1. Web Application Penetration Testing ‘17
Metasploit
Web Application Penetration Testing ‘17

2. Metasploit !!! Metasploit – Ultimate Exploitation Framework.
Highlights –
Starting Metasploit
Finding Metasploit Modules
Setting Module Options
Exploiting
Payloads
Types of Shells
Auxiliary Module
Msfvenom

3. Starting Metasploit Open Kali Linux Terminal.
Start Post-gre-sql Service –
service postgresql start
This will start the service and creates an user for storing the data relate to metasploit modules.
Start Metasploit –
service metasploit start
Msfconsole
{you can use help command after msf will start to know about it’s uses.}

4. Finding Metasploit Modules
Metasploit module is an attack vector/exploit module used for exploiting known vulnerability which is still unpatched in target.
Built in Search –
Search [module name]
Ex. Search ms08-067
To find info about module –
Info [Module path]
Modules can be searched online on website of “RAPID7”.

5. Setting Module Options
To Select a module –
Use [module path]
Setting Module Options (for selected Module) –
Show options
To change options –
Set [Option Name] [Value]

6. Exploiting To exploit target, first check available targets –
Show targets
To set the target –
Set target [target number]
*automatic targeting is pre-set.
To Exploit the target –
Exploit

7. Payloads
Payloads are the exploitation modules for taking advantage of the vulnerability. Payload or Shell is most important while exploiting the target.
To check available payload for selected Vulnerable Module –
Show payload
Set payload [payload name]
Exploit

8. Exploiting &Taking Meterpreter Session
After Exploit command, if the target is unpatched, metasploit will give a session f target machine.
Meterpreter (metasploit interpreter) console will start.
Meterpreter can perform all the tasks that can be performed using command line of the target machine.
To terminate the meterpreter session –
Exit

9. Types of Shells Two Types – 1. Bind Shell – 2. Reverse Shell –
It instructs target machine to open a command line and listen on a local port.
The attacker machine connects to target machine on the listening port.
Firewalls may BLOCK this type of shell.
2. Reverse Shell –
It pushes back the connection on attacker machine without waiting for incoming connection actively.
In this, Attacker machine sets up a listening port to listen connection from target machine.

10. THANKS