Metasploit Architecture

Metasploit is the most widely used exploitation framework. It provides a structured library of exploits, payloads, and tools to test and demonstrate vulnerabilities during authorized engagements.

Rather than writing every attack from scratch, you load proven modules, configure them, and run them through a consistent interface.

The primary interface is msfconsole, an interactive command-line shell. It offers tab completion, command history, and access to every module.

You launch it from a terminal and then work entirely inside its prompt.

Metasploit organizes capabilities into module types:

• exploit: code that takes advantage of a vulnerability.
• payload: code that runs on the target after exploitation.
• auxiliary: scanners, fuzzers, and tools that do not deliver a payload.
• post: post-exploitation actions on a compromised host.
• encoder and nop: help payloads evade detection.

Modules use a hierarchical path that tells you exactly what they do. Reading the path reveals the type, platform, and target service.

An important distinction:

• The exploit is the way in; it breaks the vulnerable software.
• The payload is what you want to happen once you are in, such as opening a shell.

You pair them: one exploit can deliver many different payloads depending on your goal and the target.

Working with any module follows a repeatable cycle:

• search for a module.
• use it to load it.
• set options like RHOSTS and LHOST.
• run or exploit it.

This consistency is why the framework scales across thousands of modules.

Module settings live in the datastore. Each option may be required or optional.

• RHOSTS: remote target address(es).
• RPORT: remote port.
• LHOST: your listening address for reverse connections.
• LPORT: your listening port.

Use show options to see what a module needs before running.

Metasploit integrates with a PostgreSQL database to store hosts, services, loot, and credentials discovered during an engagement. This lets you track a large scope efficiently.

Start it before launching the console so results are recorded automatically.

Auxiliary modules do useful work without exploiting: port scanning, service enumeration, login brute forcing, and fuzzing.

They are often your first step, gathering the intelligence you need before selecting an exploit.

msfvenom is a companion tool for generating standalone payloads as files: executables, scripts, or shellcode you deliver outside the console.

It combines payload generation and encoding into one command, useful for phishing simulations or custom delivery in authorized tests.

For multiple engagements, Metasploit workspaces keep each client's hosts, services, and loot isolated in the database. You switch between them so data never bleeds across assessments.

Test your grasp of module types.

You learned Metasploit's architecture:

• msfconsole is the main interface; msfvenom builds standalone payloads.
• Module types: exploit, payload, auxiliary, post, encoder/nop.
• Module paths encode type/platform/service.
• Workflow: search, use, set options, run; settings live in the datastore.
• The PostgreSQL database tracks hosts, services, and loot.

Next: searching for and using exploits effectively.