Shulou(Shulou.com)06/01 Report--

Functional characteristics

Description

Metasploit Framework

Metasploit Community

Metasploit Express

Metasploit Pro

Pricing

License

No IP restriction

Free

Free

Charge

Charge

User interface

Web interface

Provide a friendly web interface, greatly improve efficiency and reduce dependence on technical training

N

Y

Y

Y

Command line interface

. Command line interface

Y

N

N

Y

Professional console

Advanced command line functions, through the professional console can use new higher-level commands, better management of data, improve overall efficiency.

N

N

N

Y

* Test

Comprehensive exp coverage

Metasploit has the largest high-quality public library in the world.

Y

Y

Y

Y

Manual *

Launch a single * for a host.

Y

Y

Y

Y

Basic *

Launch a single * for any number of hosts

N

Y

Y

Y

Intelligence *

Automatically select all matching exp for the safest and most reliable test. Support dry-run mode to know which exp will run before launching *.

N

N

Y

Y

* chain

Automatically organize * and auxiliary modules, such as for Cisco routers

N

N

N

Y

Evidence collection

One click to collect evidence of capturing the host, including screenshots, passwords, hashes, system information, etc.

N

N

Y

Y

After *

. After successfully capturing a host, the customized post module is automatically launched.

N

N

N

Y

Session persistence

The connection can be reconnected automatically after the connection is disconnected. For example, a phishing user shuts down his laptop and automatically establishes a connection after rebooting.

N

N

N

Y

Password violence guess

Quickly test the most commonly used or previously captured passwords. If it is a weak password or pass-the-hash*** mode, the hash value can be cracked automatically.

N

N

Y

Y

Social engineering

Simulate fishing. Create a USB drive with malicious files to * a machine.

N

N

N

Y

Web application testing

Scan, audit, and * * vulnerabilities in Web applications, such as OWASP Top10.

N

N

N

Y

IDS/IPS bypass

Bypass the detection of IDS/IPS

N

N

N

Y

Exempt from killing

Use dynamic loads to bypass antivirus systems, so you don't need to waste time writing dynamic loads yourself.

N

N

N

Y

Load generator

Generate independent excellent loads through a quick interface

N

N

N

Y

Agent springboard

Launch a * against another foreign target through a captured host.

Y

Y

Y

Y

× × springboard

Establish a layer 2 network connection channel through a compromised host, so that you can use network-based tools, such as vulnerability scanners, to get more information for further use of more advanced technologies

N

N

N

Y

Report form

Basic report

Generate basic test reports, including audit reports and compromised host reports

N

N

Y

Y

Advanced report

Generate various reports, including Web application test reports, social engineering simulation reports, and compliance reports such as PCI

N

N

N

Y

Efficiency enhancement

Quick start Wizard

Perform baseline * * tests to find easy targets, Web application tests or simulated fishing *. Through the wizard, you can get started quickly and have a better understanding after the wizard is completed.

N

N

N

Y

MetaModules

MetaModules simplifies security testing for IT security experts. Many security testing techniques are either based on tedious tools or require custom development, which takes a lot of time. To speed up such tests, MetaModules automates common but complex security tests, thus providing understaffed security departments with a more effective way to get the job done. MetaModules includes network segmentation and firewall testing, passive network discovery, credential testing and * *.

N

N

N

Y

Discovery scan

Use integrated NMAP scanners with advanced fingerprinting technology to depict the entire network and identify the devices in the network

N

Y

Y

Y

Script playback

Generate a script to reproduce * so that you can test whether the remediation work is effective.

N

N

Y

Y

Data management

Track all found data in a searchable database. Find outliers in the grouping view.

N

Y

Y

Y

Marking

By tagging the host, you can assign the host to someone, mark it as an import source, mark the project scope, or mark a high-value target. In the future, you can find the corresponding host through the tag.

N

N

N

Y

Task chain

Create a custom workflow

N

N

N

Y

Professional API

Metasploit Pro can be integrated into SIEM and GRC systems or customized automation and integration can be achieved using advanced, fully documented API

N

N

N

Y

Integration

SIEM and GRC integration out of the box

N

N

N

Y

Teamwork

Collaborate with multiple team members on the same project, divide the workload, and make use of different levels of expert experience. Share all the information into a unified report.

N

N

N

Y

Security Programs

Closed-loop risk verification

Verify vulnerabilities and misconfigurations so that risks can be graded and results can be pushed back to Nexpose

N

N

N

Y

Simulated fishing * *

Send simulated phishing emails to measure users' security awareness, including how many people click on the link in the message or enter login credentials on a fake login page, and can train users with dangerous behavior

N

N

N

Y

Vulnerability verification

Vulnerability import

Import output files from Nexpose and third-party vulnerability scanning systems

Y

Y

Y

Y

Web vulnerability import

Import output files from various third-party Web application scanners

N

N

Y

Y

Nexpose scanning

Start a Nexpose scan directly on the interface. The results are automatically imported into Metasploit

N

Y

Y

Y

Direct import

Import the existing nexpose scan results directly

N

N

N

Y

Vulnerability exception

After verification, the vulnerability exception is pushed back to Nexpose, including comments and exception time limit.

N

N

Y

Y

Closed-loop integration

Mark and push vulnerabilities that can be * to Nexpose

N

N

N

Y

Re-run Session

Run * * again to verify the effectiveness of a remedy, such as whether a patch works

N

N

Y

Y

Support

Community support

Get support in the Rapid7 community

Y

Y

Y

Y

Rapid7 support

7X24 hourly email and phone support

N

N

Y

Y

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.