After identifying a target with Nmap, the next step in a structured penetration test is attempting to prove out the vulnerabilities you found. The Metasploit Framework is the most popular and widely used open-source tool for this — a massive, organized collection of ready-made modules for reconnaissance, exploitation, and post-exploitation.
Important: every command in this tutorial should only be run against systems and networks you have explicit authorization to test — like your own personal lab or a formal penetration-testing engagement. Using these tools against any network or system without permission is a crime. This tutorial only covers the tool's structure and running a (non-destructive) reconnaissance module against your own lab machine.
What exactly is Metasploit made of?
Exploit: code that takes advantage of a specific vulnerability in a piece of software or service.
Payload: code that runs on the target system after a successful exploit (e.g., opening a remote shell).
Auxiliary: modules that aren't exploits but are used for reconnaissance, scanning, or gathering information — exactly what this tutorial focuses on.
Post: modules used after successful access, for gathering more information or maintaining access.
Step 1: Launch msfconsole
Already installed on Kali Linux:
msfconsole
After a few seconds of loading, you'll land in Metasploit's main interactive environment.
Step 2: Search for a module
search portscan
This shows every module related to port scanning, along with its type (auxiliary, exploit, etc.) and release date.
Step 3: Select and load a reconnaissance module
use auxiliary/scanner/portscan/tcp
After this command, the prompt changes to show you're now inside that module.
Step 4: View and set the module's options
show options
This shows all the module's configurable parameters — the most important is usually RHOSTS (the target address or range):
set RHOSTS 192.168.1.10
set PORTS 1-1000
Step 5: Run the module
run
Metasploit now runs that same port scan (similar to what Nmap does, but from within this unified framework) and displays the results.
Step 6: Understanding the payload concept (without actually running an exploit)
In a real scenario, after finding a suitable exploit for a known vulnerability, commands like these are used to select a payload:
set PAYLOAD windows/meterpreter/reverse_tcp
show options
Meterpreter is an advanced payload that, after successful execution, opens an interactive control environment on the target system — but actually running an exploit should only ever happen in a fully controlled lab environment (like a deliberately vulnerable VM built for practice), never against a system you don't have formal authorization for.
Why does learning Metasploit's structure matter?
Even if you never run a real exploit, understanding how a professional framework separates and organizes reconnaissance, exploitation, and payloads gives you deep insight into the entire penetration-testing process — exactly the perspective passed on in my security and penetration testing courses, alongside practice on authorized lab machines.
Blog