i have been using metasploit for quite a while now i wanted to test exploit codes that we find from different sources (like milw0rm) but i didn't know how. I tried to figure out how metasploit launches the exploits but couldnt understand it though.
Can someone help me understand how to pentest with exploits codes independent of a framework I ment without using metasploit, immunity or core
I am not sure of how pentesting works all i tried to learn was how to use metasploit (not completey thought) but its better late than never isn't it. for now i wanted to start with exploit testing i.e. take an exploit code and set one of the machine in my lab with the vulnerability and exploit it
is it a simple enough task to start with or hav i gone too far
And by "test exploit codes" do you mean test them to see if they break stuff or do you mean import them into Metasploit? You can test them just by running them in a test environment and monitoring them to see what they do (always a good idea by the way).
Importing them into Metasploit is a different kettle of fish. There are guides out on the Net about it, some links to which are included on the forum. You may also want to check out the Offensive Security "Pentesting with Backtrack" course as it does cover this, and it looks like the planned "Metasploit Unleashed" from Offensive Security will also cover this (probably in greater depth).
To really get into pentesting I'd recommend taking the course Pentesting with Backtrack(former Offsec 101) from Offensive Security.
That will teach you what you need to know and it also shows how to add modules to Metasploit.
Tiocfaidh ár lá
adding exploits to metasploit was not a problem i managed to do that but i wanted to run exploit codes independent of metasploit and i havn't bn vry successful with that.
as you said just running the exploits codes in a test environment didnt do the trick for many exploit codes. I have a testing environment Xp machines with no patches but never managed to compromise them without metasploit
in metasploit REX module confused me a lot i thought ths whr all the magic is. My goal is only to test if the exploit code breaks into my xp machine (without metasploit) could you help me find 1 which would work
and definitely the course is a gr8 idea based on the reviews
If you can't explain it simply, you don't understand it well enough -- Albert Einstein
Some exploits need to be tweaked to work correctly - e.g. by changing the RET address to point to a memory location that contains a particular instruction (e.g. JMP ESP) for your target system. The Pentesting With Backtrack course covers this really well in the Working with Exploits module - I suggest you take the course.