MSF RCP study plan

Diagram the Metasploit architecture from memory: msfconsole, msfvenom, msfrpcd, module tree, database backend, and how Rex/core/msfbase libraries layer together

Install Metasploit Framework on a dedicated lab VM and initialize the PostgreSQL database, confirming msfdb status reports connected

Enumerate the console's core commands (search, use, info, show options, set, setg, back, sessions, workspace) and record each command's purpose in your own notes

Configure a workspace per engagement and capture the exact commands used in a reproducible setup script

Explain how a module's mixins, options, targets, and payload compatibility rules determine what payloads can pair with an exploit

Run at least three exploits against intentionally vulnerable lab targets (e.g., Metasploitable) using both reverse and bind payloads, and compare reliability

Practice generating payloads with msfvenom, setting LHOST/LPORT, encoders, and output formats, and verify each artifact runs in the lab

Use check where a module supports it and interpret the returned vulnerability code

Transition sessions from raw shell to Meterpreter and demonstrate migration, process listing, and privilege context checks

Execute post-exploitation modules for credential harvesting, local enumeration, and persistence in the lab, documenting each module's required options

Use the route and portfwd commands to pivot through a compromised host to a second lab subnet

Script a repeatable workflow with resource files that automates exploitation through post-exploitation steps

Integrate Nmap and auxiliary scanner modules with the Metasploit database, then query results with hosts, services, and vulns

Import third-party scan output (e.g., Nmap XML) and use search with database-backed filters to prioritize targets

Validate at least three suspected vulnerabilities manually with auxiliary modules and explain how false positives arise

Map findings to a severity ranking and justify each rating with evidence from the lab

Build a client-side attack chain (e.g., browser or document exploit) in the lab and explain each stage from delivery to session

Set up a controlled listener and demonstrate payload delivery through a local test page or file, verifying the callback

Compare client-side payload formats and explain trade-offs in detection, reliability, and user interaction

Document defensive indicators that would reveal the attack in logs or endpoint telemetry

Perform thorough post-exploitation enumeration on a compromised lab host: users, privileges, network shares, and installed software

Demonstrate credential extraction from memory or configuration in the lab and explain the operational risk of each technique

Configure and verify a persistence mechanism, then clean it up completely and confirm removal

Review Meterpreter extension commands and note which ones require elevated context

Walk through a Metasploit Pro project lifecycle in a trial or lab instance: discovery, exploitation, evidence collection, and report generation

Produce a client-ready report from the platform and critique its accuracy, clarity, and remediation guidance

Draft a rules-of-engagement and scope document covering authorization, target boundaries, data handling, and stop conditions

Apply an ethical decision framework to three gray-area scenarios (out-of-scope host discovered, sensitive data encountered, testing window exceeded)

Run a timed full-scope lab engagement end to end, from recon through reporting, without consulting notes for core commands

Revisit every missed or uncertain objective from weeks 1-7 and close each gap with a hands-on retest

Explain the architecture, module mechanics, and post-exploitation flow aloud in a ten-minute self-review

Finalize a personal command reference and remediation checklist for future use