
Read module descriptions, references, and options.
Use non-destructive validation where possible.
Record evidence and remediation advice.

Research modules

Search broadly, then inspect details before making choices.

msfconsole; search type:auxiliary http; info <module-name>

The info output explains purpose, references, options, and limitations. Read it first.

Organise a lab

workspace -a training-lab; workspace; help

Important: Only use modules against targets you own or are explicitly authorised to test. Do not use a framework to gain access to unrelated systems.

Practice safely

Use intentionally vulnerable labs or applications you control. Strong reporting explains what was tested, evidence, impact, and remediation.