Metasploit Tutorial for Beginners (2026)

The Metasploit Framework is the best-known platform for developing, testing, and running exploit code against target systems — in authorized testing. For learners, it's the clearest way to see how exploitation actually works end-to-end.

⚠️ Only use Metasploit against systems you own or have explicit written permission to test. Build a home lab with intentionally vulnerable VMs to practice safely.

Core concepts

Metasploit organizes everything into a few building blocks:

• Module — a unit of functionality. Types include exploit, auxiliary (scanners, etc.), post (post-access), and payload.
• Payload — the code that runs on a target after a successful test (e.g., a remote session).
• Listener / handler — waits for a session to connect back.
• Session — an interactive connection to a tested machine.

The console

You drive Metasploit from msfconsole. The everyday commands:

search <term>          # find modules
use <module>           # select a module
show options           # see required settings
set RHOSTS <target>    # set the target
set LHOST <your-ip>    # set your callback host
run            # or exploit — launch
sessions -l            # list active sessions

The workflow is always the same: search → use → configure (show/set) → run. Once that pattern clicks, every module feels familiar.

A safe learning workflow

1. Stand up a deliberately vulnerable VM in an isolated lab network.
2. Enumerate it first with Nmap — know what's running before you touch a module.
3. Match findings to the right auxiliary/exploit module.
4. Configure carefully (show options), then run.
5. Explore post-modules to understand what an attacker could do next — and therefore what to defend.

Why defenders should learn it

Understanding how exploitation works is what makes you good at stopping it. Seeing a known vulnerability go from "open port" to "session" teaches you why patching, segmentation, and least privilege matter more than any product.

Go further

Metasploit is one tool in a bigger methodology. Learn the whole picture — recon, scanning, exploitation, reporting — free at the Pentevo Academy, and read What Is Penetration Testing? for the framing.