HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
rapid7
metasploit-framework
Ruby2012–2026
rapid7 / metasploit-framework

metasploit-framework

Metasploit Framework

Explore on GitHubRead Hacker News discussions
37Distinct people
38Mentions
1Explicit recommenders
39.6KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Metasploit Framework

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

As much as I love Mozilla and their philosophy, it has to be said that - if you have any sort of worries about security - using Firefox is a bad choice and borderline reckless.…

lima used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 7:02:50 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year38 dated mentions

Observed mentions: 2012-06-11 14:51:26 UTC to 2026-08-03 13:27:16 UTC.

024682012-01-01 00:00:00 UTC to 2013-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments20122013-01-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 8 mentions; 4 submissions, 4 comments2015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 4 mentions; 2 submissions, 2 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 3 mentions; 2 submissions, 1 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 3 mentions; 2 submissions, 1 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 2 mentions; 2 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20122012-01-01 00:00:00 UTC2013-01-01 00:00:00 UTC312
20132013-01-01 00:00:00 UTC2014-01-01 00:00:00 UTC514
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC844
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC422
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC202
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC321
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC110
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC321
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC211
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC404
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC000
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC220
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC000
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC000
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC101

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
Metasploit Framework The Metasploit Framework is an open-source tool released under a BSD-style license. For detailed licensing information, refer to the COPYING file. Latest Version Access the latest version of Metasploit from the Nightly Installers page. Documentation Comprehensive documentation, including usage guides, is available at Metasploit Docs. Development Environment To set up a development environment, visit the Development Setup Guide. Bug and Feature Requests Submit bugs and feature requests via the GitHub Issues tracker. New submissions can be made through the MSF-BUGv1 form. API Documentation For information on writing modules, refer to the API Documentation. Support and Communication For questions and suggestions, you can: Join our GitHub Discussions for community support and general questions Join the Metasploit Slack for real-time chat Submit GitHub Issues for bug reports and feature requests Follow @metasploit on X or @metasploit@infosec.exchange on Mastodon for updates Note: Some community members may still use IRC channels and the metasploit-hackers mailing list, though the primary support channels are now GitHub Discussions and Slack. Installing Metasploit Recommended Installation We recommend installation with the official Metasploit installers on Linux or macOS. Metasploit is also pre-installed with Kali. For a manual setup, consult the Dev Environment Setup guide. Using Metasploit To get started with Metasploit: Start msfconsole: This is the primary interface for interacting with Metasploit. Explore Resources: Visit the Using Metasploit section of the documentation. Contributing To contribute to Metasploit: Setup Development Environment: Follow the instructions in the Development Setup Guide on GitHub. Clone the Repository: Obtain the source code from the official repository. Submit a Pull Request: After making changes, submit a pull request for review. Additional details can be found in the Contributing Guide.
Read the full README on GitHub

What Hacker News says

8 sources
nikcub·Apr 12, 2014
Reading Cloudflare's blog post[0], they keep referring to the exploit having a length of 65,536 bytes, and how an allocation of that size is unlikely to find itself lower in the heap. That is true - but this exploit doesn't depend on setting a length of 65,536. The server takes whatever length the client gives it (which is, afterall, the bug). Most of the early exploits just happen to set the maximum packet size to get as much data out (not realizing the nuances of heap allocation). You can set a length of 8bytes or 16bytes and get allocated in a very different part of the heap. The metasploit module for this exploit[1] supports varied lengths. Beating this challenge could have been as simple as running it with short lengths repeatably and re-assembling the different parts of the key as you find it. edit something that I want to sneak in
Read the rest
here since I missed the other threads. Cloudflare keep talking about how they had the bug 12 days early. Security companies and vendors have worked together to fix bugs in private for years, but this is the first time i've ever seen a company brag about it or put a marketing spin on it. It isn't good - one simple reason why: other security companies will now have to compete with that, which forces companies not to co-operate on bugs (we had the bug 16 days early, no we had the bug 18 days early!, etc.). As users you want vendors and security companies co-operating, not competing at that phase. [0] Cloudflare - Can You Get Private SSL Keys Using Heartbleed? http://blog.cloudflare.com/answering-the-critical-question-c... [1] see https://github.com/rapid7/metasploit-framework/blob/master/m...
In CloudFlare's Heartbleed challenge cracked
joev_·Mar 29, 2014
Good writeup, not enough people go in depth like this on shellcode! Metasploit has some decent shellcode. What you wrote here is essentially a specialized execve payload. Some of metasploit's execve payloads support passing arguments to execve, by building the args array on the fly: https://github.com/rapid7/metasploit-framework/blob/master/m... There are also lots of reverse shells like this, and reverse stagers too. Additionally, there are other solutions to bind shells being noisy: See https://github.com/rapid7/metasploit-framework/pull/3017 Which causes the port to show as "closed" in a scan, and https://github.com/rapid7/metasploit-framework/pull/2981 Which prevents other IPs from jacking your shells. EDIT: also I think you need a null byte at the end of everything, otherwise the last arg string might not terminate correctly dependin
Read the rest
g on what's in memory.
In Shellcode to reverse bind a shell with netcat

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.