+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: How to test metasploit network with a test target site? (/showthread.php?tid=6188592)
How to test metasploit network with a test target site? - abadguy87 - Jan 10, 2022
I'm looking for a way to test if everything on my end is working correctly, this is my setup so far:
Kali VM with bridged adapter
Home router with portforward on TCP port 4444 with Kali Local IP (the one I see from ifconfig under inet)
Inside metasploit I set LHOST with Public IP (the one I see from whatsmyip.org) and I set LPORT 4444
Inside metasploit I set ReverseListenerBindAddress to Local IP (the one I see from ifconfig under inet)
Am I missing something? All I get is exploit completed but no session was created.
I need a dummy site test on where to test a random exploit/payload, outside my network (tried with VM/metasploitable and it's working but I need an outside my network proof), to verify that everything from my side is working correctly.
Do you know any? Maybe you can suggest some tutorial?
Thank you very much.
RE: How to test metasploit network with a test target site? - linkinpork - Jan 11, 2022
(Jan 10, 2022 03:43 PM)abadguy87 Wrote: Do you know any? Maybe you can suggest some tutorial?
Thank you very much.
Super suggest you stop opening home ports externally and opt to get a VPS instead. You're opening yourself to getting scanned by everyone, everywhere, not to mention it kills your OPSEC. Here's a guide on setting up a VPS using DigitalOcean: http://www.listchan.com/2021/07/list-to-do-list-when-making-vpsrdp.html
You can try to contact Doc when he's up again, he made an installer that pulls together pentest tools from scratch.
As for test sites, you can try the Metasploitable https://information.rapid7.com/download-metasploitable-2017.html and run it in a virtual machine. Or if you want to be a little daring, you try and look around Shodan to see if any Metasploitable machines are public.
Cheers!