📱 Mobile Security Tips
Sarah Chen — iOS Security Specialist
{
“title”: “Post-Exploitation with Metasploit: A Comprehensive Cheatsheet”,
“content”: “
What is Metasploit?
Metasploit is a powerful penetration testing framework that helps security professionals find and exploit vulnerabilities in systems. It provides tools for developing and executing exploit code against a remote target machine, as well as various payloads and tool sets for post-exploitation activities.
Installation
To install Metasploit, follow these steps:
- For Linux, you can use:
curl https://raw.githubusercontent.com/rapid7/metasploit-framework/master/scripts/msfupdate | bash
- For Windows, download the installer from the official Metasploit website.
Basic Syntax
The basic command structure of Metasploit is:
msfconsole
This command will launch the Metasploit console, where you can use a variety of commands to interact with the framework.
Discovery
Using Metasploit for discovery involves identifying open ports, services, and potential vulnerabilities.
| Command | Description |
|---|---|
use auxiliary/scanner/portscan/tcp |
Scan for open TCP ports on a target. |
use auxiliary/scanner/ssh/ssh_version |
Identify SSH versions running on the target. |
Scanning
Once you have identified potential targets, the next step involves scanning for vulnerabilities.
| Command | Description |
|---|---|
use auxiliary/scanner/http/http_version |
Check the HTTP version of a target service. |
use exploit/windows/smb/ms17_010_eternalblue |
Exploit the EternalBlue vulnerability affecting Windows. |
Exploitation
After identifying vulnerabilities, you can exploit them to gain access.
| Command | Description |
|---|---|
run |
Execute the current module/attacker. |
Analysis
Post-exploitation data analysis is critical for understanding the impact and planning next steps.
| Command | Description |
|---|---|
ps |
List processes running on the target machine. |
ls |
List files and directories in the current directory. |
Evasion
To avoid detection during tests, using evasion techniques is essential.
| Command | Description |
|---|---|
set evasion true |
Enable evasion techniques for exploits. |
Reporting
Documenting findings is crucial for any penetration test.
| Command | Description |
|---|---|
db_insert |
Insert findings into the database. |
save_report |
Save your report in chosen formats. |
Quick Reference Table
Here are some of the most commonly used commands in Metasploit:
| Command | Description |
|---|---|
search |
Search for specific exploits, auxiliary modules, or payloads. |
show options |
Display module options and parameters. |
Pro Tips
- Use the