Metasploitable 3
Deliberately vulnerable Windows and Ubuntu VMs built with Packer and Vagrant for exploit practice.
Technical Architecture & Overview
Metasploitable 3 is Rapid7's intentionally vulnerable training environment, with a Windows Server 2008 R2 and an Ubuntu 14.04 target built with a large number of security vulnerabilities. Machines build from Packer templates, and Rapid7 also publishes prebuilt Vagrant boxes. The repository is not archived; its most recent commit dates from February 2025.
Targeted Technical Use Cases
Practicing network exploitation and post-exploitation against Windows and Linux targets in an isolated lab.
Evaluation & Trade-offs
Core Strengths
- +Windows and Linux targets in one project.
- +Reproducible builds from open templates.
- +Published by Rapid7 as a target for testing exploits with Metasploit.
Trade-Offs & Limitations
- -No repository activity since early 2025; the software stack is old by design.
- -Vagrant and hypervisor setup adds friction versus hosted labs.
Defensive Security Application
Reproducing well-known Windows exploitation techniques in a controlled lab.
Frequently Asked Questions
What is Metasploitable 3?→
Metasploitable 3 is Rapid7's intentionally vulnerable training environment, with a Windows Server 2008 R2 and an Ubuntu 14.04 target built with a large number of security vulnerabilities. Machines build from Packer templates, and Rapid7 also publishes prebuilt Vagrant boxes. The repository is not archived; its most recent commit dates from February 2025.
What is Metasploitable 3 used for?→
Practicing network exploitation and post-exploitation against Windows and Linux targets in an isolated lab.
What are the strengths of Metasploitable 3?→
- +Windows and Linux targets in one project.
- +Reproducible builds from open templates.
- +Published by Rapid7 as a target for testing exploits with Metasploit.
What are the limitations of Metasploitable 3?→
- +No repository activity since early 2025; the software stack is old by design.
- +Vagrant and hypervisor setup adds friction versus hosted labs.
How is Metasploitable 3 used defensively?→
Reproducing well-known Windows exploitation techniques in a controlled lab.