2005/04/05 Metasploit

Metasploit is a penetration testing tool. It's not a commercial product, so isn't necessarily up to date with the latest exploits, but it does pack a significant library.

The scary thing about Metasploit is how easy is is to use. You fire it up, and "show exploits" lists the exploits it knows how to use, and you simply choose one. Similarly, "show payloads" shows the payloads it can deliver, from gaining a root shell to adding a Windows user. Then "show targets" shows the possibly vulnerable OSes, and after this, you just set the host and let it rip. Screenshots of Metasploit in action are at http://www.metasploit.com/projects/Framework/screenshots.html

The intent of this tool is not to deploy the exploit; it's for testing your defenses against the exploit. You hopefully have firewall and other barriers to these things, but without something like Metasploit, knowing that your system really will reject a particular offense is difficult. Metasploit lets you test easily and quickly. Of course, it could also be used against you, and the ease of use should be a wake up call to anyone with a lax attitude toward security.

Click here to add your comments




Tue Apr 5 12:37:57 2005: Subject:   bruceg


The web interface is interesting, and scary! I ran everything I could against my machine, and everything was patched, since I could not get an exploit to work. Now I need to hit the work servers with it, probably on the weekend, since my load average jumped during a few of these, especially the samba exploits.

This is a script kiddies ultimate tool. Very easy to use, and very descriptive. Keep those machines patched!

--Bruce Garlock



Tue Apr 5 02:22:14 2005: Subject:   dhart


"It's not a commercial product, so isn't necessarily up to date ... ". And it isn't necessarily out of date either. After all SCO OpenServer was/is a commercial product and was/is always way out of date, at least in regards the packages that came bundled in. Contrast that with LAMP (Linux, Apache, MySQL, PERL)(and many many other applications) all of which are non-commercial products (with commercial support alternatives).

Further I have noticed considerable delays between announcement of a security hole and the availability of an update on certain commercially supported Linux platforms.

Not that I am sure what metric we should use, but commercial/non-commercial is just plain wrong and not in the spirit of FOSS.

We should consider some other meter of a products vitality other than commercial/non commercial.



Tue Apr 5 10:36:41 2005: Subject:   TonyLawrence


Well, I wasn't thinking of vitality so much here as intent. The intent with a commercial product of this type is to always be on the cutting edge - otherwise, what are you paying them for? A free version like this isn't necessarily behind, and might even be ahead now and then, but that's not its intent. The home page for Metasploit says the same thing.

Don't miss responses! Subscribe to Comments by RSS or by Email

Click here to add your comments

If you want a picture to show with your comment, go get a Gravatar

Buy Take Control of Your Domain Names

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.