(02-22-2014, 11:37 PM)chmod Wrote:

(02-22-2014, 11:23 PM)mililove Wrote: Armitage is nice, but for learning purposes I would recommend doing it manually through metasploit itself that way you will better understand whats happening and learn more from it Offensive-security (the people behind training courses and distros such as backtrack and kali) put together a nice free course on this here which I thoroughly recommend you check out. it will give you a good insight into how metasploit works but you should also check out some of @Ex094's threads specifically this and this it's quite a lot of reading but will give you a great foundation into metasploit and system hacking.

Thank you!!! you are amazing!!!

I don't usually find people willing to help. Thank you so much, i'm gonna try to understand something hahaha

We are all more than happy to help here if you run into any problems just ask.

(02-22-2014, 11:37 PM)chmod Wrote:

(02-22-2014, 11:23 PM)mililove Wrote: Armitage is nice, but for learning purposes I would recommend doing it manually through metasploit itself that way you will better understand whats happening and learn more from it Offensive-security (the people behind training courses and distros such as backtrack and kali) put together a nice free course on this here which I thoroughly recommend you check out. it will give you a good insight into how metasploit works but you should also check out some of @Ex094's threads specifically this and this it's quite a lot of reading but will give you a great foundation into metasploit and system hacking.

Thank you!!! you are amazing!!!

I don't usually find people willing to help. Thank you so much, i'm gonna try to understand something hahaha

We are all more than happy to help here if you run into any problems just ask.

(02-23-2014, 12:00 AM)mililove Wrote: I feel like I'm missing something... I'm reading about nmap and nessus so I think I'm starting to understand that... but once you do a recon what happens? that's where I get lost. Because if I'm not mistaken, that was why the autopwn it was so helpfull. But now, after the mapping how do I keep going, I'm seriously lost... sorry... this might seem stupid for you, but I've been reading a lot, a long with other stuff that I'm trying to learn and still don't get it.
I would be so gratefull if you guys could help me... sorry for being so annoying
thank you...

p.d: I apologize for my english, is not my first language so I make a lot of mistakes..

(02-23-2014, 12:00 AM)mililove Wrote: I feel like I'm missing something... I'm reading about nmap and nessus so I think I'm starting to understand that... but once you do a recon what happens? that's where I get lost. Because if I'm not mistaken, that was why the autopwn it was so helpfull. But now, after the mapping how do I keep going, I'm seriously lost... sorry... this might seem stupid for you, but I've been reading a lot, a long with other stuff that I'm trying to learn and still don't get it.
I would be so gratefull if you guys could help me... sorry for being so annoying
thank you...

p.d: I apologize for my english, is not my first language so I make a lot of mistakes..

(02-23-2014, 12:52 AM)chmod Wrote:

(02-23-2014, 12:00 AM)mililove Wrote: I feel like I'm missing something... I'm reading about nmap and nessus so I think I'm starting to understand that... but once you do a recon what happens? that's where I get lost. Because if I'm not mistaken, that was why the autopwn it was so helpfull. But now, after the mapping how do I keep going, I'm seriously lost... sorry... this might seem stupid for you, but I've been reading a lot, a long with other stuff that I'm trying to learn and still don't get it.
I would be so gratefull if you guys could help me... sorry for being so annoying
thank you...

p.d: I apologize for my english, is not my first language so I make a lot of mistakes..

The purpose of using nmap and nessus is to get an idea of the target system using these tools we can discover what the OS of the target is along with which ports and services are running and then start to gain an idea into the system configuration and narrow down our attack.

autopwn just launches each attack one after another which generates a lot of traffic and drains the system recourses meaning the admin are notified straight away (not such an issue when you are pen testing, but when trying to assess the staff's awareness this is not a good idea, also crashing a system isn't really the goal)

With proper recon you can narrow down which exploits to use based on the services and some other scans inside of metasploit to successfully attack the system without generating a lot of traffic or damaging the system

(02-23-2014, 12:52 AM)chmod Wrote:

(02-23-2014, 12:00 AM)mililove Wrote: I feel like I'm missing something... I'm reading about nmap and nessus so I think I'm starting to understand that... but once you do a recon what happens? that's where I get lost. Because if I'm not mistaken, that was why the autopwn it was so helpfull. But now, after the mapping how do I keep going, I'm seriously lost... sorry... this might seem stupid for you, but I've been reading a lot, a long with other stuff that I'm trying to learn and still don't get it.
I would be so gratefull if you guys could help me... sorry for being so annoying
thank you...

p.d: I apologize for my english, is not my first language so I make a lot of mistakes..

The purpose of using nmap and nessus is to get an idea of the target system using these tools we can discover what the OS of the target is along with which ports and services are running and then start to gain an idea into the system configuration and narrow down our attack.

autopwn just launches each attack one after another which generates a lot of traffic and drains the system recourses meaning the admin are notified straight away (not such an issue when you are pen testing, but when trying to assess the staff's awareness this is not a good idea, also crashing a system isn't really the goal)

With proper recon you can narrow down which exploits to use based on the services and some other scans inside of metasploit to successfully attack the system without generating a lot of traffic or damaging the system

(02-23-2014, 01:02 AM)chmod Wrote: When you get onto the metasploit course you will learn to search for exploits/plugins/scripts from within the msf (metasploitframework) and with a little time maybe write your own I suggest setting up a practice lab (search the forum if you are unsure how to do this as I'm sure there is tutorials on this) and practice what you learn you will soon get the hang of it