Metasploit / Burp Suite
The two tools that define professional penetration testing — Metasploit for exploiting vulnerabilities in network services and infrastructure, and Burp Suite for systematically attacking web applications — used by Cybersecurity Analysts to find and demonstrate the real-world impact of security weaknesses before attackers do.
What it is
About Metasploit / Burp Suite
Metasploit Framework (by Rapid7) and Burp Suite (by PortSwigger) are the most widely used penetration testing tools in professional security assessments, addressing two distinct attack surfaces. Metasploit is an exploitation framework: its database contains over 2,000 exploit modules targeting known vulnerabilities in operating systems, network services, and applications, along with hundreds of payload modules (shellcode, Meterpreter sessions, staged payloads) and post-exploitation modules that allow the penetration tester to escalate privileges, move laterally through the network, dump credentials, and maintain persistence after gaining initial access. A typical Metasploit workflow involves selecting a target host and port, selecting the exploit module matching the identified vulnerability (found through Nessus or Qualys scanning), selecting a payload (typically a Meterpreter reverse shell), configuring the target IP and local listener IP, and running the exploit to see whether it succeeds. When it does, the tester has an interactive shell on the target machine and can demonstrate the full extent of what an attacker could do — reading files, capturing keystrokes, pivoting to internal network segments — to produce a credible, evidenced finding for the penetration test report. Metasploit Framework is open source and free; Metasploit Pro adds a web interface, automated exploitation, and reporting features. Burp Suite is the standard tool for web application penetration testing and is used in virtually every professional web assessment. Its core component is an intercepting proxy: Burp sits between the tester's browser and the target web application, capturing every HTTP and HTTPS request and response. The tester can inspect, modify, and replay requests — changing parameter values to test for SQL injection, modifying session tokens to test for insecure direct object references, altering file upload fields to attempt server-side file upload exploitation. The Burp Scanner (available in Professional edition) automatically crawls the application and runs active scans for common vulnerabilities (OWASP Top 10), generating a detailed findings report with severity ratings and proof of concept requests. The Repeater tool allows individual requests to be sent repeatedly with modifications — the primary workflow for manually exploiting a suspected vulnerability. Burp Intruder automates payload injection across a defined insertion point, enabling brute-force attacks, fuzzing, and enumeration. The Burp Suite Community Edition (free) includes the proxy and Repeater but not the automated scanner or Intruder at full speed; Burp Suite Professional is the version used in all commercial engagements.
What you can do with it
Capabilities
Use Metasploit to exploit a known vulnerability in a lab environment — loading the EternalBlue (MS17-010) exploit module (msfconsole → search ms17-010 → use exploit/windows/smb/ms17_010_eternalblue), setting the target IP (RHOSTS), selecting the Meterpreter reverse TCP payload (set payload windows/x64/meterpreter/reverse_tcp), setting the local listener IP (LHOST), running the exploit, and once a Meterpreter session opens, running "getuid" to confirm which user account the exploit ran as and "hashdump" to extract the SAM database password hashes
Intercept and modify a web request in Burp Suite to test for SQL injection — configuring the browser to use Burp as a proxy (127.0.0.1:8080), logging into the target web application, intercepting the login POST request in Burp Proxy, sending the request to Repeater, modifying the username parameter to include a SQL injection payload (e.g. admin' OR '1'='1), sending the modified request, and observing whether the application returns a successful authentication response indicating that the SQL injection is exploitable
Run a Burp Suite active scan against a web application — adding the target URL to Burp's scope, using the Burp Browser to crawl the application (triggering all authenticated application functionality while Burp maps the attack surface), right-clicking the target in the site map and selecting "Actively scan this host", reviewing the findings generated by the scanner sorted by severity, selecting a High severity finding (e.g. SQL injection in a search parameter), and reading the evidence pane showing the specific request and response that demonstrates the vulnerability
Use Burp Intruder to enumerate valid usernames on a login page — sending a login request to Intruder, marking the username field as the injection point, loading a wordlist of common usernames (Burp's built-in lists or a custom list), starting the attack, and comparing the response lengths and status codes for each attempted username to identify which usernames return a different response (e.g. "Incorrect password" rather than "User not found") indicating that the username exists in the application
Chain Metasploit post-exploitation modules after gaining initial access to a Windows target — opening the Meterpreter session, running "getsystem" to attempt privilege escalation to SYSTEM, running "run post/windows/gather/credentials/credential_collector" to harvest stored credentials from the compromised machine, using "run post/multi/recon/local_exploit_suggester" to identify local privilege escalation paths, and pivoting to an internal network segment by using "route add" to route Metasploit's network traffic through the compromised host as a relay
How to learn it
Learning Resources
PortSwigger Web Security Academy (portswigger.net/web-security — free) — the most comprehensive free web security training resource available; covers every major web vulnerability (SQL injection, XSS, CSRF, SSRF, XXE, IDOR, authentication flaws, business logic) with interactive labs that use Burp Suite; completing the entire Academy is sufficient preparation for professional web application penetration testing
TryHackMe (tryhackme.com — free and paid tiers) — the Metasploit module and the various penetration testing paths provide guided, hands-on practice with both Metasploit and Burp Suite in legal, controlled lab environments; the Jr Penetration Tester learning path is the most structured route to basic proficiency
Hack The Box (hackthebox.com — free and paid tiers) — the retired machine writeups (available once a machine is retired) provide worked examples of how Metasploit and Burp Suite are used to compromise realistic targets; starting with "easy" rated machines and working through the published solutions is an effective learning method
Offensive Security PWK / OSCP (offensive-security.com — paid, ~$1,499 for 90-day lab access + exam) — the Offensive Security Certified Professional (OSCP) certification requires demonstrating exploitation skills against a set of real machines using Metasploit and manual techniques; it is the primary industry certification for penetration testers and the course materials are the definitive practical reference
Pro Tip
Always obtain written scope authorisation before running any Metasploit exploit or Burp Suite scan — and read the scope document carefully. Penetration testing without written permission is a criminal offence under the Computer Misuse Act 1990 in the UK regardless of intent. The scope document should specify which IP ranges, domains, and systems are in scope, the testing window, emergency contact details, and any exclusions. Keep a copy of the authorisation document accessible throughout the engagement. Running a Metasploit exploit against a system one IP address outside the agreed scope is not a technicality — it is an unauthorised access offence.
Skills that use this tool
Roles that use this tool
Alternatives