Date : 06 Mar, 2025

[Download Metasploitable](https:// sourceforge.net/projects/metasploitable/)

1. extract all → then open the vmx file in vmware

2. username : msfadmin,password :msfadmin

3. ifconfig

   • this will get you the ip of metasploit, which is the target ip

4. Create a new scan in nessus
   

5. Advanced scan
   

6. Fill the following details
   

7. Discovery → host discovery → do the following edits
   

8. Go to port scanning
   

9. turn on the UDP
   

10. in port scanning : set port scan range
    

11. Web applications → do the following edits
    
    
    

12. Go to report
    ! 900
    

13. go to advanced → enable the safe checks

! 900

14. go to Credentials → shh
    
    

15. go to plugins and disable the following
    
    
    ! 900
    

16. Save

• In metasplotable-2, hit the following command to know the target os
  

Burp Suite — Web App Hacker Tool

• Think of it as a hacker's magnifying glass for websites.

• It helps you test if login forms, search boxes, etc. can be hacked.

• You can see and change the data sent between browser and website.

• It’s used for testing things like:

  • Login bypass
  • XSS (cross-site scripting)
  • SQL injection
  • Hidden bugs in web pages

Nessus — Network Scanner

• Think of it as a security guard checking if your computers and servers have known problems.

• It scans for:

  • Weak passwords
  • Outdated software
  • Open ports that hackers could use
  • Known vulnerabilities (CVEs)