Exploitation Fundamentals

Exploitation is where theory meets practice — you take the vulnerabilities identified during scanning and enumeration and attempt to gain unauthorised access to demonstrate real-world impact. This lesson covers the Metasploit framework, exploit selection, payloads, shells, and post-exploitation basics.

---

Critical: Exploitation must only be performed on systems you have written authorisation to test. Accidentally exploiting out-of-scope systems can have legal consequences and cause real damage.

---

The Exploitation Process

┌─────────────────────┐
│ 1. Identify         │
│    vulnerability     │
└──────────┬──────────┘
           ▼
┌─────────────────────┐
│ 2. Research exploit  │
│    (CVE, PoC, etc.) │
└──────────┬──────────┘
           ▼
┌─────────────────────┐
│ 3. Select/configure  │
│    exploit + payload │
└──────────┬──────────┘
           ▼
┌─────────────────────┐
│ 4. Execute exploit   │
│    (verify scope!)   │
└──────────┬──────────┘
           ▼
┌─────────────────────┐
│ 5. Establish access  │
│    (shell/session)   │
└──────────┬──────────┘
           ▼
┌─────────────────────┐
│ 6. Document and      │
│    move to post-     │
│    exploitation      │
└─────────────────────┘

---

Exploit Databases

Before writing your own exploits, search existing databases: