Metasploit Bootcamp
The fastest way to learn Metasploit
1st Edition
Published on 8. July 2025
230 pages
978-1-78829-820-9 (ISBN)
Description
Master the art of penetration testing with Metasploit Framework in 7 daysKey Features - [*]A fast-paced guide that will quickly enhance your penetration testing skills in just 7 days
- [*]Carry out penetration testing in complex and highly-secured environments.
- [*]Learn techniques to Integrate Metasploit with industry's leading tools
Book DescriptionThe book starts with a hands-on Day 1 chapter, covering the basics of the Metasploit framework and preparing the readers for a self-completion exercise at the end of every chapter. The Day 2 chapter dives deep into the use of scanning and fingerprinting services with Metasploit while helping the readers to modify existing modules according to their needs. Following on from the previous chapter, Day 3 will focus on exploiting various types of service and client-side exploitation while Day 4 will focus on post-exploitation, and writing quick scripts that helps with gathering the required information from the exploited systems. The Day 5 chapter presents the reader with the techniques involved in scanning and exploiting various services, such as databases, mobile devices, and VOIP. The Day 6 chapter prepares the reader to speed up and integrate Metasploit with leading industry tools for penetration testing. Finally, Day 7 brings in sophisticated attack vectors and challenges based on the user's preparation over the past six days and ends with a Metasploit challenge to solve.What you will learn - [*]Get hands-on knowledge of Metasploit
- [*]Perform penetration testing on services like Databases, VOIP and much more
- [*]Understand how to Customize Metasploit modules and modify existing exploits
- [*]Write simple yet powerful Metasploit automation scripts
- [*]Explore steps involved in post-exploitation on Android and mobile platforms.
Who this book is forIf you are a penetration tester, ethical hacker, or security consultant who quickly wants to master the Metasploit framework and carry out advanced penetration testing in highly secured environments then, this book is for you.
- [*]Carry out penetration testing in complex and highly-secured environments.
- [*]Learn techniques to Integrate Metasploit with industry's leading tools
Book DescriptionThe book starts with a hands-on Day 1 chapter, covering the basics of the Metasploit framework and preparing the readers for a self-completion exercise at the end of every chapter. The Day 2 chapter dives deep into the use of scanning and fingerprinting services with Metasploit while helping the readers to modify existing modules according to their needs. Following on from the previous chapter, Day 3 will focus on exploiting various types of service and client-side exploitation while Day 4 will focus on post-exploitation, and writing quick scripts that helps with gathering the required information from the exploited systems. The Day 5 chapter presents the reader with the techniques involved in scanning and exploiting various services, such as databases, mobile devices, and VOIP. The Day 6 chapter prepares the reader to speed up and integrate Metasploit with leading industry tools for penetration testing. Finally, Day 7 brings in sophisticated attack vectors and challenges based on the user's preparation over the past six days and ends with a Metasploit challenge to solve.What you will learn - [*]Get hands-on knowledge of Metasploit
- [*]Perform penetration testing on services like Databases, VOIP and much more
- [*]Understand how to Customize Metasploit modules and modify existing exploits
- [*]Write simple yet powerful Metasploit automation scripts
- [*]Explore steps involved in post-exploitation on Android and mobile platforms.
Who this book is forIf you are a penetration tester, ethical hacker, or security consultant who quickly wants to master the Metasploit framework and carry out advanced penetration testing in highly secured environments then, this book is for you.
All prices
More details
Person
Jaswal Nipun :
Nipun Jaswal is an international cybersecurity author and an award-winning IT security researcher with more than a decade of experience in penetration testing, Red Team assessments, vulnerability research, RF, and wireless hacking. He is presently the Director of Cybersecurity Practices at BDO India. Nipun has trained and worked with multiple law enforcement agencies on vulnerability research and exploit development. He has also authored numerous articles and exploits that can be found on popular security databases, such as PacketStorm and exploit-db. Please feel free to contact him at @nipunjaswal.
Nipun Jaswal is an international cybersecurity author and an award-winning IT security researcher with more than a decade of experience in penetration testing, Red Team assessments, vulnerability research, RF, and wireless hacking. He is presently the Director of Cybersecurity Practices at BDO India. Nipun has trained and worked with multiple law enforcement agencies on vulnerability research and exploit development. He has also authored numerous articles and exploits that can be found on popular security databases, such as PacketStorm and exploit-db. Please feel free to contact him at @nipunjaswal.
Content
- Cover
- Copyright
- Credits
- About the Author
- About the Reviewer
- www.PacktPub.com
- Customer Feedback
- Table of Contents
- Preface
- Chapter 1: Getting Started with Metasploit
- Setting up Kali Linux in a virtual environment
- The fundamentals of Metasploit
- Basics of Metasploit Framework
- Architecture of Metasploit
- Metasploit Framework console and commands
- Benefits of using Metasploit
- Penetration testing with Metasploit
- Assumptions and testing setup
- Phase-I: footprinting and scanning
- Phase-II: gaining access to the target
- Phase-III: maintaining access / post-exploitation / covering tracks
- Summary and exercises
- Chapter 2: Identifying and Scanning Targets
- Working with FTP servers using Metasploit
- Scanning FTP services
- Modifying scanner modules for fun and profit
- Scanning MSSQL servers with Metasploit
- Using the mssql_ping module
- Brute-forcing MSSQL passwords
- Scanning SNMP services with Metasploit
- Scanning NetBIOS services with Metasploit
- Scanning HTTP services with Metasploit
- Scanning HTTPS/SSL with Metasploit
- Module building essentials
- The format of a Metasploit module
- Disassembling existing HTTP server scanner modules
- Libraries and the function
- Summary and exercises
- Chapter 3: Exploitation and Gaining Access
- Setting up the practice environment
- Exploiting applications with Metasploit
- Using db_nmap in Metasploit
- Exploiting Desktop Central 9 with Metasploit
- Testing the security of a GlassFish web server with Metasploit
- Exploiting FTP services with Metasploit
- Exploiting browsers for fun and profit
- The browser autopwn attack
- The technology behind a browser autopwn attack
- Attacking browsers with Metasploit browser_autopwn
- Attacking Android with Metasploit
- Converting exploits to Metasploit
- Gathering the essentials
- Generating a Metasploit module
- Exploiting the target application with Metasploit
- Summary and exercises
- Chapter 4: Post-Exploitation with Metasploit
- Extended post-exploitation with Metasploit
- Basic post-exploitation commands
- The help menu
- Background command
- Machine ID and the UUID command
- Networking commands
- File operation commands
- Desktop commands
- Screenshots and camera enumeration
- Advanced post-exploitation with Metasploit
- Migrating to safer processes
- Obtaining system privileges
- Changing access, modification, and creation time with timestomp
- Obtaining password hashes using hashdump
- Metasploit and privilege escalation
- Escalating privileges on Windows Server 2008
- Privilege escalation on Linux with Metasploit
- Gaining persistent access with Metasploit
- Gaining persistent access on Windows-based systems
- Gaining persistent access on Linux systems
- Summary
- Chapter 5: Testing Services with Metasploit
- Testing MySQL with Metasploit
- Using Metasploit's mysql_version module
- Brute-forcing MySQL with Metasploit
- Finding MySQL users with Metasploit
- Dumping the MySQL schema with Metasploit
- Using file enumeration in MySQL using Metasploit
- Checking for writable directories
- Enumerating MySQL with Metasploit
- Running MySQL commands through Metasploit
- Gaining system access through MySQL
- The fundamentals of SCADA
- Analyzing security in SCADA systems
- The fundamentals of testing SCADA
- SCADA-based exploits
- Implementing secure SCADA
- Restricting networks
- Testing Voice over Internet Protocol services
- VoIP fundamentals
- Fingerprinting VoIP services
- Scanning VoIP services
- Spoofing a VoIP call
- Exploiting VoIP
- About the vulnerability
- Exploiting the application
- Summary and exercises
- Chapter 6: Fast-Paced Exploitation with Metasploit
- Using pushm and popm commands
- Making use of resource scripts
- Using AutoRunScript in Metasploit
- Using the multiscript module in the AutoRunScript option
- Global variables in Metasploit
- Wrapping up and generating manual reports
- The format of the report
- The executive summary
- Methodology/network admin-level report
- Additional sections
- Summary and preparation for real-world scenarios
- Chapter 7: Exploiting Real-World Challenges with Metasploit
- Scenario 1: Mirror environment
- Understanding the environment
- Fingerprinting the target with DB_NMAP
- Gaining access to vulnerable web applications
- Migrating from a PHP meterpreter to a Windows meterpreter
- Pivoting to internal networks
- Scanning internal networks through a meterpreter pivot
- Using the socks server module in Metasploit
- Dumping passwords in clear text
- Sniffing a network with Metasploit
- Summary of the attack
- Scenario 2: You can't see my meterpreter
- Using shellcode for fun and profit
- Encrypting the shellcode
- Creating a decoder executable
- Further roadmap and summary
- Index
