| name | metasploit |
| description | Drive msfconsole across the workflow - DB-backed recon (db_nmap, auxiliary scanners), version->exploit search/check/run, multi/handler reverse shells (meterpreter-first, plain shell_reverse_tcp backup for Windows/EDR), sessions + local_exploit_suggester + post modules, and autoroute/portfwd/socks pivoting. Points to the metasploit cheatsheet for syntax. Use for "metasploit", "msfconsole", "msfvenom", "meterpreter", "multi/handler", or driving an exploit/reverse-shell through msf. |
Metasploit: framework driver
Drive msfconsole for recon, exploit, reverse shells, and post-ex. Syntax lives in
[[metasploit]]; this skill is the workflow that strings it together.
Pre-attack wiki query (MANDATORY)
Before firing any exploit module, query the fingerprinted tech/CVE: read [[metasploit]]
directly for syntax, then Skill(arsenal) for the matching module/payload/technique. Never fire
a module from memory when a targeted lookup would confirm the right one/target index.
Setup / DB
msfconsole -q in a named tmux tab, never a blind background job, the operator needs to see
sessions land live. workspace -a <eng> scopes loot to the engagement, db_status confirms the
Postgres backend is up before anything else. Cheatsheet: Setup + Database sections.
Recon via msf
db_nmap writes straight to hosts/services; layer auxiliary/scanner/* (smb/http/ssh
version + vuln checks) on top for anything plain nmap scripts miss. This complements the
ctf-box Phase-1 basics, it does not replace them, run both.
Search / select / verify
search <app> <ver> or search cve:<id>, use, info to read the module's CVE refs and
target list, check before / whenever the module supports it, a non-destructive
exploitability test beats a blind fire. Cheatsheet: Search and Selection + Options and Running.
