Validating your own systems with Metasploit
Validating findings in a controlled way, seeing the defence-side traces and re-validating a patch.
Level 201 · 15 lessons · 12 practice labs
Lessons
Getting to know the framework
- Metasploit in defence: validating your own systems: You will understand how Metasploit is used in defence: confirming, with permission and under control, whether a weakness really exists on your own system.
- Metasploit architecture and msfconsole: You will know the parts of Metasploit and the msfconsole interface well enough to move around comfortably in your own lab.
- Metasploit workspaces and the database: You will use Metasploit workspaces and its database to keep findings separated by project and well recorded.
- Reading the Metasploit module catalogue: You will read the Metasploit module catalogue and tell apart each module's type, purpose and which systems it affects.
- Reading a Metasploit module's documentation and impact: You will read a Metasploit module's documentation and judge its impact and risk before running anything.
- Short task: find the audit module for a CVE and summarise its documentation
Controlled validation
- Auditing with Metasploit auxiliary modules: You will use Metasploit auxiliary modules to audit services and settings on your own lab system without causing harm.
- The check method of modules: validating without changing anything
- Validating a finding in a controlled way with Metasploit: You will learn to validate a scan finding on your own lab system with Metasploit, with permission and under control, and write down the result.
- Metasploit: what defenders see, network and log traces: You will see, from the defender's side, which traces a Metasploit validation leaves in network and server logs, and judge your alert rules.
- Bind and reverse payloads: stopping them with egress filtering: You will understand why a server should not open unexpected outbound connections and block them with outbound firewall rules.
- Short task: validate a finding on the lab target with check and find its log trace
Patch and report
- Patching and re-validating with Metasploit: You will apply a patch, then re-validate the same finding with Metasploit to prove that the weakness is really closed.
- Exporting evidence and a report from the workspace
- Capstone: a before-and-after validation report with Metasploit: In the capstone you will validate a fictional company's lab system with Metasploit before and after a patch and show the difference in a report.
Practice labs
- Set up a Metasploit workspace for an assessment: Connect the database, create a separate workspace for the lab, import the inventory and list the hosts.
- Find the check module for a CVE and summarise its documentation: Search the catalogue for the CVE and write one paragraph on what the module does, its reliability and side effects.
- Rate five modules by their impact on the target: Read the stability and side-effect notes of five modules and justify which must never run outside the lab.
- Audit lab services with auxiliary modules: Run auxiliary modules that gather version and configuration details and save the results in the workspace.
- Validate a finding without changing anything using check: Run the module's check method for the lab target's finding and compare the result with version evidence.
- Resolve a conflict between a scanner finding and a check result: Investigate a service the scanner calls vulnerable but check calls safe, and prove which is right.
- Find the log trace of a validation on the lab target: Note when you ran check and find the trace of that request in the target's service and system logs.
- Recognise validation traffic in a network capture: Separate the connections in the capture taken during validation and write a recognition note for the monitoring team.
- Block outbound call-back connections with egress filtering: Write rules allowing only required outbound connections on the lab server and confirm an unauthorised outbound attempt is blocked.
- Rerun check after patching: Update the affected service and record that the same check now reports safe.
- Export evidence and host list from the workspace: Export the workspace's hosts, services and notes in a format fit for the report appendix.
- Write a before-and-after-patch validation report: Validate two findings on Bakırdere Madencilik's lab server with check, patch, revalidate and report.
About this course
Validating findings in a controlled way, seeing the defence-side traces and re-validating a patch.
What you will learn
- Getting to know the framework
- Controlled validation
- Patch and report
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.