Question Bank

TITLE

Mid Sem Question Bank

Meterpreter, Server Exploitation and VAPT – Detailed Answers

1. What is Meterpreter?

Meterpreter stands for Meta-Interpreter. It is an advanced payload used with the Metasploit Framework during authorized penetration testing.

After a successful exploit, Meterpreter provides an interactive session through which a security tester can perform post-exploitation activities such as:

• Viewing system information
• Checking users and processes
• Managing files
• Gathering network information
• Interacting with the Windows Registry
• Performing authorized privilege-escalation assessment

It is more powerful than a normal command shell because it provides specialized commands and modules.

2. What is the purpose of a Meterpreter session?

A Meterpreter session allows an authorized security tester to interact with a compromised test system after successful exploitation.

Its main purposes are:

1. Post-exploitation – Assess the system after gaining access.
2. Information gathering – Collect system, user, and network information.
3. Privilege assessment – Check whether higher privileges can be obtained.
4. File operations – Upload, download, or inspect files within the authorized scope.
5. System assessment – Inspect processes, services, and configurations.

In short:

Exploit → Gain access → Meterpreter session → Perform authorized post-exploitation testing.

3. What are communication channels in Meterpreter?

A communication channel is a logical connection used by Meterpreter to perform different activities while maintaining communication with the testing system.

For example, Meterpreter may create channels for:

• Command execution
• File operations
• Network communication
• Other session activities

Each channel can be considered a separate stream of communication inside the Meterpreter session.

Simple example: Just as a computer can open multiple tabs or connections, Meterpreter can use different channels for different operations.

4. What is meant by Meterpreter transport?

Meterpreter transport refers to the method or mechanism used for communication between the Meterpreter session and the Metasploit handler.

Different transport mechanisms may be used depending on the authorized testing environment and network conditions.

The transport is responsible for:

• Sending commands to the session
• Receiving responses
• Maintaining communication
• Handling reconnection where supported

In simple words:

Transport = the communication path used by Meterpreter and the testing machine.

5. What is Meterpreter Sleep Control?

Meterpreter Sleep Control controls how long a Meterpreter session waits before checking in or communicating again.

It can be useful during an authorized assessment for testing:

• Session timing behavior
• Network reliability
• Communication intervals
• Operational behavior of the testing payload

A longer sleep interval means less frequent communication, while a shorter interval means more frequent communication.

It should only be configured within an authorized testing environment.

6. What is the purpose of a Meterpreter resource script?

A Meterpreter resource script is used to automate a sequence of commands.

Instead of manually entering the same commands repeatedly, the tester can place them in a script and execute them in the appropriate authorized environment.

Benefits:

• Saves time
• Reduces repetitive work
• Improves consistency
• Helps automate testing procedures
• Useful for repeatable assessments

Example concept:

Instead of manually performing:

1. Collect system information
2. Check users
3. Check network configuration

A resource script can automate the approved sequence.

7. What is meant by interacting with the Windows Registry using Meterpreter?

The Windows Registry is a database containing configuration information about Windows, applications, users, and system settings.

During an authorized penetration test, interacting with the Registry means examining or managing Registry information to assess security configurations.

A tester may inspect areas related to:

• Installed software
• System configuration
• User settings
• Security settings
• Startup configurations

This can help identify misconfigurations or security weaknesses.

Registry changes should only be performed with explicit authorization because incorrect changes can damage a Windows system.

8. What is the Meterpreter API?

The Meterpreter API is a programming interface that allows developers and modules to interact with Meterpreter functionality.

It provides a way to:

• Extend Meterpreter
• Develop additional functionality
• Create modules or scripts
• Interact with Meterpreter sessions programmatically

In simple words:

API = a set of functions and interfaces that allows software to communicate with and use Meterpreter features.

9. What is VNC, and why can it be useful during an authorized penetration test?

VNC stands for Virtual Network Computing.

It is a technology that allows a user to remotely view and control another computer's graphical desktop.

During an authorized penetration test, VNC can help demonstrate the impact of an exposed or improperly secured remote desktop service.

It may be useful for:

• Testing remote-access security
• Verifying access-control weaknesses
• Demonstrating the impact of unauthorized desktop access
• Assessing whether remote administration is properly secured

In simple words:

VNC allows remote graphical access to a computer's desktop.

10. What is the difference between Meterpreter and a normal command shell?

Meterpreter	Normal Command Shell
Advanced post-exploitation environment	Basic command-line interface
Provides specialized Meterpreter commands	Uses operating system commands
Supports modules and extensions	Usually has fewer built-in testing features
Can perform structured post-exploitation activities	Mainly executes shell commands
Works through the Metasploit environment	Directly interacts with the OS shell

Example: A normal shell is like directly using the computer's command prompt, while Meterpreter provides additional features designed for authorized security testing.

Server-Side Exploitation

11. What is server-side exploitation?

Server-side exploitation is the process of taking advantage of a vulnerability or security weakness in a server or server-side service.

A server may contain services such as:

• Web servers
• Database servers
• FTP servers
• SSH services
• Mail servers

During authorized penetration testing, a tester identifies vulnerabilities and safely verifies their impact.

Basic process:

Identify Server → Enumerate Services → Find Vulnerability → Validate Safely → Assess Impact → Report

The purpose is to help the organization fix the weakness.

12. What is the difference between exploiting a Linux server and a Windows server?

The main difference is the operating system, services, architecture, permissions, and administration mechanisms.

Linux Server	Windows Server
Uses Linux OS	Uses Windows OS
Common shell: Bash	Common shell: CMD/PowerShell
Uses Linux permissions and ownership	Uses Windows users, groups and ACLs
Common services: SSH, Apache	Common services: RDP, IIS, SMB
Uses Linux configuration files	Uses Registry and Windows configuration

The testing methodology is similar, but the vulnerabilities and techniques depend on the target operating system and installed services.

13. What is a server vulnerability?

A server vulnerability is a weakness that could allow an attacker to negatively affect the confidentiality, integrity, or availability of a server.

Examples include:

• Outdated software
• Missing security patches
• Weak passwords
• Incorrect permissions
• Unnecessary open services
• Misconfigured applications
• Default credentials
• Weak encryption settings

A vulnerability does not always mean a system has already been compromised. It means a security weakness exists that could potentially be exploited.

14. What are common services that may be targeted during a server security assessment?

Common services examined during an authorized assessment include:

• HTTP/HTTPS – Web applications and web servers
• SSH – Secure remote administration
• FTP – File transfer
• SMB – File and printer sharing
• RDP – Windows remote desktop
• DNS – Domain name services
• SMTP – Email services
• MySQL/PostgreSQL/MSSQL – Database services
• Telnet – Legacy remote access
• VNC – Remote graphical access

The tester first determines which services are actually running and then checks them for known vulnerabilities and misconfigurations.

15. Why is service enumeration important before server exploitation?

Service enumeration means collecting detailed information about services running on a target.

It helps determine:

• Which ports are open
• Which services are running
• Service versions
• Operating system information
• Possible misconfigurations
• Available attack surface

For example:

If a server has a web service, the tester should first identify the web server, version, configuration, and application before assessing possible vulnerabilities.

Therefore:

Enumeration reduces guesswork and helps the tester focus on real security risks.

16. What is privilege escalation?

Privilege escalation occurs when a user or process obtains permissions greater than originally assigned.

For example:

Normal User → Administrator/Root

There are two main types:

1. Vertical Privilege Escalation

A user gains a higher privilege level.

Example:

Standard user → Administrator

2. Horizontal Privilege Escalation

A user accesses another user's resources without authorization.

Example:

User A accessing User B's private data.

During authorized testing, privilege escalation is assessed to understand the possible impact of an initial compromise.

17. What is the difference between local and remote exploitation?

Remote Exploitation

The vulnerability is attacked over a network, without needing prior access to the target system.

Example:

A vulnerable network service accessible from another system.

Local Exploitation

The tester already has some level of access to the target and tests whether a local vulnerability can increase privileges or access additional resources.

Example:

A standard authorized user account exploiting a local misconfiguration to obtain higher privileges.

In short:

Remote = attack from another system Local = exploit after obtaining access to the target

18. Why is patch management important for server security?

Patch management is the process of updating software, operating systems, and applications to fix known security weaknesses.

It is important because outdated software may contain publicly known vulnerabilities.

A good patch-management process includes:

1. Identifying available updates
2. Testing important updates
3. Applying patches
4. Verifying successful installation
5. Monitoring systems

Benefits include:

• Reduces known vulnerabilities
• Improves security
• Fixes software bugs
• Reduces attack surface
• Helps maintain compliance

Unpatched server = higher risk of compromise.

19. What is service misconfiguration? Give one example.

A service misconfiguration occurs when a service is installed or configured insecurely.

Examples:

• Default credentials
• Excessive permissions
• Unnecessary public exposure
• Weak authentication
• Anonymous access
• Insecure encryption configuration

Example:

An organization exposes an RDP remote administration service directly to the public internet even though it is not required.

This unnecessarily increases the attack surface.

A better approach would be to disable public exposure or restrict access using appropriate network controls and secure remote-access mechanisms.

20. What is the role of vulnerability scanners in server security testing?

A vulnerability scanner automatically checks systems for known vulnerabilities and possible security weaknesses.

It can identify:

• Missing patches
• Outdated software
• Known CVEs
• Open ports
• Weak configurations
• Insecure services

Advantages:

• Fast
• Automates repetitive checks
• Can assess many systems
• Helps prioritize possible weaknesses

Limitation:

Scanner results may contain false positives or may not understand the full context of the environment.

Therefore:

Scanner findings should be manually validated by an authorized security tester.

Client-Side Exploitation

21. What is client-side exploitation?

Client-side exploitation targets vulnerabilities in software used by the end user rather than directly attacking a server.

Examples of client software include:

• Web browsers
• PDF readers
• Office applications
• Media players
• Email clients

The vulnerability is typically triggered when the user interacts with malicious or specially crafted content.

Examples include:

• Malicious documents
• Vulnerable browser content
• Malicious PDF files

During security testing, such scenarios are evaluated only within the approved scope.

22. What is the difference between server-side and client-side exploitation?

Server-Side	Client-Side
Targets a server or server service	Targets software used by a client/user
Often targets network services	Often requires user interaction
Example: vulnerable web service	Example: malicious document exploiting vulnerable software
Target is usually a server	Target is usually an end-user device

Simple difference:

Server-side = target the server Client-side = target the user's application or device

23. What is antivirus software?

Antivirus software is a security program designed to detect, block, quarantine, and remove malicious software.

It can help protect against:

• Viruses
• Worms
• Trojans
• Spyware
• Other malware

Antivirus may use:

• Signature-based detection
• Behavioral detection
• Heuristic analysis
• Reputation-based analysis

Antivirus is important, but it should be used together with other security controls.

24. What is an IDS/IPS?

IDS – Intrusion Detection System

An IDS monitors network or system activity and detects suspicious behavior.

It generally alerts administrators.

IPS – Intrusion Prevention System

An IPS can detect suspicious activity and may also block or prevent the activity.

Simple difference:

IDS = Detects and alerts IPS = Detects and can actively prevent/block

25. Why is bypassing antivirus or IDS/IPS considered difficult?

Modern security systems use multiple detection methods, including:

• Signatures
• Behavioral analysis
• Heuristics
• Machine learning or reputation signals
• Network monitoring
• Endpoint detection and response
• Sandboxing

Security products are continuously updated.

Therefore, attempts to evade them may fail because suspicious behavior, network communication, files, or execution patterns can be detected.

From a defensive perspective, this difficulty helps protect systems against malware and unauthorized activity.

26. What is a Human Interface Device (HID) attack?

A Human Interface Device (HID) is a device such as a keyboard or mouse.

An HID attack involves a device impersonating or abusing trusted human-input functionality to send unauthorized input to a computer.

For example, a malicious device may appear to a computer as a keyboard and automatically enter commands.

Prevention:

• Block unauthorized USB devices
• Use device-control policies
• Restrict physical access
• Apply endpoint security
• Train users not to connect unknown devices

27. What is a Man-in-the-Middle (MITM) attack?

A Man-in-the-Middle (MITM) attack occurs when an attacker secretly positions themselves between two communicating parties and attempts to intercept or alter communication.

Conceptually:

User ↔ Attacker ↔ Website

instead of:

User ↔ Website

Possible risks include:

• Data interception
• Credential theft
• Modification of unprotected data
• Session interception

MITM attacks are especially dangerous when communication is not properly encrypted or authenticated.

28. How can MITM attacks be prevented?

MITM attacks can be reduced using:

1. HTTPS/TLS encryption
2. Proper certificate validation
3. HSTS
4. VPNs on untrusted networks
5. Secure Wi-Fi
6. Avoiding suspicious public networks
7. Strong authentication
8. Keeping browsers and systems updated

The most important mechanism for website communication is properly implemented HTTPS using TLS, which protects confidentiality and helps ensure communication integrity.

29. What is a Trojan?

A Trojan or Trojan horse is malware that disguises itself as legitimate or useful software.

The user may believe they are opening a normal file or application, but the program performs malicious actions.

A Trojan may:

• Steal information
• Download additional malware
• Provide unauthorized remote access
• Damage or modify data

Unlike a traditional computer virus, a Trojan generally relies on deception to get the user to run it.

30. What are file-format-based attacks? Give two examples.

File-format-based attacks exploit vulnerabilities in applications that process specific file formats.

The attacker creates a specially crafted file, and the vulnerability may be triggered when the application opens or processes it.

Examples:

1. Malicious Microsoft Word document
2. Malicious PDF file

Other examples can involve image, archive, spreadsheet, or media file formats.

The main security risk depends on the application's vulnerability and the content being processed.

31. A security tester discovers an outdated service running on a Linux server. What should they do before attempting exploitation?

Before attempting any exploitation, the tester should:

1. Confirm authorization and scope
2. Identify the exact service and version
3. Verify that the service is actually vulnerable
4. Research relevant vulnerability information
5. Check prerequisites and potential impact
6. Validate safely
7. Follow the organization's rules of engagement

The tester should not simply exploit a service because it is old.

Outdated does not automatically mean exploitable. Verification is required.

32. A company has an exposed remote administration service that is not required for public access. What security recommendation would you provide?

The main recommendation is:

Remove the unnecessary public exposure.

Possible actions:

• Disable the service if it is not required
• Block public access using firewall rules
• Restrict access to trusted networks
• Use a secure VPN or controlled access solution
• Apply strong authentication and MFA
• Keep the service patched
• Monitor access logs

This follows the principle of reducing the attack surface.

33. Why should a penetration tester not rely only on the output of an automated vulnerability scanner?

Automated scanners have limitations.

They may produce:

False Positives

The scanner reports a vulnerability that is not actually exploitable.

False Negatives

The scanner fails to identify a real vulnerability.

Scanners may also lack context about:

• Business logic
• Actual configuration
• Compensating security controls
• Exploitability
• Real-world impact

Therefore:

Automated scanning finds possible issues, but human validation determines whether the issue is real and important.

34. A user opens an unexpected Word document received by email. What security risks should be considered?

The following risks should be considered:

• Malicious macros
• Exploitation of Office vulnerabilities
• Phishing or social engineering
• Embedded malicious links
• Malicious attachments
• Credential theft
• Malware or Trojan installation

Recommended actions:

• Do not enable macros unless verified
• Verify the sender
• Scan the file
• Keep Office updated
• Use protected viewing features
• Report suspicious emails

35. An attacker intercepts network traffic between a user and a website. Which security mechanism can protect the confidentiality and integrity of the communication?

The main security mechanism is:

HTTPS using TLS (Transport Layer Security).

TLS provides:

Confidentiality

Data is encrypted so others cannot easily read it.

Integrity

Helps detect unauthorized modification of data.

Authentication

Digital certificates help verify the identity of the website.

Therefore, properly implemented HTTPS/TLS is a major protection against interception attacks.

VAPT

36. Explain VAPT in brief.

VAPT stands for:

Vulnerability Assessment and Penetration Testing

It is a security assessment process used to identify, analyze, and validate security weaknesses.

Vulnerability Assessment

Finds and identifies possible vulnerabilities.

Penetration Testing

Attempts to safely validate selected vulnerabilities and determine their actual impact.

Basic VAPT process:

1. Planning and authorization
2. Information gathering
3. Scanning
4. Enumeration
5. Vulnerability identification
6. Validation/testing
7. Impact assessment
8. Reporting
9. Remediation and retesting

Main goal: Identify security weaknesses before malicious attackers can abuse them.

37. What is the difference between Vulnerability Assessment (VA) and Penetration Testing (PT)?

Vulnerability Assessment	Penetration Testing
Identifies vulnerabilities	Validates selected vulnerabilities
Often scanner-based	Uses manual and automated testing
Broad coverage	Focuses on real-world impact
Finds possible weaknesses	Determines whether weaknesses can be exploited
Usually produces a list of findings	Demonstrates attack paths and impact

Simple example:

VA: "This server may have a vulnerability."

PT: "After authorization and validation, this vulnerability can/cannot actually be exploited and the impact is X."

38. What are the types of penetration testing?

1. Black-Box Testing

The tester has little or no prior knowledge of the target.

It simulates an external attacker with limited information.

2. White-Box Testing

The tester has extensive knowledge.

They may receive:

• Architecture information
• Source code
• Credentials
• Network details

This allows deeper testing.

3. Gray-Box Testing

The tester has partial knowledge of the environment.

This is between black-box and white-box testing.

Other classifications may include:

• External penetration testing
• Internal penetration testing
• Web application testing
• Mobile application testing
• Wireless testing
• Network testing
• Cloud security testing
• Social engineering assessments

39. What is the difference between a tool and a framework? Why is a framework needed?

Tool

A tool usually performs a specific task.

Examples:

• Port scanning
• Packet analysis
• Vulnerability scanning

A tool generally has a focused purpose.

Framework

A framework provides an organized environment containing multiple components, modules, and features for performing a larger set of tasks.

Why is a framework needed?

A framework helps:

• Organize functionality
• Reuse modules
• Standardize workflows
• Integrate exploits and payloads
• Manage sessions
• Automate tasks
• Extend functionality

Example:

A hammer is a tool. A complete toolbox with different organized instruments is similar to a framework.

Metasploit is a framework because it provides many integrated capabilities rather than performing only one task.

Metasploit

40. Explain the history of Metasploit.

The Metasploit Project was created by H. D. Moore in 2003 as an open-source project for developing and using security testing tools and exploits.

Initially, it focused on providing a platform for security researchers to develop and share exploit code.

Over time, it developed into a major penetration-testing framework.

Important development:

• 2003: Metasploit Project created by H. D. Moore.
• Initially developed as an open-source security project.
• Later evolved significantly and was rewritten using Ruby.
• 2009: Rapid7 acquired the Metasploit Project.
• Rapid7 continued developing Metasploit, including the open-source Metasploit Framework and commercial security products.

Today, Metasploit is widely used for:

• Security research
• Penetration testing
• Vulnerability validation
• Security education
• Authorized exploit development and testing

41. Explain the architecture of Metasploit with a diagram.

Metasploit has a modular architecture. Different components work together.

Simple Architecture Diagram

                    +----------------------+
                    |      Security        |
                    |       Tester         |
                    +----------+-----------+
                               |
                               v
                    +----------------------+
                    |     MSF Console      |
                    |    User Interface    |
                    +----------+-----------+
                               |
                               v
        +------------------------------------------+
        |         Metasploit Framework Core        |
        |  Modules, Database Support, Session Mgmt |
        +------------------------------------------+
             |           |           |         |
             v           v           v         v
        +---------+ +---------+ +---------+ +---------+
        | Exploit | | Payload | | Auxiliary| | Post    |
        | Modules | | Modules | | Modules  | | Modules |
        +---------+ +---------+ +---------+ +---------+
             |
             v
        +----------------------------------+
        |       Authorized Target          |
        |   Vulnerable Service/System      |
        +----------------------------------+
             |
             v
        +----------------------------------+
        | Session / Meterpreter / Shell    |
        +----------------------------------+

Explanation

1. MSFconsole

The main command-line interface used to interact with Metasploit.

2. Framework Core

Manages modules, sessions, databases, and overall functionality.

3. Exploit Modules

Contain code or logic designed to test specific vulnerabilities.

4. Payload Modules

Define what runs after a successful exploit.

5. Auxiliary Modules

Perform supporting tasks such as scanning and enumeration.

6. Post Modules

Used for authorized post-exploitation activities after access has been obtained.

7. Sessions

Represent active connections such as command shells or Meterpreter sessions.

42. What is the difference between a payload and an exploit?

Exploit

An exploit is the method or code used to take advantage of a specific vulnerability.

Its purpose is to trigger the vulnerability.

Payload

A payload is the code or functionality that is delivered or executed after the exploit successfully works.

Simple Flow:

Vulnerability
      |
      v
   Exploit
      |
      v
Payload is executed
      |
      v
Session / Intended Action

Example:

Exploit = the method used to open the door. Payload = what happens after the door is opened.

43. Explain the Metasploit interface in detail with a diagram.

The most common Metasploit interface is MSFconsole.

Simple Diagram

+----------------------------------------------------+
|                    MSFCONSOLE                      |
+----------------------------------------------------+
| Prompt / Command Input                             |
|                                                    |
| msf6 >                                            |
+----------------------------------------------------+
| Module Information                                 |
| - Name                                             |
| - Description                                      |
| - References                                       |
| - Options                                          |
+----------------------------------------------------+
| Configuration                                      |
| RHOSTS : Target                                    |
| LHOST  : Testing/Handler Host                      |
| Other module-specific options                      |
+----------------------------------------------------+
| Execution / Results                                |
| - Scanner output                                   |
| - Module results                                   |
| - Session information                              |
+----------------------------------------------------+

Main parts of the interface

1. Prompt

The prompt allows the tester to enter Metasploit commands.

Example concept:

msf6 >

2. Module Search

Used to locate available modules related to a particular technology or vulnerability.

3. Module Selection

The tester selects an appropriate module for the authorized target.

4. Module Options

Each module may require configuration.

For example:

• Target information
• Network configuration
• Other module-specific settings

5. Information Section

Displays information such as:

• Module description
• References
• Options
• Requirements

6. Session Management

After successful authorized testing, active sessions can be managed.

Sessions may include:

• Command shell
• Meterpreter session

7. Database and Workspace Support

Metasploit can organize assessment information using workspaces and database functionality.

44. Explain the components of Metasploit in detail.

Metasploit contains several important components.

1. Exploits

Exploit modules are designed to test specific vulnerabilities.

Their purpose is to determine whether a known weakness can be successfully triggered in an authorized environment.

2. Payloads

Payloads define the action or code that runs after successful exploitation.

Examples conceptually include:

• Command shell
• Meterpreter session

Payload selection depends on the testing environment and authorization.

3. Auxiliary Modules

Auxiliary modules perform supporting security tasks.

They may be used for:

• Scanning
• Enumeration
• Service testing
• Protocol interaction

They do not necessarily exploit a vulnerability.

4. Post-Exploitation Modules

These modules are used after authorized access has been obtained.

They help perform activities such as:

• System information gathering
• Configuration assessment
• Security analysis
• Privilege assessment

5. Encoders

Encoders transform data into another format.

Historically, they have been used for compatibility and encoding requirements. Encoding alone should not be considered a reliable method for bypassing modern security products.

6. NOP Modules

NOP means No Operation.

NOP modules can be used in certain exploit-development situations where instruction padding or execution reliability is relevant.

7. MSFconsole

MSFconsole is the primary command-line interface.

It allows users to:

• Search modules
• Select modules
• Configure options
• Run authorized tests
• Manage sessions

8. Meterpreter

Meterpreter is an advanced payload that provides an interactive post-exploitation environment.

It supports structured commands and extensible functionality.

9. Database Support

Metasploit can store and organize assessment data such as:

• Hosts
• Services
• Notes
• Vulnerability information

This helps manage larger penetration-testing projects.

10. Workspaces

Workspaces help separate different testing environments or projects.

For example:

Company_A_Test
Company_B_Test
Lab_Test

This prevents assessment information from becoming mixed together.

45. Why is Metasploit used in offensive security?

Metasploit is used in authorized offensive security because it provides an organized framework for security testing.

Main reasons:

1. Large collection of modules It provides modules for many security-testing tasks.

2. Exploit validation Helps testers validate whether certain vulnerabilities are actually exploitable.

3. Payload support Supports different payloads for authorized testing.

4. Meterpreter Provides advanced post-exploitation capabilities.

5. Scanning and enumeration Includes supporting modules for gathering information.

6. Modular architecture New modules and functionality can be added.

7. Automation Supports scripting and repeatable testing.

8. Session management Helps manage authorized sessions.

9. Education and research Useful for learning how vulnerabilities and exploitation frameworks work in legal lab environments.

10. Reporting and remediation support The results of testing can help organizations understand and fix real security weaknesses.

In short:

Metasploit is used to identify, validate, and demonstrate the impact of security vulnerabilities during authorized penetration testing.

Complete Metasploit Flow

Authorization
     ↓
Information Gathering
     ↓
Scanning
     ↓
Enumeration
     ↓
Identify Vulnerability
     ↓
Select Appropriate Module
     ↓
Configure and Validate Safely
     ↓
Exploit (If Authorized)
     ↓
Payload Executes
     ↓
Shell / Meterpreter Session
     ↓
Post-Exploitation Assessment
     ↓
Document Findings
     ↓
Remediation
     ↓
Retesting

Important for exam: Remember this difference:

Exploit = Takes advantage of a vulnerability Payload = Executes after successful exploitation Meterpreter = Advanced payload/session environment VAPT = Vulnerability Assessment + Penetration Testing