Metasploit is available in three different editions: community (open source), Express and Pro. The Pro version was introduced in 2010 as the top end of the commercial offerings for Metasploit, providing enterprise-class capabilities. The new phishing engine is specific to the Pro version of Metasploit, though Moore noted that other editions including the open source framework have also seen improvements in the area of phishing related attacks.
According to Moore, the improvements across all editions of Metasploit include better logic in browser_autopwn, bug fixes and enhancements to exploit payloads. Additionally, all versions of Metasploit 4.5 benefit from the introduction of local exploits that can be used to escalate privileges to administrator from low-privileged user sessions.
“Every exploit in Metasploit Pro is also available in Metasploit Express, Metasploit community, and the open source framework,” HD Moore, chief architect of Metasploit and chief security officer for Rapid7 told InternetNews. “The 4.5 release wraps up months of hard work by both our in-house team and the community at large.”
Moore said the exploits he finds most interesting are those that target logic flaws or weak configurations, as they tend to be incredibly reliable and are almost always a surprise. Recent examples of this include the Tectia SSH authentication bypass flaw and the various Java sandbox escapes.
Read the full story at eSecurity Planet:
Metasploit Goes Phishing
Sean Michael Kerner is a senior editor at InternetNews.com, the news service of the IT Business Edge Network, the network for technology professionals Follow him on Twitter @TechJournalist.