How to Use Metasploit for Ethical Hacking: Step-by-Step Lab Setup for Beginners

 

Dive Into Ethical Hacking with Metasploit: A Beginner’s Guide by Learn Cybersecurity BD.

Are you ready to dive into the world of ethical hacking and discover how real cybersecurity professionals uncover system vulnerabilities before real attackers do?

Then you need to understand the power of the Metasploit Framework — one of the most essential and widely used tools in cybersecurity.

💡 What Is Metasploit and Why Is It So Important?

Metasploit is a powerful open-source framework that allows ethical hackers and security professionals to simulate real-world cyberattacks in a safe, controlled environment. It’s a must-have tool for penetration testing, vulnerability scanning, and security research.

Whether you're scanning systems with Nmap, exploiting a misconfigured service, or performing post-exploitation with Meterpreter, Metasploit unifies all these tools into a single robust platform.

What is Metasploit?

Metasploit Framework is a powerful penetration testing tool that allows ethical hackers and security professionals to simulate attacks on systems to test vulnerabilities. The exploitation process generally involves:

1. Information Gathering – Identify the target and its services.
2. Vulnerability Scanning – Check for known vulnerabilities.
3. Exploit Selection – Choose a matching exploit from Metasploit.
4. Payload Configuration – Attach a payload (like reverse shell).
5. Launching the Exploit – Exploit the vulnerability.
6. Post-Exploitation – Maintain access, escalate privileges, etc.

Information Gathering – Identify the Target and Its Services

This is the first and most crucial phase. Without proper info, exploitation is guesswork.

• Identify the IP address of the target
• Discover open ports and running services
• Detect the operating system and its version

🛠️ Tools:

• Nmap
• Netdiscover
• Ping/Traceroute
• Metasploit’s auxiliary scanners

✅  Example Commands:

netdiscover                    # Identify target IP in the network

nmap -sS -sV -O <target-ip>    # Scan open ports, services, and OS

You might discover:

• Port 21: vsFTPd 2.3.4 (FTP)
• Port 80: Apache 2.2.8 (HTTP)

Port 1099: Java RMI Registry

Tolls of the Framework of Matasploit

1.  msfconsole

2.  Auxiliary Modules

3.  Exploit Modules

4.  Payloads

5.  Encoders

6.  Post Modules

7.  Meterpreter

8.  Database Support (PostgreSQL)

🛠 Tools You Can Use (from Kali Linux or similar):

1. Nmap
2. Netcat
3. Nikto
4. Enum4linux
5. WhatWeb / Wappalyzer
6. MSFconsole (Metasploit Framework)

Why ethical hacker need to understand the mataspoloit framework and what in there with in a framework like matasploit that every cybersecurity begineer need to know.

·  Realistic Environment – It simulates real-world vulnerable systems for safe testing.

·  Skill Development – Helps practice exploitation, privilege escalation, and post-exploitation.

·  Tool Familiarity – Ideal for learning tools like Metasploit Framework effectively.

·  Vulnerability Analysis – Contains numerous common CVEs for hands-on experience.

·  Penetration Testing Practice – Offers a complete OS with services to mimic enterprise targets.

·  Report Writing – Enables ethical hackers to document and explain real exploits.

·  CTF Preparation – Useful for Capture The Flag training and challenge solving.

·  Safe Lab Use – Runs in isolated environments without risk to real systems.

·  OS & Service Enumeration – Helps improve scanning and enumeration skills.

·  Professional Readiness – Prepares ethical hackers for real-world engagements and interviews.

Difference between Metasploitable 2 Metasploitable 3

1. Base Operating System

·       Metasploitable 2: Based on Ubuntu Linux 8.04.

·       Metasploitable 3: Comes in two flavors – Windows Server 2008 and Ubuntu Linux 14.04 (offering both Linux and Windows targets).

2. Modern Vulnerabilities

·       Metasploitable 3 includes more recent vulnerabilities with real-world relevance.

·       Includes vulnerable applications like Tomcat, Jenkins, OpenSSH, JBoss, Java RMI, VSFTP, and EternalBlue (Windows).

3. Vagrant & Packer-Based Build

·       Metasploitable 2 is pre-built and downloaded as a VM.

·       Metasploitable 3 uses Vagrant and Packer scripts to build the VM from scratch, teaching DevOps and automation principles.

4. Service Diversity

·       Metasploitable 3 simulates a full production environment with web servers, databases, file shares, misconfigured services, etc.

·       It includes PowerShell Empire, mimikatz, and other post-exploitation tools (on the Windows version).

5. Multi-Stage Exploits & Escalation Paths

·       Designed with multi-layered attack vectors, encouraging chaining exploits and practicing privilege escalation, unlike the straightforward vulnerabilities in v2.

6. Active Directory Support (Windows)

·       Introduces Active Directory misconfigurations, great for red team practice and learning Kerberos, LDAP, and lateral movement.

Pre-installed Vulnerable Services/Software in Metasploitable 3 (Ubuntu):

• Apache Tomcat (with default creds)
• MySQL (with weak password)
• Jenkins (vulnerable version)
• PHP, Ruby, and Python scripts with flaws
• Samba, FTP, OpenSSH, PostgreSQL, etc.
• Web apps like:
• DVWA (Damn Vulnerable Web App)
• WebDAV
• Mutillidae
• PhpMyAdmin

 

User name and default user credentials of matasploit 3

·  Username: vagrant

·  Password: vagrant

 

🎯 What You'll Learn in the Video (Part 1)

In the video linked below, I, Egnr. Md. Jashim Uddin from Learn Cybersecurity BD, will guide you step by step through:

✅  What the Metasploit Framework is and how it works

✅  Why Metasploit is crucial for ethical hacking

✅  How to install the latest version of Metasploit

✅ How to set up a vulnerable virtual machine: Metasploitable 3

✅  How to create your own ethical hacking lab at home

 

🧪 Why You Need an Ethical Hacking Lab

The best way to learn ethical hacking is through hands-on practice. Using Metasploit with Metasploitable 2, you’ll simulate real-world attacks, test your skills, and learn how vulnerabilities are discovered and exploited — all legally and safely.

This approach builds confidence, sharpens your penetration testing skills, and gives you a strong foundation to move forward in your cybersecurity career. I will attached a youtube video shortly. 

🔧 Tools Featured in This Guide:

• Metasploit Framework (Latest Version)
• Metasploitable 2 (Vulnerable Linux VM)
• VirtualBox or VMware
• Nmap
• Meterpreter Payloads

 

🚀 Kickstart Your Ethical Hacking Journey

Whether you’re just starting out or brushing up your skills, this guide will help you take the first real step in ethical hacking. By learning Metasploit, you’re unlocking one of the most versatile and respected tools in the cybersecurity field.

And remember — learning Metasploit is not optional if you want to become a serious ethical hacker or cyber