MSF RCP study guide
MSF RCP · Work through your exam, one topic at a time.
The Metasploit Pro Certified Professional credential is a vendor-issued certification from Rapid7 that validates practical skill with Metasploit Pro, the commercial platform built on the open-source Metasploit Framework. It is aimed at penetration testers, red team operators, security consultants, and SOC or vulnerability-management staff who need to plan engagements, scan and validate findings, exploit confirmed weaknesses, run post-exploitation, and hand clients a defensible report. The MSF RCP study guide has 9 sections and about 3,162 words.
01Metasploit Framework Fundamentals and Architecture
The Metasploit Framework fundamentals domain tests whether you know what each module type is for, how the framework finds and ranks modules, and how an exploit, payload, and handler fit together. Questions often probe file layout, module metadata, staged versus stageless payloads, and the object names shown in the console.
373 words, about 2 min02Installation, Configuration, and Console Operation
Installation, configuration, and console operation tests whether you can stand up a working console, connect the database, isolate engagement data, and automate repetitive commands. Expect questions on msfdb , workspaces, datastore scope, logging, and resource scripts.
336 words, about 2 min03Information Gathering and Scanning
Information gathering and scanning tests whether you can enumerate hosts and services safely, choose the right auxiliary scanner, and move results into the database for later exploitation. Expect questions on db nmap , scanner naming, RHOSTS formats, and threading.
335 words, about 2 min04Vulnerability Analysis and Validation
Vulnerability analysis and validation tests whether you can turn scan data into confirmed, evidence-backed findings. Expect questions on the check method, module references, false positives, version ambiguity, and the difference between a scanner hit and a validated vulnerability.
325 words, about 2 min05Exploitation with Modules and Payloads
Exploitation with modules and payloads tests whether you can configure an exploit correctly, select a compatible payload, establish a handler, and manage sessions without collateral damage. Expect questions on TARGET , PAYLOAD , LHOST , LPORT , staged payloads, multi/handler , and msfvenom .
360 words, about 2 min06Meterpreter and Post-Exploitation
Meterpreter and post-exploitation tests whether you can operate a session, escalate privileges carefully, collect evidence, pivot into reachable networks, and clean up. Expect questions on getsystem , migrate , hashdump , post modules, routing, port forwarding, and session management.
347 words, about 2 min07Client-Side and Social Engineering Attacks
Client-side and social engineering attacks tests whether you can deliver a payload through a user action, configure browser or file-format exploits, and run a handler that the victim can reach. Expect questions on SRVHOST , URIPATH , msfvenom templates, HTA and macro delivery, and Metasploit Pro phishing campaigns.
375 words, about 2 min08Metasploit Pro Workflows and Reporting
Metasploit Pro workflows and reporting tests whether you can run a project-based engagement from discovery through evidence collection to a defensible report. Expect questions on projects, scans, imports, exploitation, credentials, tags, task chains, and report types.
344 words, about 2 min09Ethics, Scope, and Legal Compliance
Ethics, scope, and legal compliance tests whether you can act professionally under authorization, stay inside the rules of engagement, protect data, and report findings responsibly. Expect questions on written permission, scope boundaries, privacy law, evidence handling, and disclosure.
367 words, about 2 min