And here we are, dear readers. Finally at the end of our OSINT top ten countdown, we have investigated a range of tools (or groups of tools) and delivered them to your inbox every week. Because we have covered so many different tools, here’s a quick refresher on the _secpro team’s favourite open source intelligence tools.
2. Mitaka
3. Shodan
4. VirusShare.com
5. Spiderfoot
6. Exploit Database
7. A Handful of Useful Tools
8. Hunchly
9. ThreatJammer
10. Have I Been Pwned?
If you missed any of these tools or you just want to tell us more about them, head over to the _secpro newsletter and find our survey at the bottom of the email. We love to hear what you think about the _secpro and also want to find out where you think we should focus our time and energy next.
Anyway, without further ado – on with our favourite OSINT tool!
Metasploit
If you have done any work in pentesting, you already know this name. It might seem like an obvious note to end on, but this is our favourite tool and that’s why we wanted to share it with you. Here’s our whistle stop tour of Metasploit and how you can get started with it. If you want some insights on how to use Metasploit, look back at the previous _secpro cybersecurity fundamentals section. We have been looking at Glen D. Singh’s The Ultimate Kali Linux Book. You can find a full breakdown on how to get started with Kali Linux and use Metasploit through the world’s most infamous distro.
Using Metasploit
Knowledge is power, especially when it’s shared.
Pretty strong words from Metasploit. Not only are they strong, but they’re correct too. Metasploit is a cybersecurity tool that collects open-source intelligence and makes it easily accessible. With that knowledge, you are empowered to improve awareness, manage security assessments, and verify vulnerabilities as well as stay one step ahead of the adversary.
Learning Metasploit
If you’re installing Metasploit for the first time, you will probably have a lot of questions. Don’t worry – the Rapid 7 team that maintains Metasploit created an extensive array of resources to help you learn. You can find Metasploit Docs on the Metasploit website in the right-hand drop-down menu or the Metasploit YouTube channel. Figure out what you want to learn, and you will no doubt find excellent tutorials.
Although you can easily install Metasploit on all systems, referring to the Metasploit GitHub page will give you everything you need to get it installed.
What does Metasploit contain?
Like all great tools, Metasploit is really a combination of tools. In this case, however, these things mostly do the same thing. If you access the Metasploit Framework dropdown in Kali Linux, you will see four options:
- Armitage
- Metasploit Framework
- MSF Payload Creator
- Update Metasploit
If you can’t tell, the last one isn’t a tool in and of itself.
Armitage is probably what you will be using the most if you’re not familiar with working with the command line. It’s a graphical interface for Metasploit that allows you to use all the tools available with the MSF toolkit without having to negotiate with a new set of command line instructions. As someone who grew up almost exclusively with Windows machines, this was useful for my transition period while I got more comfortable with Linux!
Because the capabilities of Metasploit are so vast, it would be foolish for me to give budding cybersecurity professionals any advice but “check the docs”. If you want to do something that is key to your pentesting career, it’s likely that someone has already thought of the problem, developed a solution, contributed it to the project, and written the documentation to accompany it. This was a large part of Metasploit’s appeal for me – not only did I have hundreds of solutions at hand, but they were created by professionals who understood and overcame that problem before me. That’s a very useful ace to have up your sleeve.
Using OSINT with Metasploit
Not only does Metasploit collate data through Rapid 7 (the owner), it also crowdsources data from its users. As you become more comfortable with the Metasploit system, you can start to contribute models, fix bugs, and provide documentation to the project. This allows a two-way relationship for people using Metasploit – you’re not just a user, but also someone who contributes to making the project work in the way you need it to work.
