Talk:Metasploit Project
From Wikipedia, the free encyclopedia
| This article is part of WikiProject Free Software, an effort to create, expand, organize, and improve free software-related articles. | |
| B | rated as B-Class on the assessment scale |
| Low | rated as low-importance on the assessment scale |
The article title should be Metasploit Framework or Metasploit Project with a re-direct from Metasploit
"and automating the process of exploiting vulnerable software." There is no automation code in the metasploit framework (though technically a wrapper script could be written) automation has not been a priority for MSF.
The utility is also only written in perl (though version 3 will be in ruby), there are external additions which are included which are included in binary format (for dlls or shellcode) or python (for Inline Egg) but they are not an actual part of the Metasploit Framework.--Vargc0 01:37, 9 February 2006 (UTC)
- Thanks, I made the changes you suggested. —Quarl (talk) 2006-02-09 03:46Z
- You might also want to split this article (if you want to dedicate a bit more time) into some of the projects. For example the metasploit project's most well known utility is the Metasploit Framework, but the Opcode Database, online shellcode generation, advisories, and research are also important and should get some coverage. The research they conduct is sometimes very original (i.e. WMF polymorphism) and a lot of the projects are well known and commonly used and should get equal coverage.
- "External add-ons allow use of python and binary shellcode." sounds a bit awkward. I would either drop the line as it's mostly extraneous information or I would re-state it to say "The Metasploit Framework can use external add-ons in multiple languages." Technically the shellcode is part of the framework (just in binary format but assembly SOURCES are included).
- I would also drop a quick mention that the project and it's work are OSS, great job! --Vargc0 05:07, 9 February 2006 (UTC)
- Feel free to be bold and edit as much as you want :) I wouldn't split the article yet until it gets much longer; 20,000 to 30,000 characters is when we should start thinking about splitting - see Wikipedia:Article size. —Quarl (talk) 2006-02-09 08:27Z
- The reason I haven't myself is I'm associated with the project and would rather keep my own biases out of it. As far as splitting I meant into sections. --Vargc0 14:55, 9 February 2006 (UTC)
- Oh, okay, I misread w.r.t. splitting the article (obviously). It is noble of you to resist editing! :) —Quarl (talk) 2006-02-09 23:04Z
- I've edited. —Quarl (talk) 2006-02-09 23:26Z
- Decided to be a bit bold and did so as well. I cut out some details that really aren't very important (i.e. it including shellcode, the names of the interfaces), and did a bit of re-wording. I also think that the description of what MSF does in the title is really more appropriate in the section as someone quickly searching for info reading only the section would have no idea what MSF actually does. --Vargc0 23:57, 9 February 2006 (UTC)
- I've edited. —Quarl (talk) 2006-02-09 23:26Z
- Oh, okay, I misread w.r.t. splitting the article (obviously). It is noble of you to resist editing! :) —Quarl (talk) 2006-02-09 23:04Z
- The reason I haven't myself is I'm associated with the project and would rather keep my own biases out of it. As far as splitting I meant into sections. --Vargc0 14:55, 9 February 2006 (UTC)
- Feel free to be bold and edit as much as you want :) I wouldn't split the article yet until it gets much longer; 20,000 to 30,000 characters is when we should start thinking about splitting - see Wikipedia:Article size. —Quarl (talk) 2006-02-09 08:27Z
[edit] Opcode database?
- The Opcode Database provides users with the ability to easily cross reference specific opcode types, classes, and meta classes across one or more modules for one or more operating system versions. The database facilitates determining opcode portability and includes the opcodes themselves as well as information about the segments, imports, and exports that are associated with each module in the database.
I must say that I don't understand what's going on here. What exactly does this database contain? "Opcode types", i.e. "types of instruction codes of machine languages"? Who would find that useful? The term "opcode portability" also baffles me; by definition opcodes are specific to a machine language and are not portable between machines. What are "opcode classes" and "meta classes"? What are the "modules" that are referred to twice? Does the database perhaps contain modules rather than opcodes?
The paragraph reads as if it was written by someone who uses this database every day and for whom its usefulness is completely obvious. For the uninitiated reader, a standard use case would be very helpful. Why would I ever want to look anything up in this database? AxelBoldt 17:55, 20 February 2006 (UTC)
- Ok, I rewrote most of it, since it wasn't clear to me and, in any event, was a copyright violation. AxelBoldt 23:56, 26 February 2006 (UTC)
- Thanks. —Quarl (talk) 2006-02-27 03:50Z
- Many of these edits do not reflect important parts of the Metasploit Project. The steps to run an exploit using the framework are unimportant in an encyclopedic article. That entire part needs to be written as text from the header needs to be moved into the Framework section as if you just start reading it makes no sense what so ever what the framework is or does. Listing the interfaces is also not interesting, the usage details are not very important in an encyclopedia article. That section should discuss what it does (exploit systems, utilize payloads, cool features like VNC and meterpreter.)
- Indeed, the Metasploit framework facilitates the latter task considerably. This seems to be rather POV (the reason being that the entire full-disclosure vs. non-disclosure vs. responsible disclosure argument is about this issue alone and has been going on for a long time now.)
- This article needs considerable re-organization, capitalization fixes, and re-writing unless you have any objections to these comments I plan to do so. --Vargc0 01:23, 28 February 2006 (UTC)
[edit] Open Source? Who says?
This software's license: http://metasploit.com/svn/framework3/trunk/documentation/LICENSE doesn't seem to be really Open Source, let alone Free Software (in an FSF sense). Do we have any links to license examination reports from anyone not associated with this project? I've tried to find some, but haven't come up with much.
- It's not listed here: http://www.opensource.org/licenses/alphabetical
- It's not listed here: http://www.fsf.org/licensing/licenses/index_html
If no relevant sources can be found, I'm going to remove the references to this being Open Source in 3 days.
--NightMonkey 23:11, 31 March 2007 (UTC)
[edit] NPOV
There is no "Controversy" section in the article, even though itis well-warranted!
The guys who develop Metasploit and the Defiler's Toolkit, etc. are not researchers, but anarchists and the net would be better if they were saccoed and vanzettied. Maybe in 40 years they would be rehabilitated, but we need to do something to help uphold law and order in the net NOW and they are a barrier, who are also abetting criminals.
Several pages worth of article: food for thought on the topic of Metasploit driven anti-forensics making crooks very happy: http://www.cio.com/article/print/114550
