Metasploit Pro Gets SIEM, Cloud Integration

A new version of the commercial Metasploit penetration-testing product arrived today that integrates the tool with SIEM systems, offers cloud-based penetration testing, more automation, and operates more tightly with vulnerability assessment and management tools.

Rapid7's Metasploit Pro 4.0 is another step toward the goal of making penetration testing more user-friendly and integrated with other security tools and processes: Part of that strategy is automating many of the workflow operations the pen-testing tool provides so organizations can execute more widespread and frequent tests. The new version of the platform also now can be integrated with vulnerability assessment and Web application scanning tools.

HD Moore, chief security officer at Rapid7 and chief architect of the Metasploit platform, says there was major demand for Metasploit Pro to provide more automation. "And what surprised us was such a huge demand for SCADA exploits," he says. The new version boasts nine new SCADA exploits, according to Moore.

Version 4 also supports pen-testing from both public cloud infrastructures and private clouds. Metasploit can be run from Amazon's EC2 service as an Amazon Machine Image. "It lets you run a large-scale arbitrary phishing campaign that's not from your own [IP]," Moore says. "That makes phishing campaigns look more realistic, [for example]."

Moore says Metasploit Pro 4.0 also provides direct product-to-product integration with Rapid7's NeXpose vulnerability management product.

Other new features include automated verification of vulnerabilities and reporting, support for VMware vSphere, automated cracking of encrypted passwords offline, and the ability to pull pen-test reports from Metasploit Pro in an XML format.

Aside from the new features, it's "a huge eye candy update," Moore says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.