Alternatives to Metasploit Framework
The standard open-source exploitation framework for authorised penetration testing and verifying that a vulnerability is real. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Metasploit Framework
The standard open-source exploitation framework for authorised penetration testing and verifying that a vulnerability is real.
Replacements
Listings that take over the same core job as Metasploit Framework.
Sliver
Open-source adversary emulation and command-and-control framework.
Sliver is an open-source GPL-3.0 command-and-control framework focused on adversary emulation implants and team operation rather than a large library of exploit modules.
Pentest-Tools.com
An online toolkit of vulnerability scanners and penetration testing tools that produces customizable reports.
Pentest-Tools.com is a hosted commercial toolkit that validates vulnerabilities with exploits and produces reports, running on the vendor's infrastructure.
Also worth comparing
These listings name Metasploit Framework as their own alternative, so the relationship runs both ways.
Commix
Open-source tool that detects and exploits command injection vulnerabilities in web applications.
Metasploit Framework is a broad exploitation framework with many modules for verifying exploitability, going well beyond Commix's focus on command injection.
Similar software
Related functionality, not a direct replacement.
Kali Linux
Debian-based distribution preloaded with security testing tools.
Nessus
Widely used commercial vulnerability scanner.
OpenVAS
Full-featured open-source vulnerability scanner.
Impacket
Python library and tool collection for working with network protocols.
NetExec
Assess network services during authorized enterprise security tests.
Pacu
AWS exploitation framework for authorised cloud security testing.
