What the automation of Metasploit and I know I just covered this but I want to go a little bit more
in depth on the what side of the house here. What are we actually automating is what I'm getting at
and we're automating some of the basic tasks like uh maybe even creating multiple connection
listeners inside of MSF console and some of the basic things that we do inside of Metasploit
overall when we're whenever we're conducting pen test against multiple systems. When now these
automation tasks and scripts are usually created within the first day or so within the actual pen
test or whenever we get the scope from our rules of engagement because there may be a like a start
period and a couple days before we actually get the rules of engagement. Now when if that happens
that doesn't necessarily mean that you can't start doing prep work and that's what we're talking
about here. During the preparatory stage is that right preparatory during the prep stage of the
actual pen test for us as the pen testers we can start putting together a bunch of different tools
and resources together to include scripts that help us automate Metasploit or other automation
tasks within Metasploit. This is to help save us time if there is a separation between us getting
the information and us having a different start time and I'm going to tell you that's usually the
case because there's the sit down between the organization heads like the CIO CISO CEO and the
pen tester or pen testing organization to hash out different things like scope rules of engagement
when this is actually going to take place and what the end time is going to be there may be something
like work hours or hours that we're not allowed to pen test or different machines out there that
we're definitely not allowed to touch and that information can be worked upon throughout the
prep period for us to be able to say hey this is what we're going to be attacking and these are
the scripts that are going to let us do this. In addition to that as the ROE is continuously
being modified during this prep period you can go through and make sure that some of the off-limit
targets are taken out of some of the scripts and everything so just a couple of things to keep in
mind when we say when this is the prep period before the actual start of the pen test. Now I
want to address those that run into a situation like within the DoD. You're going to pen test
tomorrow morning and during that pen test you need to start running some of your tasks right away
like network sweeps to figure out what's online and what's available and you're always doing this
within the scope because that scope is being modified constantly and because you found
something on the network and then the organization says or in DoD case some unidentified armor core
that is the only armor core in existence will sit there and say oh no we don't want you to
touch that that's a critical service and that's okay it's just I wish I had known this before we
had actually started and triggered all the alarms for that one system. So as you're going through
and doing the prep prep you're doing the basics at the very beginning. You're doing your network
sweeps like with nmap you're doing your vulnerability assessments and trying to figure
out if there's any unpatched vulnerabilities that exist out there while at the same time
you're going through and making the scripts and preparing the automation for your actual
Metasploit attack. So there's again a couple of different ways to do this but if you are stuck
on a pen test that is start time prep time everything time is now just remember start your
normal stuff right away and then while that's running that's when you can start preparing all
of your scripts.