Tagged: Metasploit
18 posts · browse all tags
-
Metasploit Deep Dive Part 1: History, Editions, and the Shape of the Framework
Where Metasploit came from, what Framework vs Pro actually means today, and why a series about the most-covered tool in offensive security still has something to add.
-
Metasploit Deep Dive Part 10: Network-Level Detection Engineering
What a network monitor can actually see in the meterpreter handshake and default transports, deliberately narrowed to the wire, since host-based detection is a separate series once its lab work lands.
-
Metasploit Deep Dive Part 11: RPC and msgrpc Automation
msfrpcd, MessagePack vs JSON-RPC, virtual consoles, and how the framework exposes itself to outside code, real source, the same layer AI Part 7 and Part 12's MCP server both build on top of.
-
Metasploit Deep Dive Part 12: msfmcpd, Rapid7's Own MCP Server
Five weeks after this site wired an LLM into Metasploit through a third-party MCP project, Rapid7 shipped a first-party one, with a safety model worth comparing directly against both that community project and this site's own MCP server.
-
Metasploit Deep Dive Part 13: Database, Workspaces, Loot, and Credential Tracking
The persistence layer underneath everything Parts 11 and 12 exposed: workspaces, hosts, services, vulnerabilities, credentials, and loot, and why an engagement's findings outlive any single msfconsole session.
-
Metasploit Deep Dive Part 2: Framework Internals, Modules, Mixins, and the Datastore
What Msf::Module actually is, why it's built from nineteen separate mixins instead of one class, and how the datastore turns 'set RHOSTS' into something every module type understands the same way.
-
Metasploit Deep Dive Part 3: Payload Architecture and What msfvenom Actually Builds
Singles vs. stagers vs. stages, what msfvenom is actually assembling, and the real encoder list behind a tool that's still doing the same job it did in 2003.
-
Metasploit Deep Dive Part 4: Meterpreter's TLV Wire Protocol, From Real Protocol Source
What actually goes over the wire once a meterpreter session is established: the packet header, the TLV encoding scheme, and how AES got layered on top of a protocol that started out XOR-obfuscated.
-
Metasploit Deep Dive Part 5: Transports Compared
reverse_tcp, reverse_https, bind_tcp, and the less obvious handlers the real framework ships, including two built specifically for pivoting through AWS rather than a raw socket.
-
Metasploit Deep Dive Part 9: Evasion in 2026, Honestly Assessed
What encoders, the dedicated evasion module category, and Metasploit 6.5's new features do and don't buy against modern AV and EDR, without recycling the 2015 version of this advice.
-
Metasploit Deep Dive Part 6: CVE-2014-3120, a Real Module, and Three Things Windows Defender Got Right
Running script_mvel_rce against the Elasticsearch 1.1.1 target this series has had waiting since Part 1, why the module never produced a session despite genuine SYSTEM-level RCE, and what checking Wazuh afterward turned up.
-
Metasploit Deep Dive Part 7: A Different Door, the Same Wall
Part 6 hit Windows Defender three times from an Elasticsearch MVEL exploit. Part 7 tries a completely different door — an unauthenticated SYSTEM-level Jenkins Groovy console — and finds exactly the same wall waiting on the other side.
-
Metasploit Deep Dive Part 14: Closing the Loop
Thirteen parts of internals, thirteen posts of "here's how the framework works." This one's different: no new commands, just going back through what actually happened in the lab and matching it up against the theory.
-
Metasploit Deep Dive Part 8: Pivoting Into the Blind Spot
Parts 6 and 7 exhausted stock Metasploit against a Defender-protected Windows host with no session to show for it. Part 8 moves to Linux, gets a clean foothold, and pivots into a segment the SIEM can't see at all.
-
Sn1per Deep Dive Part 8: The Windows Target and What Nuke Mode Never Touched
Building a genuine Windows target for the Sn1per lab and running the tool against it for real, including the one finding it never even scanned for.
-
Sn1per Deep Dive Part 7: Verified With Root
Six posts read Sn1per from source without ever running it live. This one reruns the tool for real, with root, against a rebuilt lab, and checks every prediction against what actually happened.
-
Sn1per Deep Dive Part 6: A Full Sweep Against Northbridge Freight
Applying Sn1per's real recon-to-exploit logic, mode by mode, against a small local lab, then handing off to Impacket and Pivoting and Tunneling for the part the automation can't do.
-
AI Part 7: When an LLM Gets Nmap and Metasploit as Tools
I wired an LLM into nmap and Metasploit against a deliberately vulnerable lab. The exploit worked — a real, server-verified root shell — but the sharper finding was the models themselves: a 7B fabricated its tool output wholesale, an 8B mangled its arguments, and only a 32B drove the tools honestly. No fabricated transcripts — the model's included.