Includes vulnerable versions of GlassFish, Apache Axis2, Jenkins, IIS, and WebDAV.
Once your Metasploitable 3 VM is running smoothly via Vagrant, you can easily export it into a standalone .ova file for backup purposes or to use on other hypervisors like VMware Workstation or Proxmox. Open . Locate the running or stopped Metasploitable 3 VM instance. Click File > Export Appliance . Select the Metasploitable 3 VM from the list.
VT-x/AMD-V virtualization support enabled in BIOS/UEFI. Software: VirtualBox (or VMware ), Vagrant, and Packer. Installation Overview If you choose the build method, the general steps include: Metasploitable3: Exploit Testing | Rapid7 Blog
For Windows users who want a , the open-source “Metasploitable 3 Direct Installer” automates the entire process, including dependency installation. metasploitable 3 ova download
Building the virtual machine yourself is the safest and most educational method. Prerequisites
Ensure you allocate at least and 2 CPU cores for the VM to run smoothly. Step 3: Network Configuration (Critical!)
Redownload the OVA (if from a third party) or re-export it from Vagrant. Use 7-Zip to extract the .ovf and .vmdk, then manually create a new VM. Locate the running or stopped Metasploitable 3 VM instance
If the official OVA download is missing or broken, you can build Metasploitable 3 from the source using Packer and Vagrant (instructions in the GitHub repo).
is the latest iteration of the legendary vulnerable VM series created by Rapid7, the company behind the Metasploit Framework. While Metasploitable 2 was designed for older Windows and Linux environments, Metasploitable 3 embraces modern infrastructure, Windows Server 2008 (and Windows 10 builds), and advanced attack vectors.
To download Metasploitable 3 OVA, follow these steps: VT-x/AMD-V virtualization support enabled in BIOS/UEFI
Click . If VMware throws an OVF specification compliance warning, click Retry to force a successful conversion. Post-Import Network Configuration (Safety First)
Historically, Rapid7 provided pre-built boxes via Atlas (Vagrant Cloud) or occasional direct OVA releases. However, maintaining a static, vulnerable Windows machine for public download is a legal and logistical nightmare. Licensing issues with Windows ISOs, coupled with the inevitable drift of the underlying operating system updates breaking the intentional vulnerabilities, made the "download and run" model unsustainable.
One comment, from a user named ZeroDayWizard , caught Alex’s eye: