Metasploit step configuration

Scan application instances with Metasploit Framework.

You can scan your application instances and ingest results from Metasploit Framework.

Workflow descriptions

Orchestration/extraction workflows

Ingestion workflows

Custom Scan step settings for Metasploit scans in STO

Scanner settings

These settings are required for most scanners. For more information, go to the reference for the scanner integration you're setting up.

• Product name

• Scan type

• Policy type

• Product config name

Product name

The scanner name. This is required for all Custom Scan steps.

Key

product_name

Value

metasploit

Scan type

The target type to scan.

Key

scan_type

Value

instance

Policy type

The scan mode to use.

Key

policy_type

Value

orchestratedScan

ingestionOnly

Product config name

Key

product_config_name

Value

Specify one of the following if you're setting up an orchestration scan.

Brute-force test a host for SSH weak ssh/pass:

metasploit-weak-ssh

Check HTTPS (443) for Heartbleed vulnerability:

metasploit-openssl-heartbleed

Finds and applies Metaspoit module by CVE:

dynamic-by-cve

Target and variant

Instance scan settings

Ingestion file

Fail on Severity