Ravindra BagaleCourses & study guides मराठी Track your progress

23. Exploitation with Metasploit

23.2 Starting msfconsole

By Last updated:

Metasploit chi mukhya command line mhanje msfconsole.

sudo systemctl enable postgresql        # database makes search fast (enable is allowed for boot)
sudo msfdb init                          # set up the Metasploit database (first time)
msfconsole                               # start the console

Inside the console:

msf6 > help                 # list command categories
msf6 > version              # framework version
msf6 > db_status            # is the database connected?
msf6 > workspace -a lab     # keep your lab work separate
msf6 > db_nmap -sV 192.168.56.20   # run Nmap and store results in the database
msf6 > hosts                # show discovered hosts
msf6 > services             # show discovered services

db_nmap runs the Nmap you already know and saves the results, so search and modules can use them.

Ravindra Bagale's Tip

If db_status does not say "connected", hosts/services stay empty and students get confused. Run sudo msfdb init first. With the database in place, Metasploit becomes much faster and more organised.

Lab

Start msfconsole, confirm db_status shows connected, create a lab workspace, and run db_nmap -sV 192.168.56.20. Then run hosts and services and confirm your scan is stored.

Metasploit in a defensive curriculum

Metasploit Framework ships with Kali and demonstrates how known vulnerabilities are abused. We use it only against Metasploitable-class VMs on host-only networks, and every successful exploit must end with the patch that would have stopped it.

Learning pattern

Exploit vsftpd 2.3.4 on the lab VM → document the CVE → show the fixed package version → explain why internet-facing FTP is a bad idea compared with SFTP.

Real examples

Global: Rapid7 maintains Metasploit; defenders use its modules to validate that patches worked. Indian company (sample): a red-team / blue-team exercise at a bank uses Metasploit only inside an isolated lab VLAN.

Common mistakes

  • Pointing Metasploit at public IPs.
  • Skipping the "how do we prevent this" write-up.

Recap

  • Lab VMs only.
  • Exploit → patch → prove.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.