Metasploit

This article is written from 14+ years of offensive security practice. Some links are affiliate links that help keep this site running — I only recommend tools and services I’d use myself. Kali Linux comes loaded with over 600 security tools. If you’re new to penetration testing, that’s not empowering — that’s paralyzing. Here’s the honest truth: working pentesters don’t use most of what’s installed. They use a tight core of tools extremely well, and add specialized ones when a specific engagement calls for it. The practitioners who get hired aren’t the ones who can name every tool — they’re the ones who can actually use ten of them. ...

Metasploit is the exploitation framework everyone knows and half the people actually understand. This cheat sheet covers everything from first-time msfconsole navigation to post-exploitation pivoting — organized by how you actually use it on an engagement, not alphabetically by command. Updated for 2026. Bookmark it. Starting Metasploit # Start msfconsole msfconsole # Start with quiet mode (skip banner) msfconsole -q # Start with a resource script msfconsole -r setup.rc # Start with a specific database msfconsole -y /path/to/database.yml # Update Metasploit msfupdate Database Setup Metasploit’s database stores hosts, services, credentials, and loot. Worth setting up. ...