Gaining Access - Web Server Hacking - Metasploitable - #1

Gaining Access - Web Server Hacking - Metasploitable - #1

by HackerSploit · View the channel on PSI

Formal & Physical Sciences Computing & Cybersecurity URComputer securityURHComputer fraud and hacking
🎙 HackerSploit 👥 1.0M 📅 November 2, 2017 ⏱ 15 min 👁 743K 📄 tutorial 🧭 2026-10-10
Available in: English (current) Français

Keywords

Metasploitableweb server hackingnmapexploitationSSH

Summary

This tutorial by HackerSploit introduces server-side attack methodology using the deliberately vulnerable Metasploitable VM. The presenter explains the difference between server-side and client-side attacks, emphasizing that server attacks require only the target’s IP address. He sets up Metasploitable in a virtual environment, obtains its local IP via ifconfig, and accesses its default web page. Using Zenmap, he performs an intense scan to enumerate open ports and services, highlighting FTP, SSH, Telnet, Samba, and Apache. He demonstrates an SSH login using default credentials and then investigates a known backdoor vulnerability in vsftpd 2.3.4. After searching online, he finds a Metasploit module for this exploit and attempts to run it, but the session fails due to a configuration error (using TARGET instead of RHOSTS). The presenter acknowledges the mistake and redirects to future videos for more advanced Metasploit usage. The video serves as a practical introduction to penetration testing, focusing on information gathering and basic exploitation principles.

155 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video’s primary value lies in its clear, step-by-step demonstration of a typical reconnaissance and exploitation workflow against a vulnerable server. It effectively illustrates the importance of enumeration using nmap and the potential of known vulnerabilities like the vsftpd backdoor. The argumentation is straightforward and logical: from identifying the target, scanning ports, to attempting an exploit. However, the argumentation is weakened by a demonstration error that prevents the exploit from succeeding, though the presenter corrects it. The value is enhanced by practical tips such as using Zenmap for beginners and emphasizing the need for a safe, virtualized lab environment.

Scientific Rigor, Source Quality, Title Accuracy

The video relies on practical demonstration and common tools, with links to Metasploitable’s download and the presenter’s website. The scientific rigor is moderate: it cites a real vulnerability (vsftpd 2.3.4 backdoor) and references Rapid7’s exploit database, but does not provide detailed technical documentation. The title accurately reflects the content, promising a server hacking tutorial, which is delivered. The content is consistent with the title, though the exploit failure is a slight mismatch but explained. Overall, the sources are acceptable for a beginner tutorial, but not exhaustive.

200 words

Title / Content Match

The title accurately reflects the content: gaining access to a web server via Metasploitable. Perfect fit.

Quality & Reliability

7/10

The video provides a clear, step-by-step tutorial on server enumeration and exploitation using Metasploitable, but contains a minor command error (TARGET vs RHOSTS) that the presenter acknowledges. The approach is practical and uses standard tools, but lacks depth in explaining underlying concepts.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • Metasploitable download — Link to the vulnerable VM used in the tutorial.
  • HackerSploit website — Presenter's personal site with additional hacking resources.

Contribution & Novelties

This video serves as an accessible entry point for beginners in penetration testing, demonstrating a practical workflow without overcomplicating. Its novelty lies in using Metasploitable as a sandbox to explore server-side hacking, while acknowledging common pitfalls such as parameter errors in Metasploit. It bridges the gap between theoretical knowledge and hands-on practice.

Pour aller plus loin :

  • Metasploit Framework — A penetration testing framework widely used for exploiting vulnerabilities; central to the video’s demonstration.
  • Nmap — The network scanner used for port enumeration; essential for information gathering in penetration testing.
  • OWASP — Provides comprehensive guides and tools for web application security, complementing the server-side focus of this video.

108 words

Radar Profile

The radar profile is moderate across all dimensions, with slightly higher marks for quantity and reliability, reflecting the tutorial's practical nature but limited depth. The technical level is lower, consistent with a beginner audience, and the overall balance suggests a useful but not highly advanced resource.

Reliability 7/10

💬 Positive. Based on the 30 comments analyzed, the sentiment is largely favorable, with viewers appreciating the clear tutorial and constructive corrections pointing out the TARGET vs RHOSTS error, indicating an engaged and helpful community.