Tip of the Trade: Metasploit

Most network administrators are familiar with old standbys like Nessus and Nmap for vulnerability scanning. Although these are useful and simple to use apps, admins who want to kick up their penetration testing a few notches should give Metasploit a try. After all, penetration is the one tactic available to network administrators to get ahead of the bad guys, instead of always being in reactive mode.

Penetration enables network administrators to stay ahead of the bad guys rather than in perpetual reactive mode. Metasploit is a powerful penetration testing tool that makes it possible.

With Metasploit, you can finally answer the question “How can I execute this mythical “arbitrary code” that is always the villain in Windows vulnerabilities?” With Metasploit, you can send attack payloads targeted at specific exploits and see for yourself what happens. It also probes for exploitable weaknesses. It comes with a nice assortment of pre-fab attacks. Admins serious about penetration-testing their networks can write their own custom attack scripts.

Metasploit runs on Windows, Linux, BSD and Mac OS X. It probes for vulnerabilities on *nix and Windows binaries, and on both operating systems and applications. For all of its power and sophistication, Metasploit is also easy to install and use. Just download, install and run the msfconsole (Metasploit’s command shell) to get started.

From here, all kinds of useful tasks are possible. You can see lists of commands, get information on each command, list available exploits, and get detailed information on each exploit and payloads.

Using Metasploit can be as simple as selecting your target and payload, or as advanced as identifying and exploiting vulnerabilities yourself.

Metasploit runs from the command line with the msfcli command, in a console (,msfconsole) and over an HTTP interface (msfweb). It’s a well-written, well-organized program that even has excellent documentation. Visit Metasploit.com for downloads and bales of excellent information.