74 votes
Accepted

Do actual penetration testers actually use tools like metasploit?

As far as forensics is concerned, Metasploit have payloads which are specifically designed to make the work of forensic analysis more difficult. For example, the most famous payload which is selected ...
user avatar
  • 5,511
33 votes

Do actual penetration testers actually use tools like metasploit?

I don't know about malicious attackers/hackers, but I do know several pentesters (myself included) that include Metasploit in their toolboxes. It's by far not the only tool used, but it certainly has ...
user avatar
  • 15.8k
31 votes
Accepted

Metasploit Meterpreter alternatives

Bypassing AV and IPS can be done through meterpreter or any other RAT. Most of the time meterpreter is handy because first it is open source and second it is implemented as a reflective DLL which ...
user avatar
  • 5,511
26 votes

Metasploit Meterpreter alternatives

PowerShellEmpire and Slingshot are the two primary considerations for implants going into 2016. However, you can get these implants easily caught by intrusion detection, advanced antivirus engines, ...
user avatar
  • 18.9k
19 votes
Accepted

What is Shikata Ga Nai

Shikata Ga Nai is an encoder included in the Metasploit framework for the x86 architecture. From the available source code: This encoder implements a polymorphic XOR additive feedback encoder. The ...
user avatar
  • 3,971
18 votes
Accepted

What is a Payload Handler?

I thought that this would be easier to look up, but everything I found was oddly worded. The reason why there is not a good description is because the handler does what it is told to do. So, quite ...
user avatar
  • 123k
16 votes

Do actual penetration testers actually use tools like metasploit?

Yes, pentesters do use Metasploit. With custom exe templates and shikata_ga_nai, you are able to fool nearly every AV solution (Google for AV evasion to learn more about this) and the meterpreter ...
user avatar
13 votes

Do actual penetration testers actually use tools like metasploit?

There are advantages to using Immunity Security or CoreSec products over Rapid7 (whether the commercial Metasploit offerings or the FOSS MetaSploit Framework aka MSF). You'll have to test them out for ...
user avatar
  • 18.9k
12 votes
Accepted

Custom Metasploit payload with UAC bypass

Ran into the same issue when reproducing. UPDATE: When using the windows/local/ask exploit, it seems you do not need to set a payload with it. In the windows/local/ask exploit you can set a ...
user avatar
  • 5,353
12 votes

Why does metasploit still work?

If a company were to actually patch all their systems, then Metasploit would have very little to offer in that environment. However, it's extremely common for companies not to patch all of their ...
user avatar
  • 15.8k
12 votes
Accepted

Difference between Run and Exploit

There is no differences, as exploit is an alias to run: Auxiliary Commands ================== Command Description ------- ----------- check Check to see if a target ...
user avatar
  • 4,595
12 votes
Accepted

When to use a Bind shell vs. a Reverse shell?

Bind tcp opens up a port on the victim's device. Usually a machine is behind a firewall (or NAT) and firewalls don't allow ports other than a few specific ones (like 80, 443, 22, etc). Reverse TCP ...
user avatar
11 votes
Accepted

Exploiting through a filtered port

You have contradictory information: nmap says the port is filtered but nessus says that the vulnerability is present on the system. They cannot both be true, one of these must be wrong. Given that ...
user avatar
  • 17.3k
11 votes

Metasploit Meterpreter alternatives

I'm scared to chime in on this thread given that the existing answers are already so good! But I'm going to give it a go anyway, and come from a slightly different angle, and that is adapting and ...
user avatar
  • 361
10 votes

What is Shikata Ga Nai

Shikata Ga Nai isn't a payload, but an encoder. The payload is the reverse shell. Metasploit offers several encoders, Shikata Ga Nai being one of them. An encoder attempts to overcome detection by AV,...
user avatar
  • 3,006
10 votes

Can't get a reverse shell

Most ncs in the OffSec lab (like most ncs in popular linux distros) don't support -e. It simply doesn't exist. The solution is to redirect the stdin/stdout communication through a pipe: cd /tmp mknod ...
user avatar
  • 2,614
8 votes

Do actual penetration testers actually use tools like metasploit?

Yes, Metasploit is very commonly used by industry professionals. See for example this link.
user avatar
  • 705
8 votes

How do exploits and payloads work together?

The vulnerability is just the weakness in the software that allows an attacker to gain control. For example (since you mentioned buffer overflows), an unchecked buffer copy via strcpy, or using ...
user avatar
  • 15.8k
8 votes

service metasploit start failed to start metasploit service

#/etc/init.d/postgresql service --status-all service postgresql start service postgresql status #/usr/bin/msfconsole msfdb init msfconsole msf > db_status
user avatar
  • 1,649
7 votes
Accepted

source code of metasploit payloads(shellcodes)

The source code of Metasploit shellcode can be found in the directory external/source/shellcode/windows/x86/ folder. Depending upon the type of shellcode, the asm file is placed in separate sub ...
user avatar
  • 5,511
7 votes

How to execute an exploit without user interaction?

Yes, certainly. Malware that affects network accessible services very rarely require user interaction. A worm such as SQL Slammer is a prime example, which propagated across the Internet looking ...
user avatar
  • 35.4k
7 votes

Virus-total offline Alternatives

The alternative is to buy all the AV which are used in virustotal.com and build a similar system for local use. Don't forget to cut it from the internet because AV might phone home not only to get new ...
user avatar
7 votes

Does it make sense to restrict the usage of Metasploit in Penetration testing exams ?

A test is free to restrict the conditions of a test for their own reasons depending on the effect that they want to test. Remember that the point is not to "get the right answer" but to teach and ...
user avatar
  • 123k
7 votes

Proxying MetaSploit through BurpSuite

Use the PROXIES environment variable (while in msfconsole) : set PROXIES HTTP:127.0.0.1:8080 Or run Metalsploit with proxychains (config at /etc/proxychains.conf) http://proxychains.sourceforge.net ...
user avatar
7 votes
Accepted

Metasploit opens Meterpreter but shows no prompt please help

The Meterpreter session has gone to the background, which is default behaviour for Metasploit now. To view the background sessions: sessions -l To interact with the session: sessions -i <...
user avatar
  • 2,724
6 votes

Do actual penetration testers actually use tools like metasploit?

Yes, I do use Metasploit to exploit a known vulnerabilities which has exploit written in Metasploit. In my case, we exploited using Metasploit just to prove the risk of the vulnerability. Show the ...
user avatar
6 votes

How do you send a 64 bit meterpreter stager?

Just use a 64 bit Meterpreter payload. For example the windows/x64/meterpreter/reverse_tcp payload. You can get a 64 bit shell from a 32 bit shell by using the payload_inject module built-in to ...
user avatar
6 votes
Accepted

Metasploit Meterpreter Persistence Script Alternatives

Justin Warner provides an argument on his blog that is important to summarize before continuing a discussion about persistence: Is Reboot Persistence a Requirement I would argue that a ...
user avatar
  • 18.9k
6 votes
Accepted

Is using Kali Linux in corporate enviroment safe?

Kali is a community-built distro full of security tools from both organisations and individuals. It is not designed to be used as a day-to-day operating system. It's a quick-start, throw-away distro ...
user avatar
  • 131k
6 votes
Accepted

How would I turn an open telnet shell into a Metasploit session?

If you have root on the server (or any kind of shell access), generate a payload on Metasploit, copy it to the server, and execute. You don't turn telnet into meterpreter, you start another ...
user avatar
  • 50.5k

Only top scored, non community-wiki answers of a minimum length are eligible