Metasploit › Module 3 › Lesson 1
Exploit vs Aux
Exploits deliver payloads; auxiliary modules support without owning the box — names matter for defenders.
Visual · msf_exploit_vs_aux
exploit/ vs auxiliary/ prefixes. Original Cyberlium.
Opening
Not every msf module is an exploit — aux scans, fuzzes, and talks without a shell.
Exploit modules target a vulnerability and pair with payloads. Auxiliary modules run standalone: scanners, fuzzers, login checks, info gathers — still only against $LAB when authorized. Mislabeling aux as 'safe to run anywhere' is how LAN scans start — don't. Next: Payload Encoder.
1. Exploit modules
Path `exploit/.` ranks targets, uses payloads, and aims for code execution or session. Requires strict RoE and lab VM snapshots.
Defenders monitor exploit-specific IDS rules and patch the named CVE.
Command guide
Try these commands — Exploit modules
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Module types — https://docs.rapid7.com/metasploit/msf-overview/#module-types Exploit vs auxiliary — https://docs.rapid7.com/metasploit/using-metasploit/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Kali: preinstalled, or: sudo apt install metasploit-framework
macOS: Prefer Kali/Linux VM — brew install metasploit (heavy)
Windows: Use Kali VM or WSL with metasploit-framework — not raw Windows host
═══ LINUX / macOS ═══
Command — copy this
msfconsole -q -x 'show exploits; show auxiliary; exit' 2>/dev/null | head -30 || echo 'Module taxonomy literacy'
Primary tools to practice this lesson: msfconsole. Reference sites: Module types (https://docs.rapid7.com/metasploit/msf-overview/#module-types); Exploit vs auxiliary (https://docs.rapid7.com/metasploit/using-metasploit/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Auxiliary modules
Path `auxiliary/.` — scanners, admin interfaces, protocol tests. Still need authorization — 'aux' is not a free pass to scan the dorm.
Many aux modules only make sense against $LAB services you intentionally run.
3. Literacy without launch
This module is taxonomy. You will search and info in Module 4 before any run against $LAB.
4. What you ship: exploit vs auxiliary definitions
Two definitions + one defender note each. No run. chmod 600.
5. What you record before the next lesson
Date. Definitions. File t14-m03-l01-exploit-aux.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab VM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Scan the whole subnet with auxiliary because 'it is not exploit.'
Right
Define both module types. Next: Payload Encoder.
Mission: write exploit vs aux
1) Define exploit module in one sentence. 2) Define auxiliary module in one sentence. 3) Note both require RoE pointing at $LAB. No msf run.
Stuck? Ask Cyberlium AI Mentor
Auxiliary scanner headlines cause incidents too — scope first.
Knowledge Check
APPLY: exploit/ modules primarily:
Multiple choice
Knowledge Check
APPLY: True or False: auxiliary/ modules can be aimed at unauthorized hosts because they are not exploits.
True or False
Knowledge Check
APPLY: Defender value of naming module type:
Multiple choice