Metasploit Deep Dive Part 1: History, Editions, and the Shape of the Framework

Metasploit is the most written-about tool in offensive security. A search for “Metasploit tutorial” turns up thousands of walkthroughs, most of them the same use exploit/..., set RHOSTS, exploit sequence against Metasploitable2. That saturation is exactly why this series exists: not another msfconsole tour, but a look at what the framework actually does under the hood, how its pieces fit together, and where it sits next to the other tools this site has already covered in depth.

This site has run two other series that touch Metasploit without covering it directly. Sn1per Part 7 showed normal mode firing decades-old Metasploit exploit modules unconditionally the instant a banner matches, no scan required, treating the framework as a black box to be orchestrated. AI Part 7 wired an LLM into Metasploit through msfrpcd and a third-party MCP server, treating the framework as an API to be called. Neither post asked what’s inside the box. This series does.

Origin

HD Moore released the first version of Metasploit in October 2003: a Perl framework with 11 exploits, built because he was spending more time validating and sanitizing public exploit code by hand than actually testing anything. The problem wasn’t a shortage of exploits floating around IRC channels and mailing lists. It was that every one of them arrived in its own format, with its own conventions, and had to be re-verified before you could trust it against a real target. A framework that normalized exploit code into a common structure, with a shared payload layer, solved that problem once instead of every time.

Moore and a contributor named spoonm rewrote the project as Metasploit 2.0 in April 2004. The bigger break came in 2007: Metasploit 3.0 was a ground-up rewrite from Perl to Ruby, a migration that took about 18 months and added over 150,000 lines of code. Ruby’s object model gave the project what Perl’s didn’t: a clean way to express “an exploit is a subclass of a module, which has a datastore, which has options” as actual inheritance rather than convention. Everything this series looks at in Part 2, the module class hierarchy, the mixin system, the datastore, is downstream of that 2007 rewrite.

Rapid7 acquired the project in the fall of 2009. The acquisition didn’t fork the framework into a closed product; the open-source line kept shipping under the same BSD-style license, and Moore stayed on to lead a team that could now work on it full time instead of nights and weekends. That’s the model that’s held for 17 years: an open-source core with a commercial layer built on top of it, not instead of it.

Editions in 2026

Three tiers exist today, and the boundary between them matters for what this series can verify directly:

Metasploit Framework is free and open source, hosted at github.com/rapid7/metasploit-framework, 38,747 GitHub stars at the time of writing. This is what this entire series is built against, and every claim in it traces back to a real clone of that repository, not to documentation or memory.

Metasploit Pro is Rapid7’s commercial edition: a web UI, MetaModules for guided workflows, social engineering campaign management, and dynamic payloads aimed at AV evasion, on top of the open-source module base. Pricing is quote-based through Rapid7 sales rather than published on a price list, so this series won’t repeat a specific number; older public estimates put annual licensing in the low five figures, but that’s not something to treat as current without a quote. Pro’s source isn’t public, so anywhere this series touches Pro-only functionality, it says so plainly rather than describing internals it can’t verify. That’s the same discipline the Sn1per series applied to Sn1per Professional’s closed-source 2026 architecture.

Metasploit Express sat between the two as a cheaper Pro subset; it’s been folded into Pro’s lower tiers over the years and isn’t sold as a separate product anymore.

Both commercial editions build on the same open module base as Framework. A new exploit module lands in modules/exploits/ once, and Framework, Express-era, and Pro users all get it.

The framework right now

The clone this series works from is current as of publication: Metasploit Framework 6.5, released July 30, 2026, with 422 new modules added over the preceding two years. Real module counts from that clone:

Type	Count
Exploits	2,677
Auxiliary	1,325
Post	435
Payloads	538
Encoders	57
Evasion	12
NOPs	14

That’s roughly 5,000 modules total, close to the “about 4,500 exploit, auxiliary, and post modules” figure Rapid7 cites when explaining why they added MITRE ATT&CK tagging to the module search in 6.5, a real discoverability problem at that scale, not a marketing line.

6.5 also shipped something this series will spend an entire part on later: msfmcpd, a first-party Model Context Protocol server built directly into the framework. That’s a genuinely new development, and it changes the shape of Part 12 considerably from how this series was originally scoped. More on that when we get there.

Metasploit Pro 5.1 released August 3, 2026, four days before this post was drafted, adding evasion primitives for HTTP Meterpreter payloads and service hierarchy tracking. Both release dates are worth sitting with: this is not a legacy tool coasting on its 2003 reputation. It shipped two major releases in the same week this series started.

What this series covers

Fourteen parts, roughly equal weight across angles rather than leaning the whole thing toward one theme:

1. History, editions, module taxonomy (this post)
2. Framework internals from real source: Msf::Module, mixins, the datastore
3. Payload architecture: singles vs. stagers and stages, msfvenom internals, encoders
4. Meterpreter’s TLV wire protocol, from real protocol source
5. Transports compared: reverse_tcp, reverse_https, bind_tcp, and the less obvious ones
6. A disclosed-CVE-to-working-module walkthrough against a real Windows target, and three Windows Defender layers that stopped it cold
7. A second real vector against the same target, Jenkins’s Groovy console this time, and the same wall waiting on the other side
8. A working Linux foothold, a real pivot into an isolated lab segment, and what the SIEM did and didn’t see
9. Evasion in 2026, honestly assessed
10. Network-level detection engineering for the meterpreter handshake and default transports
11. RPC and msgrpc automation
12. MCP integration: msfmcpd vs. the community MetasploitMCP project from AI Part 7
13. Database, workspaces, loot, and credential tracking
14. A closing retrospective, matching what actually happened in Parts 6 through 8 back against the internals covered everywhere else in this series

Parts 6, 7, 8, and 14 were the four held back for a live target and a live meterpreter session. That lab work has since landed, care of the Old Kit, New Kit series, which built a dedicated Wazuh manager and a real Active Directory domain for its own tool-comparison arc and left both standing afterward. Parts 6 through 8 reuse that lab directly rather than duplicating it: two real exploitation attempts against a Windows target end without a session despite confirmed SYSTEM-level code execution, and a third against a different host lands a working pivot into a segment the SIEM can’t see at all. Part 14 goes back through everything covered in Parts 2 through 5 and 9 through 13 and checks it against what actually happened. Until you get there, this series covers everything that can be verified from source, documentation, and the framework’s own published release notes: the architecture, the protocols, the module system, and Metasploit’s own new answer to the AI-tooling question this site already asked once in AI Part 7.

Part 2 starts where that 2007 rewrite started: the Msf::Module base class, and what nineteen separate mixins buy you that a single monolithic class wouldn’t.

Sources: Metasploit Framework 6.5 Released, Metasploit Pro 5.1 Released, rapid7/metasploit-framework, Rapid7 acquires Metasploit, 2009.