Learning offensive security has a practical problem: the techniques only make sense against real, vulnerable systems, but attacking systems you do not own is illegal and dangerous. The training answer is a deliberately vulnerable machine you run yourself. metasploitable is exactly that — a purpose-built Linux virtual machine loaded with exploitable services and misconfigurations, designed to be attacked in a lab so students can practise with tools such as Metasploit in a legal, controlled environment. This guide explains what it contains, how to set it up safely, and how to learn from it.
What Is Metasploitable?
Metasploitable is an intentionally insecure Ubuntu Linux image distributed as a virtual machine. Unlike a normal hardened server, it runs outdated services with known vulnerabilities, weak passwords, badly configured file shares and web applications full of classic flaws. Each weakness corresponds to techniques taught in security courses and demonstrated in the Metasploit Framework, which makes the machine a companion target for learning exploitation step by step.
The best-known release, Metasploitable 2, includes vulnerable services such as old versions of FTP, SSH, Telnet, Samba, MySQL and Apache Tomcat, plus web applications including DVWA, Mutillidae and phpMyAdmin in deliberately unsafe configurations. Nothing on the machine is there by accident: every open port is a lesson.
Setting Up the Lab Safely
Safety rule one: Metasploitable must never be exposed to a real network. Run it in VirtualBox or VMware on a host-only or internal virtual network, ideally alongside an attacker machine such as Kali Linux on the same isolated segment. Never bridge it to your home or office LAN, and never give it internet access — a machine designed to be hacked will be hacked by whoever finds it first.
Setup itself is simple. Download the image, import it into your hypervisor, set its network adapter to the isolated network, and start it. The machine boots to a login prompt (the well-known credentials are published in its documentation), but you rarely need to log in directly: your work happens from the attacker machine, scanning and exploiting it across the virtual network exactly as you would a real target — except legally and with an undo button.
What You Can Practise
A typical learning path starts with reconnaissance: scanning with Nmap to enumerate open ports and service versions, then researching which of those versions have known exploits. From there, students work through password attacks against weak credentials, exploitation of specific service vulnerabilities through Metasploit modules, and web application attacks against the bundled vulnerable apps — SQL injection, cross-site scripting, file upload flaws and authentication bypasses.
Just as valuable is the defensive view. After exploiting a service, log in to the target and look at what the attack left behind: log entries, new processes, changed files. Seeing both sides of the same attack teaches detection and hardening far better than reading about them, and it is why vulnerable-by-design machines remain a staple of security training years after their release.
Metasploitable and Metasploit
The machine was built by Rapid7, the company behind the Metasploit Framework, and the two are designed to work together. Most Metasploit tutorials and certification courses (such as the OSCP-style labs and Metasploit Unleashed) use Metasploitable as the standard target, so exploits, auxiliary scanners and post-exploitation modules can be practised against known-vulnerable services with predictable results. When a module works there, you understand its mechanics; when it fails, you can inspect the target to find out why.
Frequently Asked Questions
Is Metasploitable legal to use? Yes — on your own computer, in an isolated virtual network. It exists precisely so you can practise legally. Attacking any system you do not own or have written permission to test is a crime in most jurisdictions.
Is Metasploitable 2 outdated? Its software is old on purpose: the vulnerabilities are documented, stable teaching examples. For modern targets, trainers pair it with newer vulnerable machines, but the core techniques it teaches — enumeration, exploitation, privilege escalation — have not changed.
How much resource does it need? Very little. It runs comfortably with modest RAM and a single virtual CPU, so it fits on an ordinary laptop alongside Kali Linux.
Conclusion
Practical security skill comes from doing, and doing requires a target you are allowed to break. Metasploitable remains the classic answer: a free, deliberately vulnerable machine that turns Metasploit tutorials into hands-on experience, safely contained in a virtual lab. Set it up on an isolated network, work through its services methodically, and study each attack from the defender's side as well. The documentation and downloads at metasploitable.org are the place to start.
