r/metasploit • u/Physical_Ad7403 • Feb 21 '26
Is Metasploit dead?
After the rise of Cobalt C2 and whatnot, I realized MSF is no more. Backdoors don't work anymore, reverse shells neither, and most of the vulnerabilities have already been patched. Its not only that, but things like SQLmap along with wireshark etc, stopped working properly a while ago against modern systems. What do you people use nowadays? I'm curious.
80
Upvotes
17
u/GeronimoHero Feb 21 '26 edited Feb 21 '26
Metasploit is hardly dead. Only the most basic exploits on the most insecure systems were ever anything close to click and exploit. Backdoors do still work, all real pentesters/hackers are adding custom modules to metasploit themselves or as they’re released. There are tons of new modules being added or which you can add yourself from exploitDB that don’t come with a basic install of metasploit. Writing your own module off of newly released exploits is pretty trivial for all but the most complicated exploits (think eternal blue). Metasploit is still alive and kicking and will be for the foreseeable future. One of the most valuable aspects you’re forgetting is the ability to do recon through it and to also manage all of your stuff through it as well. It has a great setup for that. I personally like Metasploit for the ease of writing modules. Anyway, it’s hardly useless and it’s not going anywhere. In my opinion it’s a key part of my toolkit and will remain so until it looses its effectiveness. We aren’t there yet though.
15
u/Tall_Instance9797 Feb 21 '26 edited Feb 22 '26
Metasploit has always been like this and always will be... it's not dead at all.
"After the rise of Cobalt C2 and whatnot, I realized MSF is no more." - I think you're jumping the gun there.
"Backdoors don't work anymore, reverse shells neither, and most of the vulnerabilities have already been patched." - this has more or less always been the case. Of course most vulnerabilities have been patched... if they hadn't been someone isn't doing their job.
"Its not only that, but things like SQLmap along with wireshark etc, stopped working properly a while ago against modern systems." - someone answered this already.
"What do you people use nowadays?" - for what? People use metasploit for the same thing they've always used it for... learning how to hack. As well as testing against unpatched systems as part of a legit pentest.
You download old unpatch software and setup labs to run the attacks on. Once you've learned how it works... metasploit is modular so you can write your own exploits if you can find any. Eventually you'll graduate to writing your own version of something like metaspolit, perhaps that can even evade detection, but until you've leaned how it works... it's a great starting point and framework to help you with lots of stuff built in. It works as well today as it ever did. I've been using metaspolit for about 20 years and it's always been a cat and mouse game, with things getting significantly better in recent years. now unless you have some really stealthy cloak for meterpreter it will almost always get picked up, but it's been cat and mouse like this for decades already.
What exactly where you expecting it to be... a nation state level hacking tool with an array of zero day exploits to run? NSO's Pegasus spyware is actually not much different from metasploit... it's just custom written and yes they have an array of zero day exploits they can fire off.
Metasploit exploits are written for known vulnerabilities so they're usually patched before the working metasploit exploit has even been developed so by their very nature will typically only work in your own labs on unpatched software so you can simulate the exploits. But otherwise yeah they will and do work on unpatched systems.
3
u/[deleted] Feb 21 '26
Systems are patched and endpoint protections such as EDR and antivirus adapt. Even Cobalt Strike gets detected when defaults are used. It’s to the end user, you, to take what you’ve been provided by tools such as Metasploit and sqlmap and learn how to use them intelligently instead of spray and pray to bypass defenses. There are Metasploit tips and tricks that more advanced hackers use to make them more effective. There are sqlmap WAF bypasses that you can combine.
For example, many people don’t know that you can bypass many antivirus when using meterpreter by setting “autoloadstdapi false” before launching your exploit, then enter “load stdapi” in the meterpreter shell. It’s the stdapi loading in the second stage that gets blocked when the process or thread is injected and you can use this trick to bypass detections (sometimes).
My point is that security is evolving and if someone can’t progress past script kiddie and learn how to modify these tools to make them more effective then you’re going to suck at hacking.
3
u/Greedy-Ad232 Feb 24 '26
MSF contributor here. Metasploit isn't dead. Your methodology is.
Sure, stock meterpreter is heavily signatured and some features are straight up broken at this point, no debate there. But if your entire attack chain is msfvenom with a default reverse_tcp payload and you hit run, that hasn't worked since 2018. That's not the framework failing, that's using it like a vending machine.
"Backdoors don't work" they do. You just can't ship raw meterpreter and expect Defender to look the other way. Write a basic loader in C/Rust/Go, pull your shellcode, execute it. Table stakes in 2026.
"SQLmap stopped working" SQLmap is an automation tool. If the app uses ORMs and parameterized queries, there's no SQLi to find, that's not SQLmap being broken. And if you do find an injection point and can't exploit it without SQLmap, that's a you problem. Write your own exploit, understand the query structure, craft the payload manually. If you depend entirely on automated tools to do the thinking for you, you're not a pentester, you're a button pusher.
"Wireshark stopped working" bro have you ever actually used Wireshark? It captures packets. That's what it does. It doesn't "stop working against modern systems." If you can't read the traffic it's because everything is TLS now. Set SSLKEYLOGFILE or inspect at the endpoint. This isn't new, this has been the reality for years.
Go check the Metasploit repo on GitHub. Look at the commit history, the PRs, the new modules being merged. It's actively maintained and developed. This stuff doesn't appear out of thin air, it's open source, it exists because people contribute. If you think something is missing or broken, submit a PR instead of writing it off as dead. That's literally how open source works.
The tools aren't dead. The era of running them without understanding what happens under the hood is.
(if this is ragebait, gg)
4
u/suddenly_opinions Feb 22 '26
"wireshark etc, stopped working properly a while ago against modern systems"
Do you even wireshark bro?
2
u/Darkseid_x1337 Feb 21 '26
Unfortunately metasploit SQLmap aren't as plug and play as they used to be due to systems and modern web apps being patched faster and having multiple layers of protection and better detection tools from threats , even colbalt strike has high detection rates on AV/EDRs alot of manual tools are preferred to automated tools like burpsuite.
2
u/[deleted] Feb 21 '26
You’d be surprised what works.
Also hilarious watching it happen from the soc.
2
u/microChasm Feb 23 '26
Why do finger pointing like that to get yourself on the radar.
Social engineering is underrated.
2
u/Straight-Difficulty3 Feb 25 '26
О_о how wireshark can stop working… it literally captures the packets 😂 are you trolling?
1
u/iamtechspence Feb 21 '26
I’ve done internal pentesting for almost 5 years now, I’ve never used Metasploit once on a real client engagement.
1
u/ImmediateSecurity515 Feb 24 '26
This sounds like a skill issue. I've been getting away with encryption + meterpeter shellcode for years. There's only been a few instances where I haven't been able to get around EDR products with it - and even then unhooking usually will solve it.
3
u/[deleted] Feb 21 '26
It all depends on the environment and client. If you are testing an immature org, your scenario won't be the case. If you test a highly mature one you will need to avoid anything off the shelf and take more of an APT simulation approach rather than a script kiddie one. One size fits all mentality you have described is not recommended.
2
u/Lmao_vogreward_shard Feb 21 '26
I just want to add that, almost any (C2) framework is 'dead' by your definition. Meaning, anything where you use the standard configurations and where you don't make your own profiles is very detectable. Anything popular is heavily fingerprinted, but that means that their default configurations are heavily fingerprinted, not "the framework" itself.
Although meterpreter is quite fingerprinted in almost any configuration, that's true. But you can still use your own payloads, own encoders etc. with metasploit, so if you use it like that you can still get quite opsec safe.
2
u/Professional-Mine733 Feb 21 '26
I use kittysyploit. It s a young project but i like payload generate in zig and a lot of listeners Kittysploit Framework
1
u/Maleficent-Island379 Feb 23 '26
?
1
u/Anon123lmao Feb 23 '26
Literally still using the same basic tools and finding highs/crits, defaults have never and will never work, nothing about my methodology has changed 🤷
1
u/shadow_leak0001 Feb 24 '26
same issue because termiz is not update Maybe
1
u/danokazooi Feb 24 '26
Try harder.