I85PREP
⌘ K
MSF RCP study materials
MSF RCP study resources

MSF RCP: Metasploit Pro Workflows and Reporting

MSF RCP · Work through your exam, one topic at a time.

All guide sections

Metasploit Pro Workflows and Reporting

Metasploit Pro workflows and reporting tests whether you can run a project-based engagement from discovery through evidence collection to a defensible report. Expect questions on projects, scans, imports, exploitation, credentials, tags, task chains, and report types.

Core rules

  • Pro organizes work into projects. A project holds hosts, services, vulnerabilities, credentials, loot, evidence, and reports. Create one project per engagement or scope boundary.
  • Typical workflow: create project, add target range, run discovery scan, import scanner or Nexpose data, validate findings, exploit authorized targets, collect evidence, tag hosts, then generate reports.
  • Task chains automate sequences such as scan, import, and exploit. They still require correct scope and credentials; automation does not grant authorization.
  • Pro report types include audit, compliance, credentials, executive summary, FISMA, ISO 27001, PCI, web application, and custom. Reports can export to PDF, HTML, XML, CSV, and RTF.
  • The API supports automation and integration. Treat API keys as credentials and protect project exports because they can contain sensitive data.

Worked example

Create project ClientA-Q3, add 10.10.10.0/24, run a discovery scan, and import a Nexpose export. Validate SMB findings, exploit only the authorized host, collect session evidence, and tag hosts as validated or false-positive. Generate an audit report plus an executive summary. Reasoning: the project isolates data; import avoids duplicate scanning; validation prevents unproven findings from reaching the report; tags make the report readable. The executive summary should not expose raw credentials.

Traps

  • Reporting every imported scanner finding without validation.
  • Adding a target range outside the statement of work because Pro accepts it.
  • Forgetting to collect evidence before closing sessions.
  • Mixing two clients in one project.
  • Exporting projects or reports containing plaintext credentials without protection.
  • Treating a task chain as a substitute for checking scope and timing.