Metasploit › Module 1 › Lesson 1
What MSF Is
Metasploit is a modular framework — literacy and defender awareness on YOUR lab VM only.
Visual · msf_what_is
MSF = modular framework for security research. Lab VM / $LAB only. Original Cyberlium.
Opening
Metasploit is not a free pass to scan the internet. It is a catalog of modules you read before you touch YOUR lab.
The Metasploit Framework (MSF) bundles exploits, auxiliary tools, payloads, encoders, post modules, and nop generators into one console-driven workflow. Pen testers and defenders both use it — testers to validate fixes under written scope, defenders to understand what their sensors should catch. Cyberlium Topic 14 teaches framework literacy, not stranger-host raids. Every practical dest is YOUR intentional vulnerable lab VM on a host-only network — placeholder $LAB. You will NOT aim modules at café Wi-Fi, classmates, employers, or public IPs you do not own. You will NOT treat MSF as ransomware, phishing, or persistence homework on real machines. Next: RoE Written Scope.
1. Framework pieces, not a single magic button
MSF organizes work into modules: exploits deliver payloads against vulnerabilities; auxiliary modules scan or interact without owning a shell; payloads are the code that runs after success; encoders reshape bytes; post modules assume access; nop sleds pad shellcode. Console commands search, select, configure, and run — always after you read docs.
Defenders care because blue teams map MSF module names to detection rules and patch priorities. Attackers care because modules fail loudly when misconfigured. Your job in this topic is to name the pieces before any run command.
Command guide
Try these commands — Framework pieces, not a single magic button
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Metasploit docs — https://docs.rapid7.com/metasploit/ (framework literacy — lab VM only) MITRE ATT&CK — https://attack.mitre.org/ (map modules to defender view) Rapid7 overview — https://www.rapid7.com/products/metasploit/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Kali: preinstalled, or: sudo apt install metasploit-framework
Command — copy this
sudo apt install curl
macOS: Prefer Kali/Linux VM — brew install metasploit (heavy)
Windows: Use Kali VM or WSL with metasploit-framework — not raw Windows host Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
msfconsole -q -x 'version; help; exit' 2>/dev/null || echo 'Install msfconsole in YOUR Kali/lab VM'
curl -sS -m 3 https://docs.rapid7.com/metasploit/ -o /dev/null -w "docs fetch HTTP %{http_code}
"Primary tools to practice this lesson: msfconsole, curl. Reference sites: Metasploit docs (https://docs.rapid7.com/metasploit/); MITRE ATT&CK (https://attack.mitre.org/); Rapid7 overview (https://www.rapid7.com/products/metasploit/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Research tool under authorization
Legitimate use requires written Rules of Engagement: which VM, which network segment, which time window, which modules are allowed, and when you stop. Curiosity about a neighbor's open port is not authorization. A YouTube title saying 'hack anything' is not authorization.
Cyberlium labs assume you built or imported a disposable VM isolated on host-only networking. If the target is not $LAB in your RoE file, msfconsole stays closed for that target.
3. What this topic will never call practice
Running exploits against public IPs, scanning dorm LANs, leaving Meterpreter on a classmate's laptop, deploying phishing kits, or practicing ransomware choreography. Those are crimes or policy violations — not homework.
Ship a sentence: MSF literacy here means reading modules and options on assets I own at $LAB under written RoE. Next lesson writes that RoE.
4. What you ship: MSF definition that excludes stranger hosts
Write MSF = modular framework (exploit/aux/payload/encoder/post/nop). Lab dest = $LAB on host-only net. NEVER public RHOSTS, LAN sweeps, ransomware, phishing kits. Notes chmod 600.
5. What you record before the next lesson
Date (UTC). MSF vs script-kiddie misuse. Lab = $LAB host-only. NEVER stranger RHOSTS, café Wi-Fi, classmates, real persistence. Path: $HOME/cyberlium-lab/t14-m01-l01-what-msf.txt chmod 600.
6. Wrong vs right: stranger hosts vs YOUR lab VM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Set RHOSTS to a random Shodan IP 'to learn.' Run eternalblue against the office file server without ticket. Treat MSF as a DDoS button.
Right
Define MSF modules at a high level. Name $LAB as the only dest. Next: RoE Written Scope.
Mission: define MSF as a framework you own
1) Write MSF module categories in one paragraph. 2) Write a NEVER list (strangers, LAN, ransomware, phishing). 3) Name $LAB as your lab VM address on host-only networking. Never set RHOSTS to the public internet.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: 'Hint only: what is an auxiliary vs an exploit?' — not how to hit a public IP.
Knowledge Check
APPLY: MSF is best described as:
Multiple choice
Knowledge Check
APPLY: True or False: Cyberlium MSF practice includes setting RHOSTS to arbitrary public internet hosts.
True or False
Knowledge Check
APPLY: A defender uses MSF module names mainly to:
Multiple choice