Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [metasploitable]

a well-known, intentionally vulnerable Linux distribution, developed by Offensive Security. It is used for training in the fields of vulnerability assessment and penetration testing, often in conjunction with the Metasploit framework (as an attacking platform), which is developed by the same company.

2
votes
1answer
127 views

Can't log in dvwa with a simple python program, even though login credentials are good

import requests target_url = "http://127.0.0.1/dvwa/login.php" data_dict = {"csrfmiddlewaretoken": "bbbfeed6e1aea50f14a51a331054022c", "username": "admin", "password": "password", "Login": "Submit"} ...
5
votes
1answer
3k views

How would I turn an open telnet shell into a Metasploit session?

I'm trying to pivot using a metasploitable2 system, which has a shell port open in a scan: port status service 1524/tcp open shell Accessing the root shell is easy enough in telnet, ...
1
vote
2answers
729 views

DVWA: “Hacking attempt detected…”

Hello and good evening, i've recently tried to improve my pentesting skills and learn more about it with metasploitable 2. I am trying some things on the DVWA. For the moment, i am learning the ...
-1
votes
1answer
589 views

Why should not run Metasploitable on bridge network?

I have read on somewhere that: "Do not run Metasploitable (an Intended Vulnerable Virtual Machine) in your Bridge Network." Why? Does it create a bridge to the attacker's system directly? If yes, ...
0
votes
1answer
492 views

proftpd backdoor not backdoored

I wanted to practice exploiting system using proftpd backdoor. I use the exploit proftpd_133c_backdoor and the payload reverse_perl.I learned on how to exploit using this link, https://www.youtube.com/...
2
votes
1answer
426 views

Metasploit MsfVenom - Payload binds shell, but unable to spawn it with netcat

Running a SEH BoF exploit script that contains a payload that is generated from msfvenom as such: msfvenom --payload windows/shell/bind_tcp --format py --arch x86 --platform windows --bad-chars "\...
1
vote
0answers
56 views

Detecting Samba exploit attacks

I've been messing around with metasploitable two and Kali linux. I came across a tutorial that went over the exploit/multi/samba/usermap_script, I used the exploit and got a shell My question is how ...
5
votes
2answers
2k views

Reverse connection Metasploitable 2 -> Kali Linux (Samba 3.x) without Metasploit

I am trying to exploit Metasploitable 2 without the use of Metasploit, with the aim of learning. In this case, I am focusing on Samba 3.x (Port TCP 139, 445) In this link http://www.rwbnetsec.com/...
1
vote
1answer
323 views

Cannot exploit elasticsearch on Metasploitable3

I am a newbie to security and have started my learning by downloading Metasploitable 3 and trying to get into it using Metasploit's "script_mvel_rce" module to exploit Elasticsearch 1.1.1 At my home ...
4
votes
1answer
843 views

Wordpress 4.0 CSRF Password Reset

I am working on a faculty project. I need to replicate Wordpress CSRF vulnerability on my localhost wordpress. I am trying to do this: https://wpvulndb.com/vulnerabilities/7691 I couldn't find any ...
4
votes
3answers
3k views

Metasploitable ports closed and web server unavailable [closed]

I have setup a fresh VirtualBox install of both Kali Linux and Metasploitable. I did an ifconfig on the Metasploitable VM and tried to access it through the browser, but that gives the message The 10....
0
votes
4answers
533 views

Attack Metasploitable using Nessus

For my computer security class I have to prepare a malicious attack using Tenable Nessus security scanner. The scanner and target, which is Metasploitable2, both have been installed on separate ...
2
votes
0answers
2k views

VirtualBox Metasploitable VM not visible to Kali VM [closed]

I am running VirtualBox on Windows 10, and have 2 VMs set up; Metasploitable (target obviously) and Kali (lab host). I am attempting to fping, followed by nmap from Kali, and for some reason my ...
1
vote
0answers
636 views

Fixing vulnerabilities in metasploitable 2 [closed]

I am new to penetration testing . I've done exploits from kali linux on metasploitable 2, and i want to fix the vulnerabilities i'm exploiting, but all i can find as a solution to these ...
0
votes
0answers
328 views

Closing the exploit/unix/ftp/vsftpd_234_backdoor

I just downloaded Metasploitable and mingling through it. As a start, I was able to make the exploit/unix/ftp/vsftpd_234_backdoor exploit work. My question is that, is there any way I can stop this (...
0
votes
2answers
1k views

Meterpreter reverse_https ExitOnSession

When I'm setting the options for the reverse_https handler in metasploit why would I set ExitOnSession to false and SessionCommunicationTimeout to 0. I don't fully understand the purpose. When I used ...
0
votes
1answer
194 views

Applocker Execution Prevention Bypass - Session parameter

I am still new to Metasploit and I am trying to explore the following module: 1- Module Name: exploit/windows/local/applocker_bypass I did: 1- use exploit/windows/local/applocker_bypass 2- set ...
1
vote
1answer
800 views

Nmap not working as a root

Hi I asked this questions on other forums, and searched on google, but nothing was useful to me. My problem works as a non-privileged used, but whenever I run it as a root, I get: Starting Nmap 7.01 (...
0
votes
1answer
204 views

Metasploitable: Change/Location of login page file?

I have been messing around with Metasploitable 2 and changed the default login credentials. The login page looks like this: I want to change where it says "Login with msfadmin/msfadmin to get ...
3
votes
3answers
1k views

armitage find attack tool cli equivalent command

Ive been using metasploit through the cli and a little through armitage. The tool in armitage to find attacks that gives you attacks that are more likely to work is quite useful, so i was wondering ...
1
vote
1answer
542 views

Hosting a “Capture the Flag” style competition for fun and learning? [duplicate]

A few friends and I want to run some kind of CTF competition in which we both have identical OSes that we can attack and defend as teams/individuals. I was looking on the web and I found some good ...