HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
rapid7
metasploit-framework
Ruby2012–2026
rapid7 / metasploit-framework

metasploit-framework

Metasploit Framework

Explore on GitHubRead Hacker News discussions
37Distinct people
38Mentions
1Explicit recommenders
39.6KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Metasploit Framework

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

As much as I love Mozilla and their philosophy, it has to be said that - if you have any sort of worries about security - using Firefox is a bad choice and borderline reckless.…

lima used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year38 dated mentions

Observed mentions: 2012-06-11 14:51:26 UTC to 2026-08-03 13:27:16 UTC.

024682012-01-01 00:00:00 UTC to 2013-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments20122013-01-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 8 mentions; 4 submissions, 4 comments2015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 4 mentions; 2 submissions, 2 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 3 mentions; 2 submissions, 1 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 3 mentions; 2 submissions, 1 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 2 mentions; 2 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20122012-01-01 00:00:00 UTC2013-01-01 00:00:00 UTC312
20132013-01-01 00:00:00 UTC2014-01-01 00:00:00 UTC514
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC844
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC422
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC202
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC321
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC110
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC321
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC211
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC404
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC000
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC220
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC000
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC000
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC101

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
Metasploit Framework The Metasploit Framework is an open-source tool released under a BSD-style license. For detailed licensing information, refer to the COPYING file. Latest Version Access the latest version of Metasploit from the Nightly Installers page. Documentation Comprehensive documentation, including usage guides, is available at Metasploit Docs. Development Environment To set up a development environment, visit the Development Setup Guide. Bug and Feature Requests Submit bugs and feature requests via the GitHub Issues tracker. New submissions can be made through the MSF-BUGv1 form. API Documentation For information on writing modules, refer to the API Documentation. Support and Communication For questions and suggestions, you can: Join our GitHub Discussions for community support and general questions Join the Metasploit Slack for real-time chat Submit GitHub Issues for bug reports and feature requests Follow @metasploit on X or @metasploit@infosec.exchange on Mastodon for updates Note: Some community members may still use IRC channels and the metasploit-hackers mailing list, though the primary support channels are now GitHub Discussions and Slack. Installing Metasploit Recommended Installation We recommend installation with the official Metasploit installers on Linux or macOS. Metasploit is also pre-installed with Kali. For a manual setup, consult the Dev Environment Setup guide. Using Metasploit To get started with Metasploit: Start msfconsole: This is the primary interface for interacting with Metasploit. Explore Resources: Visit the Using Metasploit section of the documentation. Contributing To contribute to Metasploit: Setup Development Environment: Follow the instructions in the Development Setup Guide on GitHub. Clone the Repository: Obtain the source code from the official repository. Submit a Pull Request: After making changes, submit a pull request for review. Additional details can be found in the Contributing Guide.
Read the full README on GitHub

What Hacker News says

38 sources
gzer0·Sep 3, 2021
Searching for the text "strcmp" finds a static string that is referenced in the sub_ED7D94 function. Looking at the strings output, we can see some interesting string references, including auth_admin_ssh_special and auth_admin_internal. Searching for auth_admin_internal finds the sub_13DBEC function. This function has a strcmp call that is not present in the 6.3.0r19b firmware: The argument to the strcmp call is <<< %s(un='%s') = %u, which is the backdoor password, and was presumably chosen so that it would be mistaken for one of the many other debug format strings in the code. This password allows an attacker to bypass authentication through SSH and Telnet. [1] is the backdoor. [2] is more details regarding discovery. [1] https://github.com/rapid7/metasploit-framework/blob/master/m... [2] https://blog.rapid7.com/2015/12/20/cve-2015-7
Read the rest
755-juniper-scr...
In The NSA's Backdoor in Dual EC
progval·Aug 31, 2020
As an occasional rust programmer: you don't see this kind of behavior from the rust community. You see it when a random person opens an issue on a bugtracker you are subscribed to. Then it's usually prompty closed by a maintainer because the issue is very low effort, and the author doesn't offer to do any work themselves. Examples: https://gitlab.com/fdroid/fdroidclient/-/issues/1049 and https://github.com/rapid7/metasploit-framework/issues/9092
In Supporting Linux kernel development in Rust
e12e·Jul 21, 2017
I'm not sure what you mean - as stated in the article, and the linked blackhat presentation, this has been broken and exploited for 15 years: https://github.com/rapid7/metasploit-framework/blob/master/m... and/or: https://github.com/rapid7/metasploit-framework/blob/master/d... Getting a hash is rather simple, if you already have access to the lan, assuming you are able to redirect traffic or insert yourself between the target user and the network (say, false wifi ap): https://shellgam3.com/2016/03/14/capturing-and-cracking-ntlm... I'm generally not much of fan of firewalls (precisely because they by definition set up a "soft core" that's assumed to be safe) - but egress filtering of smb packets is unfortunately necessary if you have an winodws (and/or smb/cifs) clients on your network. I would much rather only run boxes that are "fit for
Read the rest
the Internet" - but that's been rather difficult to do with windows for the past decades. In fairness, Microsoft has made a number of improvements - but still not enough. It would be nice if there was an easy way to set up the network so all clients used only kerberos5, and only sent credentials to kerberos principals in a trusted domain. As far as I know, there is no such easy way.
In NTLM Hash Leaks: Ancient Microsoft Design Flaw

Showing the 15 most recent of 38 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.