As mentioned in the title I'm looking for a tool that puts on a webserver some .html or .php files filled with popular malware like java drive-bys or other browser exploit payloads? Maybe there is something like this in Metasploit or on BackTrack?


The Social Engineer Toolkit (SET) has something like what you ask for.

It allows you to create websites with various attack vectors.

Check out the 'Tactical Nuke' option for a widespread test.

This is found on Backtrack and integrates with Metasploit.

  • that seems to be what I was looking for..thanks a lot! – JohnnyFromBF Jan 19 '12 at 21:34
  • do you know SET or metasploit payloads that work without user interaction? – JohnnyFromBF Apr 7 '12 at 16:59
  • without user interaction, then it wouldn't be 'social' :) Metasploit has many tools to hack a computer without interaction. – schroeder Apr 7 '12 at 17:18
  • that's true somehow ;) could you name a few? i'm not very much into metasploit, just want to try it out myself on a VM. – JohnnyFromBF Apr 9 '12 at 13:13
  • you are looking for 'autopwn' on offensive-security.com/metasploit-unleashed/Main_Page – schroeder Apr 9 '12 at 15:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.