Metasploit Framework Fundamentals for Web Exploitation

In the previous lesson you caught a reverse shell by hand — start a netcat listener, fire a one-liner through the vulnerability, upgrade the dumb shell to a TTY one manual step at a time. That teaches the raw mechanics, but every stage was something you assembled yourself: find the right exploit, build a payload for the target, catch and manage the session, do post-exploitation. Metasploit is the framework that industrialises that whole flow — a curated, versioned library of exploits and payloads, a single command loop to drive them, and managed, encrypted sessions with post-exploitation built in.

Scope and safety warning — lab VMs and authorised targets only. Metasploit is the most powerful offensive tool in this curriculum: pointing a working exploit module at a host is a real intrusion, not a scan. Practise only against an intentionally vulnerable lab VM you own — Metasploitable 2/3, a deliberately built target, or a host covered by a signed engagement scope. The unchanging rule applies: capability is never permission.

About the practical. The embedded NovaCart application is not a typical Metasploit target — it is a modern web app, not a vulnerable network service — so this lesson is concept-plus-walkthrough. The hands-on part runs against Metasploitable or a lab VM you control. If you do not have one to hand, read the commands closely so you can recognise the search → use → set → show options → exploit loop; you do not need a live victim to finish the lesson.

In this lesson you will:

• Learn the framework anatomy — exploit, payload, auxiliary, and post modules, plus encoders and the backing database.
• Drive the core loop in msfconsole: search a module, use it, set the options (RHOSTS, RPORT, LHOST/LPORT, PAYLOAD), inspect them with show options, and exploit.
• Understand sessions and Meterpreter — the in-memory, encrypted, scriptable successor to the raw netcat shell.
• See the web-relevant modules (auxiliary/scanner/http/*, wmap) and generate a standalone payload with **msfvenom**.
• Connect Metasploit to the rest of the toolchain — how Nmap, Nikto/WPScan, and searchsploit results feed module selection — and the defences that stop it.

Estimated time: ten to twelve minutes.

When you are ready, send the Continue signal.