What is the role of Metasploit in introductory pentest practice?

• A. Metasploit is a password cracker.
• B. Metasploit is a framework for developing and executing exploit payloads against known vulnerabilities within permitted scope.
• C. Metasploit is a network scanner.
• D. Metasploit is a web proxy.

Answer: (B)

Metasploit in introductory pentest practice acts as a framework that brings together exploit modules, payloads, and post-exploitation tools so you can develop and run exploit code against known vulnerabilities within a legally authorized, scoped environment. This setup lets you see the full sequence from identifying a vulnerability to delivering a payload and gaining a controlled session, which helps you understand how weaknesses translate into real access. The framework provides ready-to-use modules and a consistent interface, so you can learn, repeat, and vary scenarios without writing everything from scratch. It’s essential to stress that any testing must stay within the permitted scope and authorization. Metasploit is not a password cracker, not a network scanner, and not a web proxy, which is why those other options don’t describe its role in practice.