Rapid7 Metasploit Reviews

I use the solution for the validation of vulnerability.

For the solution, I think it's the user interface and usability that are the main features of the solution. Also, you can do more with the interface.

Some features that are not available on the console are available in the user interface, like, for example, the creation of payload. The creation of a payload is a tough part in the terminal. So, it is kind of handy when we use Rapid7 Metasploit.

I think areas with shortcomings that need improvement are more integration and automation.

I have been using Rapid7 Metasploit for two years. Also, I am using the solution's latest version. I'm a customer and a reseller of the solution.

Stability-wise, I rate the solution a nine out of ten.

Scalability-wise, I rate the solution a nine out of ten.

Previously, we were using BurpSuite. We switched to Rapid7 Metasploit because of its features.

On a scale from one to ten, one being difficult and ten being easy, I rate the setup a ten.

The deployment takes around twenty to thirty minutes maximum.

The setup process can be carried out by a single person.

On a scale of one to ten, where one is cheap and ten is expensive, I rate the product's pricing a six. So it's fairly priced.

I would definitely recommend the solution to those planning to use it on a long-term basis. For new users planning to use it for testing, I recommend they do a PoC before starting.

Overall, I rate the solution a nine out of ten.

Our use case is for penetration testing. 

My organization has been happy with it.

I would like to see more capabilities, more functions, and more features. More types of attack vectors.

I have experience with this solution. Like, I have been aware of this product for a few years. 

I would rate the stability a seven out of ten. It's not a ten. There is room for improvement.

It is scalable. It's in line with our needs. There are around five end users. We have possible plans to increase the further usage.

The initial setup is fairly easy.

We deployed it ourselves.

It is worth it.

We pay monthly. The pricing is reasonable. There are additional costs. 

I may have considered others, but Rapid7 was the one that stood out to me.

It's definitely one of the best penetration testing tools available. Overall, I would rate the solution an eight out of ten. 

I used the community edition. It's a very handy and powerful product. For a free product, the capabilities are absolutely astonishing.

I used Rapid7 Metasploit as a marketing solution. I was working as a security expert and whenever I would meet a client as a consultant or a freelancer, I would open my laptop and start using the software.

Rapid7 Metasploit is a standalone solution, intended to be used by one person, but it can be used by a few people in a team — maybe 10 people or less.

All of the features are great. I used it as a tool for penetration testing. The exploitation capabilities and the development in general, are all great. It's open-source and very handy. 

At the time I was using it, the graphical user interface needed some improvements. It might be better now because there was a very big community behind it, and of course, newer versions are always improved. The free, community edition I was using, lacked some very specific exploits but, as I remember, under the commercial version, you could find your exploits.

All the features that are available on the command line could be integrated with the graphical user interface.

I used Rapid7 Metasploit for more than five years.

The earlier versions had some bugs, but the last version, Version Four, was much more stable compared to the previous versions — which we stopped using because of the bugs.

The scalability is not that good.

When you use the command-line interface, not very much of the process is automated. There should always be an expert present to work with the software. Under the GUI, I believe there are some features that can be automated for testing.

The solution was not intended to be automated because penetration testing requires attention and caution because it's done on a live network with line services. Automation can damage the target network or the system on the network.

You can automate the input of data, but the results are not satisfactory.

The scalability should definitely be improved.

As it's a free product, the community edition doesn't include any technical support. I haven't used the commercial edition so I can't comment on their support.

In terms of development, the team of developers that supports the software is very active and quick to help. In short, the software is being maintained very actively, and I do believe the customer support should be the same.

I would like to see some support available for the free version; however, there are a lot of open-source materials available to solve any issues, so for me personally, there wasn't any need for technical support.

If you want to install it separately on a fresh new Linux, the solution is still effective. The installation is very, very straightforward.

The great advantage with Rapid7 Metasploit, of course, is that it's free. You can download it and start using it for free, right away. The features are satisfactory, and you can do your job strictly with the free edition. Of course, you could do your job even better with the commercial edition. 

There are better products available, like Core Impact, but they are much more expensive.

On a scale from one to ten, I would give Rapid7 Metasploit a rating of eight.

We're using the solution in conjunction with some governmental agencies.

The solution automatically discovers vulnerabilities. We don't need to update or fine-tune the tool. It automatically handles that itself.

The reporting on the solution is good.

The solution should be more user friendly. Right now, a user needs a certain level of technicality.

The solution should improve the responsiveness of its live technical support.

The solution has been stable so far. I hope it stays that way. We haven't experienced bugs or glitches. There haven't been crashes.

So far, for our purposes, we've never run into issues with scalability. It's been good. I'm not sure how it would be for other companies, however, I don't forsee there being any issues if they should require the solution to expand to meet their needs.

Technical support is okay. If you access its resources online, it's quite helpful. However, if you need to contact them directly, they can be quite sluggish in their response. It's sort-of unpredictable.

We did use different solutions previously. I know of a few other products the organization utilized before this product.

The initial setup isn't too complex. If you have a bit of a technical background, you should be fine installing the solution without facing any issues. A person with no technical background, however, may find it challenging.

The pricing of the solution is pretty good. That said, it would be good if there could be more of a discount. It would be better for us.

I used the product previously. Now, I am more of a consultant.

I'm not sure what version of the solution I'm currently using is.

This product is fantastic. I prefer using it. I'd rate it seven out of ten. If it wasn't for the unpredictable support, I would rate it a bit higher. If it added just a few more advancements, it would be even better still.

We use Metasploit for penetration testing. Three to five testers use it annually. 

The open-source version has reporting limitations. You need to develop these capabilities yourself. Built-in reporting is an excellent feature for penetration testing, but it isn't a must-have. The solution could also cover more vulnerabilities. Metasploit has around 10,000 exploits in its library, but more is always better. 

I have used Metasploit for more than 10 years.

I rate Metasploit nine out of 10 for stability. 

Deploying Metasploit is straightforward and only took a few minutes. I'm using a pre-installed package that updates itself in a couple of minutes, but I don't think it takes much time to install it from scratch. Metasploit doesn't require maintenance after deployment. 

We use the free open-source edition. 

I rate Rapid7 Metasploit eight out of 10. I would recommend it. I don't have any other tools like it, and I always use it when I'm doing a pen test. Metasploit is a great solution for penetration testing, but end-to-end testing can be hard to manage if you don't have deep expertise. From the perspective of comprehensively addressing vulnerabilities, it may be hard for the average user in the community. 

We are a solution provider and we offer a variety of services that include security and vulnerability management. Rapid7 Metasploit is one of the products that we use to identify vulnerabilities.

Specifically, Metasploit is for penetration testing. It uses models to check for exploitable vulnerabilities, and if one is detected then we would raise the importance of solving the problem. We normally operate Metasploit at the client site, which helps us to explore and assess the vulnerabilities directly in the environment.

This solution allows us to offer additional services to our clients. Projects can vary, where one will include vulnerability testing and another may include penetration testing.

One of the services that we provide is security during the development process. This means that beyond user acceptance and performance testing, we are doing all of the security tests. It helps customers ensure that the code they are developing and deploying has all of the necessary security controls.

The most valuable feature for us is the support for testing Linux-based web server components.

Integration with popular vulnerability scanners would be a useful feature.

Better automation capabilities would be an improvement. For example, if a project is moving from a development to a testing environment, then automation is crucial. We are using Jenkins, JIRA, and other tools for SecOps and DevOps. If somebody is storing code or a project in SVN then it needs to be fully automated. We need the ability for the scanner to run, then have Checkmarx scan them, then exploit the vulnerabilities if any are found. 

We began working with Metasploit about 15 years ago.

I do not have any complaints about stability, as it has been fine.

For the projects that we have worked on, the scalability has been fine. I'm not sure how it would perform in a hybrid environment, but for our on-premises deployment, it is quite a nice product.

We have a team of 12 people and it is used for perhaps 10 large companies.

We have not been in contact with technical support.

When we do application-level penetration testing, we employ some manual techniques. Metasploit is generally used at the infrastructure level. We did not use another solution prior to this one.

The initial setup is pretty straightforward. We have been working with this product for several years and it isn't a problem for us to set it up. The deployment can be completed in a matter of hours, depending on the size of the environment.

For our needs, which is usually a dedicated environment for our customers, I cannot envision any significant improvements that need to be made.

My advice for anybody who is considering this solution is that it works well as a component in a vulnerability testing platform. We use a combination of tools with a certain level of automation and integration, which gives us the flexibility that we need to accommodate customers with differing needs. There is no one tool in the market that covers everything and ultimately, Metasploit helps to produce the reports that we need.

The biggest lesson that I have learned from using this product is that if proper security checks are not done during the development process then very likely, you will face major vulnerabilities or risks in the production environment.

Overall, it is a very good product for penetration testing.

I would rate this solution an eight out of ten.

I use Rapid7 Metasploit for payload generation and Post-Exploitation.

Rapid7 Metasploit could be made easier for new users to learn.

I have been using Rapid7 Metasploit for one to two years.

The solution’s initial setup is easy.

I have used the free version of Rapid7 Metasploit.

I would recommend the solution to other users.

Overall, I rate the solution an eight out of ten.

We use it for penetration testing of our internal systems. 

• The option to generate phishing emails has proven to be very valuable in understanding the behavior of users. 
• It contains almost all the available exploits and payloads. 
• The in-built Wireshark is valuable in performing packet analysis. 
• It has different installation files for different OSs.

• The GUI version is not as effective as a command prompt. For general users, the PT using GUI could be improved. At the same, the track of a phishing emails were not accurate sometimes. Rapid7 could work on this further. 
• Metasploit cannot be installed on a machine with an antivirus. This could be improved. 
• There were times when it hung, then I had to restart the DB service. This leaves an area of improvement for them.
• It is necessary to add some training materials and a tutorial for beginners.

It is a very robust and stable product. 

Its scalability can be improved.

The tech support was not as robust as our prior experience with Cisco. With Cisco, we had immediate response. 

The initial setup was easy and straightforward. 

There is also a manual setup available for installation, both for Windows and Linux. We just had to uninstall the antivirus and disable the firewall. This is not recommended. 

It is expensive. Our license expired, and our company is not thinking to renew because of our budget.