Push-Button Exploits Screensaver

The Metasploit Framework is an open-source tool for security testing. H. D. Moore created it in 2003, and Rapid7 acquired the project in October 2009. It is a library of modules that penetration testers and defenders use to check whether a system is vulnerable under authorised conditions. Module types include exploits, payloads and auxiliary modules, a group that covers scanners, admin and server modules.

Each exploit has a rank that describes how reliably and safely it behaves. From least to most reliable the ladder is Manual, Low, Average, Normal, Good, Great and Excellent. The framework stores these as numbers from 0 for Manual up to 600 for Excellent, in steps of 100, so Normal is 300. Excellent means the exploit will never crash the service, as with SQL injection or command execution flaws. Manual marks modules that are unstable or difficult to exploit, or that need user configuration to be useful.

A rank describes the module's reliability and predictability, not how serious the underlying vulnerability is. A module existing in the framework means a public exploit module exists for that flaw, which defenders often take as a reason to prioritise patching. It does not show that anyone has attacked a given organisation.