Server exploitation becomes meaningful when reconnaissance findings can be connected to a specific service, a matching module, a correctly configured payload, and verifiable access on a controlled target. This 20-lab course develops that offensive workflow with Kali Linux, Nmap, Metasploit, and a deliberately vulnerable Metasploitable2 machine on a private lab network.
The sequence begins with target discovery and Metasploit fundamentals, then moves through vulnerable network services, credential guessing, custom scanner development, root-access paths, and selected post-exploitation techniques. Several labs establish real shells on the training target; later exercises also generate a payload-bearing PDF and demonstrate persistence and command-history removal. These are high-risk techniques presented for isolated, authorized practice, not instructions for use on third-party systems.
What You Will Learn
After completing the course, you will be able to:
- Start the provided Kali and Metasploitable2 environments, verify private-network connectivity, and identify the correct attacker and target addresses.
- Discover ports and services with Nmap, run vulnerability-oriented scripts, save results, and import scan data into a Metasploit workspace.
- Navigate Metasploit modules, configure
RHOST,LHOST, ports, exploits, and payloads, and validate a resulting session with host and user information. - Write and run a simple Ruby Metasploit auxiliary scanner against a controlled TCP listener.
- Investigate and exercise vulnerable or misconfigured Samba, Unreal IRCd, distcc, Tomcat, FTP, Telnet, and Ingreslock services on Metasploitable2.
- Run SSH and VNC credential checks with Metasploit modules and interpret successful and unsuccessful authentication results.
- Exploit an NFS export misconfiguration by mounting a share and using an SSH key to demonstrate passwordless root access.
- Generate a PDF containing a Windows payload and examine persistence and trace-removal commands within the isolated post-exploitation scenarios.
Who This Course Is For
This course is for learners who have completed a Kali or penetration-testing introduction and want repeated exploitation practice against a purpose-built vulnerable server. Although the metadata labels it Beginner, the pace assumes comfort switching terminals, reading IP and port information, and following Nmap and Metasploit commands. It is not suitable as a first Linux course, and it does not by itself establish professional penetration-testing competence.
Prerequisites: Basic Linux command-line, TCP/IP, ports and services, Nmap, and introductory Metasploit knowledge are strongly recommended. You should understand reverse connections, payloads, and the distinction between scanning, exploitation, privilege level, and persistence. Strict respect for authorization and lab boundaries is required.
Learning environment: You will use a browser-accessible Ubuntu/Kali lab host, a Kali container with host networking, and a Metasploitable2 virtual machine on a private network, commonly addressed as 192.168.122.102. Environment startup and module behavior can affect results, so target reachability and options must be checked rather than assumed. All offensive work must remain inside the designated lab.
Frequently Asked Questions
Is this really a beginner course?
It uses step-by-step instructions, but the technical scope is broader and more aggressive than a typical first course. Learners who already know basic Kali navigation, networking, Nmap, and the Metasploit console will be much better prepared for its 20 scenarios.
Are the exploits run against real internet servers?
No. The intended target is the provided Metasploitable2 machine on a private lab network. It is deliberately outdated and vulnerable so that scanning, shells, and root-access paths can be observed without targeting unrelated systems.
Does the malicious PDF exercise compromise a Windows victim?
The lab configures a Metasploit PDF exploit module and generates an evil.pdf artifact in the Kali environment. It does not provide an external victim-delivery campaign or authorize opening the file on a real Windows system; keep the artifact contained in the lab.
Does the course cover a complete, ethical penetration-testing engagement?
No. It concentrates on discovery, exploitation, access, and selected persistence or trace-removal actions. Professional work also requires written authorization, rules of engagement, evidence preservation, impact control, reporting, remediation guidance, cleanup, and often defensive validation—topics that need separate study.
