Project 33: Metasploit in a Lab

Module: Module 4: Vulnerability Scanning & Web Exploitation Defense  |  Level: Intermediate  | 
Primary tool: Metasploit Framework (free)  |  Estimated time: 75–120 minutes

Objective: Understand the exploit -> payload -> session workflow against a purpose-built vulnerable target.

Free lab environment

Metasploitable2 (free vulnerable VM) + Greenbone/OpenVAS Community Edition — https://sourceforge.net/projects/metasploitable/ and https://www.greenbone.net/en/community-edition/

Metasploitable2 is a free, intentionally vulnerable Linux VM published by Rapid7 specifically for this kind of training; download it, run it in NAT-less/host-only mode in VirtualBox so it is not exposed to your real network, and treat it as your scan target. Greenbone’s Community Edition of OpenVAS is free and open-source.

Lab workflow

1. Stand up your target (Metasploitable2 (host-only VM)) in an isolated host-only VM network.
2. Run Metasploit Framework (free) with the specific goal of learning to understand the exploit -> payload -> session workflow against a purpose-built vulnerable target.
3. Before writing anything, sort your raw findings by severity so your report reflects real priority, not the order the tool happened to list them in.
4. For your top 3 findings, write: what it is, how you confirmed it, the real-world risk, and the fix.
5. If time allows, apply at least one fix and re-scan to confirm it’s resolved.
6. Assemble your findings into the deliverable format described below.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• your `msfconsole` session showing module selection and a successful (lab-only) session
• your written note on the exact vulnerable service/version that made the exploit possible, and its patched equivalent

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.