Browse Exploit & Auxiliary Modules
The Metasploit Project hosts the world's largest database of quality assured exploits, including hundreds of remote exploits, auxiliary modules, and payloads. You can even review the Metasploit Framework source code of any module - or write your own.
Search for modules
Module Browser
HTTP Client Automatic Exploiter
This module has three actions. The first (and the default) is 'WebServer' which uses a combination of client-side and server-side techniques to fingerprint HTTP clients and then automatically exploit them. Next is 'DefangedDetection' which does only the fingerprinting part. Lastly, 'list' simply prints the names of all exploit modules that would be used by the WebServer action given the current MATCH and EXCLUDE options. Also adds a 'list' command which is the same as running with ACTION=list.
Authentication Capture: FTP
This module provides a fake FTP service that is designed to capture authentication credentials.
Authentication Capture: HTTP
This module provides a fake HTTP service that is designed to capture authentication credentials.
HTTP Client MS Credential Catcher
This module attempts to quietly catch NTLM/LM Challenge hashes.
Authentication Capture: IMAP
This module provides a fake IMAP service that is designed to capture authentication credentials.
Authentication Capture: POP3
This module provides a fake POP3 service that is designed to capture authentication credentials.
Authentication Capture: SMB
This module provides a SMB service that can be used to capture the challenge-response password hashes of SMB client systems. Responses sent by this service have by default the configurable challenge string (\x11\x22\x33\x44\x55\x66\x77\x88), allowing for easy cracking using Cain & Abel, L0phtcrack or John the ripper (with jumbo patch). To exploit this, the target system must try to authenticate to this module. The easiest way to force a SMB authentication attempt is by embedding a UNC path (\\SERVER\SHARE) into a web page or email message. When the victim views the web page or email, their system will automatically connect to the server specified in the UNC share (the IP address of the system running this module) and attempt to authenticate.
Authentication Capture: SMTP
This module provides a fake SMTP service that is designed to capture authentication credentials.
Authentication Capture: Telnet
This module provides a fake Telnet service that is designed to capture authentication credentials. DONTs and WONTs are sent to the client for all option negotiations, except for ECHO at the time of the password prompt since the server controls that for a bit more realism.
DNS Spoofing Helper Service
This module provides a DNS service that returns TXT records indicating information about the querying service. Based on Dino Dai Zovi DNS code from Karma.
Fake DNS Service
This module provides a DNS service that redirects all queries to a particular address.
PXE Boot Exploit Server
This module provides a PXE server, running a DHCP and TFTP server. The default configuration loads a linux kernel and initrd into memory that reads the hard drive; placing a payload to install metsvc, disable the firewall, and add a new user metasploit on any Windows partition seen, and add a uid 0 user with username and password metasploit to any linux partition seen. The windows user will have the password p@SSw0rd!123456 (in case of complexity requirements) and will be added to the administrators group. Note: the displayed IP address of a target is the address this DHCP server handed out, not the "normal" IP address the host uses.
Socks4a Proxy Server
This module provides a socks4a proxy server that uses the builtin Metasploit routing to relay connections.
SOCKS Proxy UNC Path Redirection
This module provides a Socks proxy service that redirects all HTTP requests to a web page that loads a UNC path.
Cross Platform Webkit File Dropper
This module exploits a XSLT vulnerability in Webkit to drop ASCII or UTF-8 files to the target file-system. By default, the file will be dropped in C:\Program Files\