The Complete Metasploit Guide

▶What You Will Learn
- Develop advanced and sophisticated auxiliary modules
- Port exploits from Perl, Python, and many other programming languages
- Bypass modern protections such as antivirus and IDS with Metasploit
- Script attacks in Armitage using the Cortana scripting language
- Customize Metasploit modules to modify existing exploits
- Explore the steps involved in post-exploitation on Android and mobile platforms

▶Key Features
- Gain a thorough understanding of the Metasploit Framework
- Develop the skills to perform penetration testing in complex and highly secure environments
- Learn techniques to integrate Metasploit with the industry’s leading tools

▶Who This Book Is For
This Learning Path is ideal for security professionals, web programmers, and pentesters who want to master vulnerability exploitation and get the most of the Metasploit Framework. Basic knowledge of Ruby programming and Cortana scripting language is required.

▶What this book covers
- Chapter 1, Introduction to Metasploit and Supporting Tools, introduces the reader to concepts such as vulnerability assessment and penetration testing. The reader will learn the need for a penetration testing framework, and be given a brief introduction to the Metasploit Framework. Moving ahead, the chapter explains how the Metasploit Framework can be effectively used across all stages of the penetration testing lifecycle along with some supporting tools that extend the Metasploit Framework's capability.

- Chapter 2, Setting up Your Environment, essentially guides on setting up the environment for the Metasploit Framework. This includes setting up the Kali Linux virtual machine, independently installing the Metasploit Framework on various platforms, such as Windows and Linux, and setting up exploitable or vulnerable targets in the virtual environment.

- Chapter 3, Metasploit Components and Environment Configuration, covers the structure and anatomy of the Metasploit Framework followed by the introduction to various Metasploit components. This chapter also covers the local and global variable configuration along with the procedure to keep the Metasploit Framework updated.

- Chapter 4, Information Gathering with Metasploit, lays the foundation for information gathering and enumeration with the Metasploit Framework. It covers information gathering and enumeration for various protocols such as TCP, UDP, FTP, SMB, HTTP, SSH, DNS, and RDP. It also covers extended usage of the Metasploit Framework for password sniffing along with the advanced search for vulnerable systems using Shodan integration.

- Chapter 5, Vulnerability Hunting with Metasploit, starts with instructions on setting up the Metasploit database. Then, it provides insights on vulnerability scanning and exploiting using NMAP, Nessus and the Metasploit Framework concluding with post-exploitation capabilities of the Metasploit Framework.

- Chapter 6, Client-side Attacks with Metasploit, introduces key terminology related to clientside attacks. It then covers the usage of the msfvenom utility to generate custom payloads along with the Social Engineering Toolkit. The chapter concludes with advanced browserbased attacks using the browser_autopwn auxiliary module.

- Chapter 7, Web Application Scanning with Metasploit, covers the procedure of setting up a vulnerable web application. It then covers the wmap module within the Metasploit Framework for web application vulnerability scanning and concludes with some additional Metasploit auxiliary modules that can be useful in web application security assessment.

- Chapter 8, Antivirus Evasion and Anti-Forensics, covers the various techniques to avoid payload getting detected by various antivirus programs. These techniques include the use of encoders, binary packages, and encryptors. The chapter also introduces various concepts for testing the payloads and then concludes with various anti-forensic features of the Metasploit Framework.

- Chapter 9, Cyber Attack Management with Armitage, introduces a cyberattack management tool “Armitage” that can be effectively used along with the Metasploit framework for performing complex penetration testing tasks. This chapter covers the various aspects of the Armitage tool, including opening the console, performing scanning and enumeration, finding suitable attacks, and exploiting the target.

- Chapter 10, Extending Metasploit & Exploit Development, introduces the various exploit development concepts followed by how the Metasploit Framework could be extended by adding external exploits. The chapter concludes by briefing about the Metasploit exploit templates and mixins that can be readily utilized for custom exploit development.

- Chapter 11, Approaching a Penetration Test Using Metasploit, takes us through the absolute basics of conducting a penetration test with Metasploit. It helps establish an approach and set up an environment for testing. Moreover, it takes us through the various stages of a penetration test systematically. It further discusses the advantages of using Metasploit over traditional and manual testing.

- Chapter 12, Reinventing Metasploit, covers the absolute basics of Ruby programming essentials that are required for module building. This chapter further covers how to dig existing Metasploit modules and write our custom scanner, authentication tester, postexploitation, and credential harvester modules; finally, it sums up by throwing light on developing custom modules in RailGun.

- Chapter 13, The Exploit Formulation Process, discusses how to build exploits by covering the essentials of exploit writing. This chapter also introduces fuzzing and throws light on debuggers too. It then focuses on gathering essentials for exploitation by analyzing the application's behavior under a debugger. It finally shows the exploit-writing process in Metasploit based on the information collected and discusses bypasses for protection mechanisms such as SEH and DEP.

- Chapter 14, Porting Exploits, helps to convert publicly available exploits into the Metasploit framework. This chapter focuses on gathering essentials from the available exploits written in Perl/Python, PHP, and server-based exploits by interpreting the essential information to a Metasploit-compatible module using Metasploit libraries and functions.

- Chapter 15, Testing Services with Metasploit, carries our discussion on performing a penetration test over various services. This chapter covers some crucial modules in Metasploit that helps in testing SCADA, database, and VOIP services.

- Chapter 16, Virtual Test Grounds and Staging, is a brief discussion on carrying out a complete penetration test using Metasploit. This chapter focuses on additional tools that can work along with Metasploit to conduct a comprehensive penetration test. The chapter advances by discussing popular tools such as Nmap, Nessus, and OpenVAS, and explains about using these tools within Metasploit itself. It finally discusses how to generate manual and automated reports.

- Chapter 17, Client-Side Exploitation, shifts our focus on to client-side exploits. This chapter focuses on modifying the traditional client-side exploits into a much more sophisticated and certain approach. The chapter starts with browser-based and file-format-based exploits and discusses compromising the users of a web server. It also explains how to modify browser exploits into a lethal weapon using Metasploit along with vectors such as DNS Poisoning. At the end, the chapter focuses on developing strategies to exploit Android using Kali NetHunter.

- Chapter 18, Metasploit Extended, talks about basic and advanced post-exploitation features of Metasploit. The chapter advances by discussing necessary post-exploitation features available on the Meterpreter payload and moves on to discussing the advanced and hardcore post-exploitation modules. This chapter not only helps with quick know-how about speeding up the penetration testing process but also uncovers many features of Metasploit that save a reasonable amount of time while scripting exploits. At the end, the chapter also discusses automating the post-exploitation process.

- Chapter 19, Evasion with Metasploit, discusses how Metasploit can evade advanced protection mechanisms such as an antivirus solution using custom codes with Metasploit payloads. It also outlines how signatures of IDPS solutions such as Snort can be bypassed and how we can circumvent blocked ports on a Windows-based target.

- Chapter 20, Metasploit for Secret Agents, talks about how law enforcement agencies can make use of Metasploit for their operations. The chapter discusses proxying sessions, unique APT methods for persistence, sweeping files from the target systems, code caving techniques for evasion, using the venom framework to generate undetectable payloads, and how not to leave traces on the target systems using anti-forensic modules.

- Chapter 21, Visualizing with Armitage, is dedicated to the most popular GUI associated with Metasploit, that is, Armitage. This chapter explains how to scan a target with Armitage and then exploit the target. The chapter also teaches the fundamentals of red-teaming with Armitage. Further, it discusses Cortana, which is used to script automated attacks in Armitage that aid penetration testing by developing virtual bots. At the end, this chapter discusses adding custom functionalities and building up custom interfaces and menus in Armitage.

- Chapter 22, Tips and Tricks, teaches you various skills that speed up your testing and help you to use Metasploit more efficiently.