rapid7/metasploitable3
Metasploitable3
Metasploitable3 is an automated virtual machine provisioner designed to build and deploy operating system images with intentional security weaknesses. It functions as a penetration testing lab by creating vulnerable virtual machine targets used for security training, exploit development, and the validation of security tools.
The system uses configuration scripts to inject vulnerabilities into Windows and Linux environments. This includes the deployment of insecure applications and services, such as web servers and databases, and the application of misconfigured system permissions to simulate real-world software flaws.
The project manages the environment provisioning process through orchestration and configuration management tools. These tools allow for the creation of reproducible security scenarios across different virtualization platforms by combining base images with scripts that introduce specific vulnerabilities.
Features
- Cybersecurity Training Labs - Provides a complete training lab environment with vulnerable Windows and Linux machines for offensive security practice.
- Virtual Machine Provisioners - Automates the acquisition of images and generation of configurations to deploy virtualized security targets.
- Vagrant Multi-Provider Orchestrators - Leverages Vagrant to orchestrate the lifecycle of virtual machine environments across different providers.
- Vulnerable - Enables the building and launching of intentionally insecure virtual machines to serve as penetration testing targets.
- Vulnerable Infrastructure - Provisions virtualization environments that are intentionally configured with security weaknesses.
- Vulnerability Simulations - Builds reproducible virtualized environments that simulate specific software flaws and misconfigurations.
- Vulnerable Lab Environments - Creates a controlled lab environment consisting of intentionally insecure virtual machines for penetration testing practice.
- Image Provisioning - Provisions virtual machine instances from standardized base images and then applies layered security flaws.
- Vulnerable Operating System Images - Builds operating system images designed with insecure services and configurations for research and training.
- Exploit Development Testing Environments - Deploys insecure operating systems and services as safe targets for validating and refining new security exploits.
- Vulnerable Targets - Deploys pre-configured, intentionally insecure virtual machines to serve as targets for security research.
- Vulnerability Injection Recipes - Uses automated recipe scripts to install outdated services and misconfigure permissions to create intentional security holes.
- Configuration Management Systems - Employs a configuration management system to automate the injection of insecurity and system settings during VM provisioning.
- Hypervisor Backend Integrations - Utilizes an abstraction layer to ensure virtual targets can be deployed across various host hypervisors.
- Security Testing Tools - Provides targets to verify the effectiveness and accuracy of security testing tools through active probing.
- Configuration-Based Vulnerability Simulation - Allows modifying system configurations and installed services via automation recipes to create specific security scenarios.
- Vulnerable Systems and Mobile - VM built with numerous security vulnerabilities for testing.
- Vulnerable Applications - VM built with a large amount of security vulnerabilities.
- Vulnerable Environments - Virtual machine built for testing exploitation techniques.
- Vulnerable Systems - Vulnerable virtual machine for practicing exploitation techniques.
