Practice Lab · Safe VM

Metasploitable

A deliberately vulnerable Linux VM for safe, legal practice.

ModuleSafe VMPhasePractice LabTypeDefensive / AnalysisPlatformKali Linux

Safe to try on your own machine. Spin up your Kali Linux lab and practice away — on any system you own or have permission to test. That’s exactly how the pros learn.

Definition

Metasploitable is an intentionally vulnerable Linux virtual machine built by Rapid7 for security training and testing.

Primary purpose

Provide a safe, legal target to practice vulnerability scanning, exploitation, and post-exploitation.

Cybersecurity use

Hands-on learning and tool practice (Nmap, Metasploit, Nessus) in an isolated lab, never exposed to a live network.

Key features

Pre-loaded vulnerabilities

Ships with outdated, misconfigured services (FTP, Samba, Tomcat, databases).

Isolated lab target

Designed to run in an isolated VM/network (VirtualBox, VMware).

Multiple versions

Metasploitable 2 and 3 offer different OS bases and vuln sets.

Pairs with Metasploit

Commonly used as the target when learning the Metasploit Framework.

Default weak credentials

Known default accounts for practicing credential-based access.

Important commands

$nmap -sV <metasploitable-ip>

Enumerate services and versions on the VM.

$msfconsole

Launch the Metasploit Framework console.

$use exploit/<path>

Select a specific exploit module.

$set RHOSTS <metasploitable-ip>

Set the target IP for the module.

$run

Execute the configured module against the target.

$ssh msfadmin@<metasploitable-ip>

Practical examples

01Service enumeration

command

nmap -sV -p- 192.168.56.102

Purpose Identifies all open ports and service versions for later targeting.

02Launch Metasploit against a known service

command

msfconsole
use exploit/unix/ftp/vsftpd_234_backdoor
set RHOSTS 192.168.56.102
run

Purpose Exploits a deliberately backdoored FTP service, in a lab-only setting.

03Default credential login

command

ssh msfadmin@192.168.56.102

Purpose Practices authenticating with the VM's intentionally weak lab credentials.

Important points

Lab-only use: Run on an isolated/host-only network; never expose it to the internet.
Not representative of production: Its vulnerabilities are deliberately severe — great for learning, not realistic of hardened systems.
Legal boundaries still apply: Techniques practiced here must not be reused against systems without authorization.
Version differences: Metasploitable 2 (Ubuntu) and 3 (Windows/Linux) target different skill levels.

Common use cases

Pen-testing training

Practice recon, scanning, exploitation and post-exploitation safely.

Tool familiarization

Learn Nmap, Metasploit and Nessus against a predictable target.

Certification prep

Common in OSCP-style and hands-on security coursework.

CTF / lab exercises

A base image for capture-the-flag training.