MSF RCP case studies
MSF RCP · Put your knowledge to work in context.
The Metasploit Pro Certified Professional credential is a vendor-issued certification from Rapid7 that validates practical skill with Metasploit Pro, the commercial platform built on the open-source Metasploit Framework. It is aimed at penetration testers, red team operators, security consultants, and SOC or vulnerability-management staff who need to plan engagements, scan and validate findings, exploit confirmed weaknesses, run post-exploitation, and hand clients a defensible report. The MSF RCP case studies are 5 cases and about 4,436 words.
1The Module That Never Appeared and the Scan That Never Persisted
A junior consultant joins a five-person offensive security team and is handed a Kali workstation plus access to the team's shared msfconsole workflow. They drop a custom exploit module at /usr/share/metasploit-framework/modules/exploits/windows/http/acme upload.rb, start the console, and search acme returns nothing.
831 words, about 4 min2Covering a /22 in Twenty Hostile Hours
The scope is the client's internal server range 172.16.8.0/22 - 1,022 addresses - reachable only from a jump host inside the data centre. The network team confirms ICMP echo is blocked across the server VLAN and that the core firewall rate-limits new TCP connections from any single source to 20 per second.
930 words, about 5 min3One Host, Two Failed Payloads, and an Egress Policy
An external test targets a single host, 203.0.113.45 - Windows Server 2016 x64 running Tomcat 8 with a manager application reachable over HTTPS. The client's edge firewall permits inbound 443 only, and outbound TCP 80/443 to any destination plus DNS; everything else is dropped.
912 words, about 5 min4350 Mailboxes, a Blocked Macro, and a Board Report
A retail client authorises a phishing simulation against 350 employees across four departments. The rules are explicit: a lookalike domain registered for the exercise, one landing page, no credential capture - a "submit" is recorded as a click-through event only - and no malware may execute on employee endpoints.
885 words, about 4 min5The Pivot That Left the Scope Document
On day 6 of a 10-day internal test, the tester holds a SYSTEM session on app-01 (10.0.5.14) and pivots to 10.0.9.31 using harvested service credentials. The authorisation letter names only 10.0.5.0/24 plus two named hosts; 10.0.9.0/24 appears nowhere.
878 words, about 4 min