I decided to try Metasploitable2 tonight just to see how far I could get, and I ended up getting my first shell way sooner than I expected. I’m still very new to pentesting, so I was prepared to spend a while fumbling around — but things actually clicked pretty quickly once I got into it.

I’ve been doing a lot of Linux customization/building lately (I’m working on my own distro as a side project), but offensive security is still pretty unfamiliar territory for me. So even though MSF2 is intentionally vulnerable, going through the full process myself felt like a big milestone.

Here’s what I’m proud of:

• getting Kali + Metasploitable talking over bridged networking

• running Nmap and being able to make sense of the output

• setting LHOST/RHOST correctly (took a minute, not gonna lie)

• trying different exploits and learning from the ones that failed

• actually navigating msfconsole without totally guessing

• and eventually getting a working shell

It wasn’t perfect, and I definitely had a few “wait… what did I break?” moments, but overall it made a lot more sense than I expected it to.

I know this is a beginner box, but it was still really satisfying to see everything come together. If anyone has suggestions for good next-step VMs or labs, I’d love to hear them.