HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
rapid7
metasploit-framework
Ruby2012–2026
rapid7 / metasploit-framework

metasploit-framework

Metasploit Framework

Explore on GitHubRead Hacker News discussions
37Distinct people
38Mentions
1Explicit recommenders
39.6KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

Metasploit Framework

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

As much as I love Mozilla and their philosophy, it has to be said that - if you have any sort of worries about security - using Firefox is a bad choice and borderline reckless.…

lima used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 6:01:08 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year38 dated mentions

Observed mentions: 2012-06-11 14:51:26 UTC to 2026-08-03 13:27:16 UTC.

024682012-01-01 00:00:00 UTC to 2013-01-01 00:00:00 UTC (exclusive): 3 mentions; 1 submissions, 2 comments20122013-01-01 00:00:00 UTC to 2014-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 8 mentions; 4 submissions, 4 comments2015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 4 mentions; 2 submissions, 2 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 3 mentions; 2 submissions, 1 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 3 mentions; 2 submissions, 1 comments20192020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments2021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 4 mentions; 0 submissions, 4 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 2 mentions; 2 submissions, 0 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20122012-01-01 00:00:00 UTC2013-01-01 00:00:00 UTC312
20132013-01-01 00:00:00 UTC2014-01-01 00:00:00 UTC514
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC844
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC422
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC202
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC321
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC110
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC321
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC211
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC404
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC000
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC220
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC000
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC000
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC101

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
Metasploit Framework The Metasploit Framework is an open-source tool released under a BSD-style license. For detailed licensing information, refer to the COPYING file. Latest Version Access the latest version of Metasploit from the Nightly Installers page. Documentation Comprehensive documentation, including usage guides, is available at Metasploit Docs. Development Environment To set up a development environment, visit the Development Setup Guide. Bug and Feature Requests Submit bugs and feature requests via the GitHub Issues tracker. New submissions can be made through the MSF-BUGv1 form. API Documentation For information on writing modules, refer to the API Documentation. Support and Communication For questions and suggestions, you can: Join our GitHub Discussions for community support and general questions Join the Metasploit Slack for real-time chat Submit GitHub Issues for bug reports and feature requests Follow @metasploit on X or @metasploit@infosec.exchange on Mastodon for updates Note: Some community members may still use IRC channels and the metasploit-hackers mailing list, though the primary support channels are now GitHub Discussions and Slack. Installing Metasploit Recommended Installation We recommend installation with the official Metasploit installers on Linux or macOS. Metasploit is also pre-installed with Kali. For a manual setup, consult the Dev Environment Setup guide. Using Metasploit To get started with Metasploit: Start msfconsole: This is the primary interface for interacting with Metasploit. Explore Resources: Visit the Using Metasploit section of the documentation. Contributing To contribute to Metasploit: Setup Development Environment: Follow the instructions in the Development Setup Guide on GitHub. Clone the Repository: Obtain the source code from the official repository. Submit a Pull Request: After making changes, submit a pull request for review. Additional details can be found in the Contributing Guide.
Read the full README on GitHub

What Hacker News says

2 sources
lima·Nov 30, 2016Recommendation phrase
As much as I love Mozilla and their philosophy, it has to be said that - if you have any sort of worries about security - using Firefox is a bad choice and borderline reckless. It lacks even basic exploit mitigations that other browser have had for years now (most importantly a feature-complete sandbox). Right now, Firefox is just a single process with zero separation of privileges. Any bug in the rendering code is a potential RCE. Writing exploits for Firefox vulnerabilities is well within a strong amateur's reach and this headline does not surprise me at all. This is a (probably incomplete) list of all public exploits in the past three years: - 2013/08: XPCOM RCE (https://github.com/rapid7/metasploit-framework/blob/master/m...) - 2013/08: __exposedProps__ (https://github.com/rapid7/metasploit-framework/blob/master/m...) - 2014/03: WebID
Read the rest
L RCE (https://github.com/rapid7/metasploit-framework/blob/master/m...) - 2015/03: PDF.js RCE (https://github.com/rapid7/metasploit-framework/blob/master/m...) - 2015/08: The file stealing exploit: https://blog.mozilla.org/security/2015/08/06/firefox-exploit... - [The FBI exploit (2016-ish)] - This one. Publicly known as in, with a fully functional Metasploit exploit, and most of them through JavaScript, so 100% reliable. ASLR isn't going to help with interpreter bugs. This is 90s level bad! And those are just the publicly known ones. With a code base as large as Firefox, it'd be foolish to assume to assume that there aren't any private 0days. Just take a look at this list: https://www.cvedetails.com/vulnerability-list/vendor_id-452/... Even Microsoft Edge is better at this. Project Electrolysis is a step in the right direction, but it will take a LONG time to mature. Last time I checked, it was just for process separation and did not provide any security guarantees. Chromium had a fair bit of sandbox escapes during the first years, and there's no reason to believe this is going to be different with Firefox. If have high hopes for their Rust re-implementation, but that's not going to be usable any sooner. In the meantime, there's nothing like Chrome/Chromium security-wise. Not even close. When was the last time there was a reliable, public Chrome exploit with a sandbox escape? The only one I can think of was the Hacking Team exploit, which used a Windows kernel 0day to escape the sandbox. Chrome's security team is probably the strongest in the industry and they poured an absurd amount of effort into Chrome's security. And it being open source means that I can use without worrying about backdoors or data leakage.
In Javascript exploit actively used against TorBrowser
qb45·Oct 19, 2016
Pretty much the only points which make sense are threats of violence and impersonation. Maybe invasion of privacy. Exploits and NSFW is just silly and the rest is asking for abuse. > I'm sure agreement is much higher for their rejection of "Active malware or exploits". Not really, especially when they use it as an excuse to censor lists of malware-infested websites https://news.ycombinator.com/item?id=12712648 while providing hosting for years to famous projects like https://github.com/rapid7/metasploit-framework Not that I think they should take MS down, of course.
In Introducing GitHub Community Guidelines

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.