Metasploitable 3
Build, Explore & Understand an Intentionally Vulnerable Security Lab
Metasploitable 3 is an intentionally vulnerable virtual machine environment created for security testing, training and research. Instead of downloading a single fixed image, you assemble the target machine yourself with automated build tooling — then run it inside an isolated lab network where experimentation stays safe, repeatable and completely under your control.
- Vagrant
- Packer
- Virtual Machines
- Metasploit
- Security Labs
$ vagrant status
target : metasploitable 3
provider : virtualbox
network : host-only (isolated)
state : running
- TARGET VM · Metasploitable 3
- ENVIRONMENT · Isolated Lab
- BUILD · Vagrant / Packer
- PURPOSE · Security Training
- virtualization provider detected
- host-only network attached
- clean snapshot stored
Built for Hands-On Security Learning
Four ideas shape the whole project: controlled exposure, virtualisation, automation and education.
Intentionally Vulnerable
A purpose-built security testing environment where weak configurations exist on purpose.
Virtual Machine Lab
Runs inside an isolated virtualised environment you can pause, snapshot and rebuild at will.
Reproducible Builds
Vagrant, Packer and provisioning workflows turn the entire lab into repeatable code.
Security Research
Practice understanding vulnerable services safely, without touching production systems.
Key Features of Metasploitable 3
What actually sets this project apart from a downloaded vulnerable image — the build pipeline, the service depth and the discipline it encourages.
Infrastructure-as-Code Build Pipeline
The entire target machine is described in files rather than shipped as a finished disk. Packer produces the base image from a written definition and Vagrant drives the machine lifecycle, which means the lab you build today is the same lab you can rebuild in six months on different hardware.
- Machine definitions live in readable configuration files
- Automated provisioning replaces manual setup steps
- Identical targets for every student in a class
- Rebuild from scratch instead of repairing a broken VM
A Broad, Realistic Service Surface
Instead of one isolated flaw, the target exposes a spread of everyday enterprise services — web servers, Java application platforms, an automation server, databases, file sharing and remote management. That breadth is what turns a single exercise into a genuine methodology practice ground.
- Multiple service categories on one machine
- Mirrors the mixed estates found in real organisations
- Supports enumeration, analysis and reporting workflows
- Concepts transfer directly to defensive hardening work
Multiple Target Environments
Windows-based and Linux-based builds share one workflow, so you can compare how exposure differs across platforms.
Virtualization Provider Choice
The build targets standard hypervisors, letting you work with the virtualization stack you already run.
Snapshot & Reset Friendly
A clean baseline can be captured before any session and restored in seconds, so nothing you break stays broken.
Open Source & Inspectable
The source, issue tracker and build definitions are public, so nothing about the target is a black box.
Feature summary
Reproducible builds, a wide service surface, cross-platform targets, provider flexibility, instant resets and full source transparency — all inside an environment that never has to touch a network you do not own.
What Is Metasploitable 3?
Metasploitable 3 is an open-source, intentionally vulnerable virtual machine project used to study how services fail when they are outdated, misconfigured or left wide open. It exists so that learners have somewhere legitimate to practise: a disposable target that belongs to them, running on their own hardware, disconnected from anything that matters.
The most important difference from earlier vulnerable machines is that Metasploitable 3 is distributed as a build project rather than as a finished disk image. The machine is described in configuration files, and automation tooling assembles it on demand. Packer handles image creation, while Vagrant manages the lifecycle of the running virtual machine — creating it, starting it, suspending it and destroying it with short, predictable commands.
That approach makes the environment reproducible. If a lab session goes sideways, or a service is changed beyond recognition, the machine can be discarded and rebuilt into a known-good state. Instructors get identical targets for every student; independent learners get a clean slate whenever they want one. Along the way, building a Metasploitable 3 lab teaches genuinely useful infrastructure skills — virtualisation providers, provisioning, host networking and image automation — which are just as valuable as the security concepts themselves.
The project provides more than one target flavour. A Windows-based environment exposes typical enterprise services such as web servers, application platforms, file sharing and remote management, while a Linux-based environment covers common open-source daemons and web applications. Together they represent the kind of mixed estate a security professional actually meets in the field.
Used correctly, a Metasploitable 3 lab becomes a personal cyber range: somewhere to observe how a vulnerable service behaves, understand why a configuration is dangerous, learn how the Metasploit framework interprets a target, and document findings the way a real assessment would. The one non-negotiable rule is isolation — the machine is deliberately weak, so it belongs on a closed lab network and nowhere else.
- LAYER 01 · Virtualization
- LAYER 02 · Vagrant
- LAYER 03 · Target VM
- LAYER 04 · Vulnerable Services
- LAYER 05 · Security Lab
Each layer sits inside the one above it. Nothing in the stack ever reaches beyond the boundary of your own machine.
Metasploitable 3 at a Glance
Six characteristics that define how the project is built, distributed and used in a lab.
Intentionally Vulnerable
Built specifically for controlled security labs, with weaknesses left in place on purpose so they can be studied.
Reproducible Environment
Virtual machines can be built through automated tooling, so the same lab can be recreated on demand.
Vagrant Workflow
Vagrant simplifies the VM lifecycle — bringing the target up, halting it and destroying it from one place.
Packer Builds
Packer supports automated machine-image creation, so the base image is assembled from a written definition.
Multiple Services
The target ships with a spread of deliberately vulnerable services, giving a broad learning surface.
Open-Source Project
The project source and its documentation are publicly available, so the whole build is open to inspection.
Inside the Metasploitable 3 Lab
A Metasploitable 3 environment is a small stack of layers. Understanding the boundaries between them is what keeps the lab useful and contained.
Host Machine
Virtualization Provider
Metasploitable 3 VM
Vulnerable Services
Security Testing Machine
Indicative guidance only. The host runs the hypervisor; the Metasploitable 3 VM holds every deliberately weak service on a private, non-routable segment; a separate testing machine sits on that same segment. Confirm real requirements in the official project documentation before building.
Metasploitable 3 Environments
The project is not a single machine. Different target environments let you study Windows-style and Linux-style service exposure through one build process.
Windows Environment
The Windows-based Metasploitable 3 target models a small enterprise server: web hosting, Java application platforms, an automation server, file sharing and remote management — the kind of stack a defender meets constantly and a learner rarely gets to take apart safely. Because the machine comes from a written build definition, it can be regenerated whenever a session ends, which suits structured exercises where everyone needs an identical starting point.
- IIS
- SMB
- WinRM
- Jenkins
- Tomcat
- MySQL
Linux Environment
The Linux-oriented build follows the same virtualisation and provisioning workflow, targeting an Ubuntu-based system instead. It leans towards familiar open-source daemons and web applications, making it a natural companion to the Windows target rather than a replacement for it. Availability of specific builds and provider support changes as the project evolves, so treat the official repository as the authority on what can be built today rather than assuming a fixed feature set.
- SSH
- Web Services
- Databases
- FTP
- Web Apps
- Network Daemons
Explore the Metasploitable 3 Attack Surface
A high-level map of the service categories a Metasploitable 3 lab exposes, and what each one teaches about real-world security.
GlassFish
APPLICATION SERVER
A Java application server, useful for studying administrative interfaces and how deployment surfaces get exposed.
Apache Struts
WEB FRAMEWORK
A Java web framework frequently referenced in vulnerability research and secure development training.
Tomcat
SERVLET CONTAINER
A widely deployed Java servlet container, ideal for understanding management endpoints and hosted applications.
Jenkins
AUTOMATION SERVER
A continuous integration service showing why build infrastructure needs hardening and strict access control.
IIS
WEB SERVER
Microsoft's web server, used to examine Windows-hosted content, modules and configuration behaviour.
SSH
REMOTE ACCESS
A secure shell service for exploring authentication design, key handling and remote administration exposure.
SMB
FILE SHARING
Windows file and printer sharing, a staple topic in network enumeration and share permission lessons.
WinRM
REMOTE MANAGEMENT
The Windows Remote Management endpoint, helpful for understanding management channels and their controls.
MySQL
DATABASE
A relational database service used to discuss data exposure, privilege design and configuration hygiene.
Elasticsearch
SEARCH & ANALYTICS
A search service highlighting the risk of leaving data stores reachable without authentication.
WebDAV
HTTP EXTENSION
An HTTP extension for publishing files, useful for studying upload handling and access control logic.
SNMP
NETWORK PROTOCOL
A network management protocol that demonstrates information disclosure and default configuration risk.
Educational scope only
This page describes the learning surface at a conceptual level. It deliberately contains no credentials, no exploit commands and no step-by-step attack instructions — the goal is to understand why these services matter, inside an environment you own.
How Metasploitable 3 Works
From an empty host machine to a running, isolated target in five deliberate stages.
Prepare the Host
Confirm your machine has the RAM, disk headroom and virtualisation support the lab needs.
Install Virtualization Tools
Set up a hypervisor plus the automation tooling that drives the build.
Set Up the Project
Obtain the official project files and review the build configuration before running anything.
Launch the Target VM
Bring the machine up on a private network and let provisioning finish.
Practice in an Isolated Lab
Snapshot the clean state, then explore, observe and reset as often as you like.
Metasploitable 3 Installation Overview
A high-level route from bare host to running lab. Always follow the official project documentation for exact commands and current requirements.
- A supported host environment with enough headroom to run a VM comfortably
- A virtualization provider such as VirtualBox or VMware
- Vagrant for managing the virtual machine lifecycle
- The official project files from the upstream repository
- Sufficient RAM and free disk space for images and snapshots
- An isolated, non-routable lab network segment
Stage 01 · Prepare the host
Free up disk space, check available memory and make sure hardware virtualization is enabled in firmware.
Stage 02 · Install prerequisites
Add your chosen hypervisor and the automation tooling, then verify each one launches cleanly on its own.
Stage 03 · Obtain project files
Fetch the official project from its upstream repository and read the accompanying documentation first.
Stage 04 · Configure virtualization
Select the provider, review machine resources and attach the target to a private, non-routable network.
Stage 05 · Start the lab
Bring the machine up and allow provisioning to complete without interruption before touching anything.
Stage 06 · Verify the environment
Confirm the target is reachable only from your lab machine, then capture a clean snapshot as your baseline.
Lab Safety
Metasploitable 3 is intentionally vulnerable. Run it only in a controlled and isolated environment. Do not expose the vulnerable VM directly to the public internet or to untrusted networks, and never place it on a segment that carries real work or personal data.
Choose Your Metasploitable 3 Setup
Both paths end with the same kind of isolated target. They differ in how much of the machine you assemble yourself.
Feature
Prebuilt Environment
Build From Source
Setup complexity
PREBUILTLower — import and run
FROM SOURCEHigher — tooling must be configured first
Time required
PREBUILTMinutes once the image is available
FROM SOURCELonger, since the image is assembled locally
Customization
PREBUILTLimited to what the image already contains
FROM SOURCEFull control over the build definition
Reproducibility
PREBUILTDepends on the image you were given
FROM SOURCEStrong — the machine is described in code
Best suited for
PREBUILTBeginners who want a target quickly
FROM SOURCELearners who also want infrastructure skills
Tooling requirements
PREBUILTA hypervisor is usually enough
FROM SOURCEHypervisor plus Vagrant and Packer workflows
Learning value
PREBUILTFocused on the services themselves
FROM SOURCECovers services, automation and provisioning
Metasploitable2 vs Metasploitable 3
The two projects share a purpose but not a philosophy. One hands you a machine; the other hands you the blueprint.
Metasploitable2
Previous generation
- GENERATION · The earlier generation of the vulnerable machine series
- DISTRIBUTION APPROACH · Shared primarily as a ready-made virtual machine image
- BUILD WORKFLOW · Import the supplied image and boot it
- CUSTOMIZATION · Fixed — the image arrives as it is
- AUTOMATION · Minimal; the machine is already assembled
- VIRTUALIZATION WORKFLOW · Import into a hypervisor and run
- LEARNING EXPERIENCE · Fast to start, focused on the exposed services
Metasploitable 3
Current generation
- GENERATION · The later generation, designed around automation
- DISTRIBUTION APPROACH · Published as an open-source build project rather than one image
- BUILD WORKFLOW · Assembled locally through image creation and provisioning tooling
- CUSTOMIZATION · Configurable — the machine is defined in files you can read
- AUTOMATION · Scripted provisioning is central to the design
- VIRTUALIZATION WORKFLOW · Provider-based builds managed through Vagrant
- LEARNING EXPERIENCE · Teaches services plus virtualization and build automation
A Better Way to Learn Security
Intentionally vulnerable environments work best as a loop rather than a one-off exercise. Each pass through the cycle deepens understanding without risking anything real.
Learn
Study the concept before touching the machine.
Build
Assemble the lab from its written definition.
Observe
Watch how the service actually behaves.
Test
Work through authorised exercises on your own target.
Document
Record what happened and why it mattered.
Reset
Roll back to a clean snapshot and start again.
The cycle repeats
Every reset returns the environment to a known-good baseline, so the next experiment starts from exactly the same place as the last one.
Who Is Metasploitable 3 For?
Anyone who needs somewhere safe and legal to understand how vulnerable systems behave.
Cybersecurity Students
Coursework becomes concrete when there is a real machine to inspect instead of a slide deck.
Ethical Hacking Learners
A legitimate target of your own removes every ambiguity about authorisation while you practise.
Penetration Testing Students
Methodology, note-taking and reporting habits are easier to build against a predictable environment.
Security Researchers
A disposable, rebuildable host is a convenient place to observe service behaviour in detail.
CTF Learners
Competition-style thinking benefits from a private range where failure costs nothing at all.
Lab Instructors
Reproducible builds mean every participant works from an identical, verifiable starting point.
Metasploitable 3 Lab Safety
Six practices that keep a deliberately vulnerable machine from becoming a genuine problem.
Non-negotiable: a Metasploitable 3 machine is weak on purpose. Treat every session as something that happens inside a sealed room.
Isolate the VM
Attach the target to an isolated lab network only. Host-only or internal networking keeps it unreachable from everything else you own.
Avoid Public Exposure
Never expose the vulnerable target directly to the internet, and never forward ports to it from a router or cloud instance.
Use Your Own Environment
Practise only on systems you own or are explicitly authorised to test. Authorisation is the line between learning and an offence.
Take Snapshots
Capture a clean VM state before every session so the lab can be returned to a known-good baseline in seconds.
Separate Sensitive Data
Keep real credentials, personal files and work accounts entirely outside the lab. Nothing valuable belongs on a deliberately weak machine.
Reset Often
Restore or rebuild after experiments. A drifting target quietly stops teaching you anything reliable.
Common Metasploitable 3 Setup Issues
Most setup problems come down to virtualization support, resources or networking. Here is where to look first.
VM fails to start
Check that the hypervisor launches on its own first, confirm the machine definition is intact, and review the provider log the tooling points you to.
Vagrant provider issue
Make sure the provider is installed, up to date and selected explicitly. Mismatched provider versions are a common source of silent failures.
Virtualization disabled
Hardware virtualization is often switched off by default in firmware. Enable it in BIOS/UEFI and verify nothing else is already holding the hypervisor.
Insufficient memory
Lower other workloads or raise the memory available to the host. A target starved of RAM will appear to hang rather than report an error.
Build dependency error
Re-read the documented prerequisites and confirm each tool is on a supported version before rerunning the build from a clean state.
Network configuration issue
Confirm the lab adapter exists, uses a private range and does not clash with your home or office subnet. Overlapping ranges break routing in confusing ways.
Provisioning failure
Provisioning steps can fail part-way through. Destroy the half-built machine and start again rather than patching a partial state by hand.
Host compatibility issue
Some host operating systems and CPU generations behave differently. Check the project's notes and community issue tracker for your specific platform.
Your Metasploitable 3 Learning Path
Six levels that move from virtualization basics to disciplined, documented practice.
Level 01 · Understand Virtual Machines
Learn what a hypervisor does, how virtual networking works and why isolation is the foundation of every safe lab.
Level 02 · Build the Lab
Work through the prerequisites and bring a target up yourself. The build itself teaches provisioning and automation.
Level 03 · Explore Services
Identify what is running, what each service is for and how it is meant to be configured in a healthy environment.
Level 04 · Learn Vulnerability Concepts
Study the classes of weakness behind the exposure — authentication, access control, input handling, patching.
Level 05 · Practice Authorized Testing
Apply structured methodology on your own target only, with the same discipline a real engagement demands.
Level 06 · Document & Rebuild
Write findings up properly, then reset the machine and repeat the cycle with a harder objective.
Metasploitable 3 Resources
Primary sources only. When guidance here and the official documentation disagree, trust the documentation.
Official Project Repository
The upstream source, issue tracker and release notes for the project itself.
Official Documentation
Read the project's own README and wiki before running any build command.
Installation Resources
Current prerequisites, supported providers and build instructions live upstream.
Vagrant Resources
Learn how Vagrant manages virtual machine lifecycles and provider configuration.
Packer Resources
Understand automated machine-image creation and how build templates are written.
Metasploit Learning Resources
Official documentation for the framework most often paired with this lab.
Metasploitable 3 FAQ
Twenty-five straight answers about building, running and using a Metasploitable 3 lab safely.
What is Metasploitable3 ?
Metasploitable 3 is an open-source, intentionally vulnerable virtual machine project used for security training and research. Rather than shipping as a finished disk image, it is distributed as a build project: automation tooling assembles the target machine on your own hardware so the same environment can be recreated whenever it is needed.
What is Metasploitable 3 used for?
It is used to practise security concepts safely. Learners study how exposed services behave, how misconfiguration creates risk, and how assessment methodology works — all inside a machine they own. It is also widely used by instructors who need identical lab targets for a whole class.
Is Metasploitable 3 intentionally vulnerable?
Yes. The weaknesses are deliberate. Services are configured to be studied rather than to be secure, which is precisely why the machine must stay on an isolated lab network. Treat it as unsafe software by design and never place it anywhere it could be reached by others.
Is Metasploitable 3 free?
The project is open source and publicly available from its official repository at no cost. You will still need suitable hardware and virtualization software, and some hypervisors have their own licensing terms, so check what applies to the provider you choose.
Who created Metasploitable3?
Metasploitable3 originated as a Rapid7 open-source project and has been developed with contributions from the wider security community. This website is an independent educational resource and is not affiliated with or endorsed by Rapid7 — always treat the official repository as authoritative.
Is Metasploitable 3 suitable for beginners?
It is approachable, but it asks more of a beginner than a prebuilt image would, because you assemble the machine yourself. If virtualization is new to you, spend time on hypervisors and virtual networking first; the build then becomes a straightforward extension of what you already understand.
What is the difference between Metasploitable 2 and Metasploitable 3?
Metasploitable 2 was distributed mainly as a ready-made virtual machine image you import and boot. Metasploitable3 is a build project that uses automation tooling to create the machine locally, which makes it configurable and reproducible while also teaching provisioning and image-build skills.
Does Metasploitable 3 use Vagrant?
Yes. Vagrant is central to the workflow. It manages the virtual machine lifecycle — creating, starting, halting and destroying the target — through a written configuration, which is what makes rebuilding a clean lab quick and consistent across different machines.
What is Packer used for?
Packer handles automated machine-image creation. It takes a written build definition and produces the base image that the virtualization provider then runs. Combining Packer with Vagrant means the whole environment is described in code rather than assembled by hand.
Can Metasploitable 3 run in VirtualBox?
VirtualBox is one of the commonly used providers for this kind of lab and is a popular choice because it is freely available across major host platforms. Provider support does change over time, so confirm the currently supported options in the official project documentation before you begin.
Can Metasploitable 3 run in VMware?
VMware products are also widely used for vulnerable-machine labs. Exact support depends on the project’s current build configuration and on the VMware edition you have, so check the upstream documentation rather than assuming a particular provider will work out of the box.
Does Metasploitable 3 have Windows and Linux environments?
The project provides more than one target flavour, including a Windows-based environment and a Linux-based one. Both are produced through the same build workflow, which lets learners compare how service exposure differs between the two operating system families.
How much RAM does Metasploitable 3 need?
Plan for the virtual machine’s memory allocation plus enough left over for your host and any second testing VM. In practice that usually means a host with a comfortable amount of RAM rather than a minimum spec machine. Confirm current requirements in the project documentation before building.
Why is my Metasploitable 3 VM not starting?
Start with the basics: hardware virtualization enabled in firmware, the hypervisor launching correctly on its own, enough free memory and disk, and no conflicting virtualization software running. If provisioning failed part-way, destroy the machine and rebuild from a clean state.
Should Metasploitable 3 be connected to the internet?
No. The vulnerable target should never be exposed to the public internet or to untrusted networks. Use host-only or internal networking so the machine is reachable only from your lab. Any temporary connectivity needed during a build should be removed once the machine is ready.
Is Metasploitable 3 safe to use?
It is safe when it is contained. The software itself is deliberately weak, so safety comes entirely from how you run it: an isolated network, no sensitive data inside the lab, snapshots taken before experiments, and testing limited to systems you own or are authorised to assess.
Can I use Metasploitable 3 to learn Metasploit?
Yes — that pairing is one of the main reasons the project exists. Having a legitimate target of your own means you can learn how the framework enumerates and interprets a system without ever touching infrastructure that belongs to someone else.
What vulnerable services are included?
The targets expose a spread of service categories: web servers, Java application platforms, automation servers, databases, file sharing, remote management and network services. The exact list depends on the environment you build, so treat the official repository as the definitive reference.
Can I reset a Metasploitable 3 lab?
Yes, and you should. Take a snapshot of the clean machine before any session so you can roll back in seconds. Because the environment is defined in code, you can also destroy it completely and rebuild it from scratch whenever a fresh baseline is preferable.
Where can I find the official Metasploitable 3 project?
The project is hosted publicly on GitHub under the Rapid7 organisation, where you will also find the README, issue tracker and build instructions. Always download from that upstream source rather than from third-party mirrors offering repackaged images.
Do I need cybersecurity experience to use it?
No, but some computing fundamentals help enormously — comfort with the command line, basic networking, and an understanding of what a virtual machine is. Many people use Metasploitable3 as the environment in which they build exactly those foundations.
What virtualization software can I use?
You need a hypervisor supported by the project’s build configuration; VirtualBox and VMware products are the ones most commonly discussed for labs of this kind. Because supported providers can change between releases, verify the current list in the official documentation first.
Why should I use VM snapshots?
Snapshots turn mistakes into non-events. A clean baseline captured before an exercise lets you undo any change in moments, compare behaviour before and after, and guarantee that the next session starts from exactly the same state as the last one.
Is Metasploitable 3 a CTF?
Not formally. It is a vulnerable lab environment rather than a scored competition, although its flexible structure makes it a popular base for building CTF-style exercises and classroom challenges on top of the machine you have built.
Can Metasploitable 3 be used for security training?
Yes. Reproducible builds make it well suited to training, because every participant can be given an identical target and a reliable way to reset it. Instructors typically pair it with a separate testing machine on the same isolated lab network.
Explore Metasploitable 3 in a Controlled Environment
Learn how the project works, understand its architecture, explore intentionally vulnerable services, and build a safe cybersecurity practice environment that you control from end to end.
Metasploitable 3 is intentionally vulnerable software designed for security testing and education. Use it only in environments you own or are explicitly authorized to test.
This website is an independent educational resource and is not affiliated with, sponsored by, or endorsed by Rapid7.
“Metasploitable”, “Metasploit” and related names may be trademarks of their respective owners. All product names, logos and brands are the property of their respective owners and are referenced here for identification purposes only.