Now that we've looked at the Metasploit capabilities,
let's wrap up with a brief review. In this module, we took a quick look at
how the Metasploit Framework has capabilities at each of the Penetration
Testing Execution Standard testing sections. We took a look at how
Metasploit includes some modules and host‑based tools that can be used in
gathering data about the testing targets.
Passive intelligence gathering uses techniques to collect
information about the target through public sources.
Active intelligence gathering uses methods to interact
directly with the target systems.
There are auxiliary scanning modules, as well as integration
with Nmap for network and service scanning.
While broad vulnerability scanning is not a feature of Metasploit,
it does integrate with a few third‑party tools,
including OpenVAS, which is open source and available in Kali Linux,
as well as commercial tools. Metasploit's key functionality
lies in its exploitation capabilities.
We took a brief look at its capabilities there and the
active and passive attack methods.
Post exploitation includes all of the activities that
occur after a target is compromised.
We looked at the use of post modules to exploit local vulnerabilities,
gather system and application data, and exploit privileges.
We also discussed Meterpreter, a full‑featured tool for post exploitation.
We've only taken a shallow look at the capabilities of the Metasploit Framework.
Later in this course,
we will look at the organization of the framework and how we can find more
detail on the modules that we only talked about briefly.
Next up, we'll take a closer look at the architecture of Metasp.