Written first in Perl and then Ruby, it provides a powerful tool for investigating potential security vulnerabilities. Its most well known sub-project is the metasploit framework for developing exploit code to be used against a target machine.
To install metasploit on Ubuntu Linux, I used Ubuntu 10.04.1 in VMware Workstation 7.1.0 build 261024 with 2 NIC's. One was set to NAT and the other to bridged (but disconnected)
I booted up Ubuntu and logged in as a normal user and then used Firefox to download the latest version of Metasploit. I used version 3.4.1 i686 of the metasploit framework.
I then changed to root using the linux su command and moved the framework-3.4.1-linux-i686.run file to the root folder. But before I could install metasploit I needed to install Ruby as well as it has dependancies that the framework needs.
To install ruby use this command : apt-get install ruby
Once Ruby has installed install the Metasploit framework with the following command : ./framework-3.4.1-linux-i686.run
That's pretty much all there is too it. The tool can be launched by running the command "msfconsole" (without the quotes). The screenshot below is what it looked like on my machine once it is running.
It may interest you to know that metasploit has a web interface as well that can be used to select exploits, targets and payloads as well.
To use the web interface, it needs to be started at the command line. Type "msfweb" (no quotes) and then open firefox. Metasploit listens on port 55555 by default (although this behaviour can be changed).
The following screencapture shows msfweb starting:
Once msfweb is running, open firefox and point the address to the localhost IP, which is 127.0.0.1 on port 55555.
The last screenshot shows metasploits web interface. From here you can explore the application, see what vulnerabilites are in its database and direct a payload to an 'unsuspecting' victim.
This concludes the installation of metasploit, a powerful tool for discovering security vulnerabilities and penetration testing.
