Now, as we start to dive deeper into the PEN 200 curriculum
and course overall, you're going to notice that one of the tools
that we always go back to the well on is Metasploit.
And it's not just a singular tool.
It's an entire suite.
It's the Metasploit framework.
And it's very handy when doing a wide variety of things in the name of pen
testing.
You can actually go through and send payloads that are crafted to be able to do
things like reverse shell, send out little sweepers to go through
and see what's available on the actual network itself
and what vulnerabilities may exist.
And speaking of vulnerabilities, it even goes so far as to acting like a
vulnerability scanner.
Now more on that in just a second.
But Metasploit framework is natively applied and installed to Cali Linux.
So if you get a recent distribution of Cali, you're going to have
Metasploit installed on it already out of the box.
It can be installed on Windows and there is support for it.
I have a link below if the official Metasploit site below the video for that.
And then you can also install it on other POSIX based systems
because it's more friendly towards that POSIX based environment.
So let's say you go inside the lab and you want to see if you can do a
test run inside of Ubuntu, the Ubuntu box that we have set up as one of our
targets.
You could very well do it one of two ways.
You could either say, I want to update the sources for updates, the app update
and modify it to include the Cali rollout.
Or you can actually download Debian packages for Metasploit itself and install
that way
using DPKG. Now, as we go throughout this course, any time that we work with
Metasploit,
it's 99.99% probability.
We're going to be working with it inside of Cali.
And we're going to be using one of three things when it comes to actually
working
inside of that environment to do pen testing.
And that is number one, the actual Metasploit framework console, which is a
combination of everything altogether.
But let's say, for instance, that you want to be able to split up your systems
and have one to send out probes and another one to receive said responses in
case one
of those probes actually works or whatever the case may be.
Well, we have also the MSF Venom console, which primarily packages up payloads
and gets
them ready for potential exploits to leverage vulnerabilities on targeted
systems.
And then we have MSF console, which is primarily used to be able to receive the
messaging coming from targeted systems that were infected or, excuse me,
penetrated tested by MSF Venom.
So let's say, for instance, that we create and we will do this throughout the
course and particularly in the skill as an example, we create a payload in MSF
Venom that allows us to be able to send a reverse shell so we can execute
command
line and power shell on a remote window system.
MSF Venom will create that package.
It will get over to the target system and the response will be received by MSF
console.
And therefore we will go through and act through MSF console, PowerShell
commands,
whatever, you know, directory, intrusion, file inclusion, all sorts of
different
things.
And lastly, I mentioned earlier that Metasploit also does vulnerability
assessment.
Well, yes, you can definitely go through and use Metasploit and we will in this
skill do a vulnerability assessment of a targeted system or maybe even systems.
But the reason that it exists inside of Metasploit is to enhance the
vulnerability
reports that you get from programs like NESSIS or OpenVOS that we do here in
this course as well.
So where NESSIS and OpenVOS would actually go through and give us a broken
down detail summary of what's known in things like CBE, NIST, etc, etc.
The Metasploit vulnerability scanner is basically there for us to be able to go
even further based on one of those CBEs or even just a blank assessment and see
if
we can get some more information about what payload may work on this ex-[garbled]
ability over here.
And so let we create a payloaded MSF venom.
We want to try to get it back an MSF console.
It doesn't really work out too well.
We use the Metasploit vulnerability scanner to be able to get a kind of a bead
on what's actually going on.
And so again, the reason that we're kind of going over the fundamentals is
because
as we continue through the course, you're going to see Cali pop up all the time
,
or Metasploit pop up all the time.
And I don't want you to be taken to surprise by that.
So that way, whenever it does come up, you're very familiar with it and you're
already an expert by the time the big ones come around.