Quick Cookie Notification

This site uses cookies, including for analytics, personalization, and advertising purposes. For more information or to change your cookie settings, click here.

If you continue to browse this site without changing your cookie settings, you agree to this use.


View Cookie Policy for full details

Rapid7 Blog

Metasploit Weekly Wrapup  

Metasploit Wrap-Up

Better persistence options thanks to two new modules for Yum and APT package managers. Plus, new exploits for Rails DoubleTap and Spring Cloud Config.…

Metasploit Wrap-Up

Faster tab completion for `set PAYLOAD` and faster output for `show payloads`. Plus, four new exploits, including unauthenticated template injection for Atlassian Confluence and Ruby on Rails DoubleTap directory traversal.…

Metasploit Wrap-Up

A more useful use command From among the many musings of longtime contributor/team member Brent Cook, in a combined effort with the ever-present wvu, the use command has become so much more useful. PR 11724 takes new functionality from search -u one step further…

Metasploit Wrap-Up

WordPress RCE tiyeuse submitted a Metasploit module for an authenticated remote code execution vulnerability in WordPress, which was described in a blog post by RIPS Technology. After authenticating as a user with at least author privileges, the module starts by uploading an image file with…

Metasploit Wrap-Up

Your workflow just got easier Are you tired of copy/pasting module names from the search results before you can use them? Thanks to this enhancement (PR #11652) by Brent Cook, you can now run search with the -u flag to automatically use a module…

Metasploit Wrap-Up

Introducing Metasploit Development Diaries We are happy to introduce a new quarterly series, the Metasploit Development Diaries. The dev diaries walk users and developers through some example exploits and give detailed analysis of how the exploits operate and how Metasploit evaluates vulnerabilities for inclusion in…

Metasploit Wrap-Up

Spring is here: Four new modules and metashell improvements.…

Metasploit Wrap-Up

elFinder remote command injection elFinder is a client-side open-source file manager tool written for web applications. In a browser it has the look and feel of a native file manager application. It ships with a PHP connector, which integrates the client side with the back…

Metasploit Wrap-Up

The Payload UUID and paranoid mode Meterpreter payload and listener features were first introduced and added to many HTTP and TCP Metasploit payloads in mid-2015.…

Metasploit Wrap-Up

An improvement to HTTP command stagers allows exploits to write on-disk stagers to the location of your choosing.…

Metasploit Wrap-up

Document ALL THE THINGS! This release sees quite a bit of documentation added with a module doc from bcoles and four new module docs from newer docs contributor Yashvendra. Module docs can be viewed with info -d and are extremely helpful for getting acquainted with…

Metasploit Wrap-Up

Crock-Pot cooking with Metasploit Belkin's Wemo line of smart home devices offers users a variety of internet-connected gadgets and gizmos they can control around the home. One of those happens to be a Crock-Pot. We went ahead and bought one. Naturally, it made sense for…

Metasploit Wrap-Up

Ubiquitous Devices Our Rapid7 Labs team pulled the thread on some recent buzz around exploitable Ubiquiti devices, which led to a new scanner module (auxiliary/scanner/ubiquiti/ubiquiti_discover.rb) from jhart-r7. This module uses a simple UDP protocol to identify potentially exploitable Ubiquiti devices…

Metasploit Wrapup

Hi everyone! For those in the US, hope you all had a great MLK weekend. We have a pretty light release due to the holiday, but we still have some cool stuff in the house. Check it out!…

Metasploit Wrapup

This week, phra offers up a new potato dish to make privilege escalation in Windows just a bit tastier.…