Metasploit › Module 1 › Lesson 2
RoE Written Scope
If it is not written, it is not in scope — draft YOUR MSF RoE for $LAB.
Visual · msf_roe_written_scope
RoE = written who / what / when / stop. $LAB only. Original Cyberlium.
Opening
Curiosity is not authorization. A file you chmod 600 is.
Rules of Engagement for Metasploit answer: which VM ($LAB on host-only), which operator (you on your hardware), which module classes (literacy first — search/info before run), where notes live ($HOME/cyberlium-lab), and stop conditions (any host not $LAB, any real persistence, any phishing or ransomware play). Original Cyberlium. You draft RoE before msfconsole touches a target. You do not copy a bug-bounty scope and aim it at a school network. Next: Lab VM Only.
1. Four RoE lines: who, what, where, stop
Who: the lab VM owner (you) on hardware you control. What: read/search/info/configure on $LAB; run only what the lab brief allows. Where: notes under $HOME/cyberlium-lab, mode 600. Stop: any IP that is not $LAB, consumer gear on shared Wi-Fi, classmates, production servers, phishing kits, ransomware sims outside isolated VM.
Written scope is how you refuse 'try my friend's VM' in Discord. Their VM needs their RoE — not your console.
Command guide
Try these commands — Four RoE lines: who, what, where, stop
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Metasploit docs — https://docs.rapid7.com/metasploit/ (framework literacy) Nmap — https://nmap.org/book/man.html (lab host discovery)
═══ INSTALL ═══
Linux (Debian/Ubuntu): Kali: preinstalled, or: sudo apt install metasploit-framework
Command — copy this
sudo apt install nmap
macOS: Prefer Kali/Linux VM — brew install metasploit (heavy)
Command — copy this
brew install nmap
Windows: Use Kali VM or WSL with metasploit-framework — not raw Windows host
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t14-msf"
printf 'LAB_HOST=%s
' "${LAB_HOST:-127.0.0.1}" > "$HOME/cyberlium-lab/t14-msf/roe.env"
source "$HOME/cyberlium-lab/t14-msf/roe.env"
nmap -sn "$LAB_HOST"
msfconsole -q -x 'version; help search; exit'Primary tools to practice this lesson: msfconsole, nmap. Reference sites: Metasploit docs (https://docs.rapid7.com/metasploit/); Nmap (https://nmap.org/book/man.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Authorization is not 'I have Kali'
Installing Metasploit does not grant network permission. Owning a laptop does not grant LAN sweep rights. Scope is host-level: this VM at $LAB is in; everything else is out until a signed engagement says otherwise — this course is not that engagement.
Professional tests attach RoE to tickets and contracts. Steal the habit (write scope, respect stop) and leave stranger targets alone.
3. Stop conditions you can say out loud
If RHOSTS is not $LAB, stop. If someone asks for real-host persistence, stop. If a module wants outbound C2 to the public internet for 'fun,' stop unless your lab brief explicitly simulates it in isolation.
Next lesson hardens the network: host-only lab VM, not bridged café Wi-Fi.
4. What you ship: four written RoE lines for MSF
who/what/where/stop on disk. $LAB named. NEVER stranger RHOSTS, LAN scans, ransomware, phishing. chmod 600.
5. What you record before the next lesson
Date. Four RoE lines. $LAB named. File t14-m01-l02-roe-scope.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab VM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Keep RoE 'in your head.' Aim msfconsole at the dorm gateway because it is 'your Wi-Fi.'
Right
Write four lines and stop conditions. Next: Lab VM Only.
Mission: freeze MSF RoE before console use
1) Write who/what/where/stop in $HOME/cyberlium-lab. 2) Name $LAB as the only in-scope RHOSTS. 3) List stop conditions including stranger hosts and real persistence. Never scan the LAN for targets.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor for a RoE template shape — not for a list of public exploit targets.
Knowledge Check
APPLY: A classmate shares a public IP and says 'practice MSF.' Your RoE lists only $LAB. You:
Multiple choice
Knowledge Check
APPLY: True or False: Installing Metasploit authorizes scanning any network you can join.
True or False
Knowledge Check
APPLY: RoE 'stop' should include:
Multiple choice