I'm new to metasploit, and want to install it on the work computer I use every day; but I'm not sure whether it is safe.

Are there any best practices when using metasploit?


3 Answers 3


While installing metasploit on your machine will not directly cause any issues you should be aware of the following:

  • metasploit, like all other software, can introduce vulnerabilities as a result of the underlying components that make it work, the database listener and Ruby service are installed as well as a web framework depending on the version installed. If your computer is not adequately protected or new exploits are found for this software, it may be possible to compromise your machine. This is an inherent risk of installing any software.

  • metasploit allows for the creation and generation of 'malicious' payloads. If configured incorrectly or run accidentally on your machine could introduce vulnerabilities as well.

  • many antivirus solutions will detect metasploit modules and exploits and prevent them from running by placing them quarantine. If you have AV installed you'll need to provide exceptions for it which is, overall, reducing your effective security.

In summary, it depends on what you define as safe. If the above risks are acceptable, go ahead. The metasploit framework is well renowned and as far as anyone knows, isn't backdoored in any way. Assuming you download it directly from rapid7 I would imagine there would be no issues.

  • I'll go for a VM, it makes situation more confortable
    – elsadek
    Commented Feb 24, 2013 at 6:28
  • Not only for Metasploit but for every tool, you should use a machine independent for this kind of actions. That's why exist Backtrack, Backbox, etc
    – user15194
    Commented Feb 24, 2013 at 15:16
  • 1
    Just be warned that unless its part of your job, installing Metasploit (especially if it triggers an AV alert) will likely draw the attention of your system administrators which may be against your company IT policy. Cheers!
    – NULLZ
    Commented Feb 24, 2013 at 22:19
  • @yzT that's fine if you have the processing power available to run VM's. However, often I do not, especially when running from a laptop.
    – NULLZ
    Commented Feb 24, 2013 at 22:22
  • Unless you're running on a laptop from ancient times, you shouldn't have any trouble running one of the smaller *nix distros. You don't need to feed a dedicated Metasploit VM with RAM and processing power like you would a general-purpose Windows VM.
    – Rushyo
    Commented Feb 28, 2013 at 10:28

I'd recommend that you don't install Metasploit on your work computer. To make Metasploit run without issues, it's recommended that you switch off your firewall and anti-virus, which may not be a good idea for your production system. My recommendation: Install Metasploit on a virtual machine (e.g. VirtualBox) in Bridged Mode (so the payloads can connect back). Ubuntu seems to work great and doesn't require a license.

Disclosure: I (used to) work for Rapid7

  • 1
    thnsk for the advice, it's been a while I've setup two VMs on virtualbox, the first is ubuntu which run metasploit and the second is just BackTrack VM.
    – elsadek
    Commented Mar 4, 2013 at 8:51

As long as you install it from a known source, then there should not be any risk to you or your computer.

However, your employer's network administrators may have a few questions for you if you use it and they detect the activity.

  • 3
    They may have questions even if you don't use it - many corporate AVs have signatures to detect tools like this as "Potentially Unwanted Programs" (PUPs) or "Hacking Tools".
    – Iszi
    Commented Feb 24, 2013 at 2:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .