Which exploitation framework is commonly used to obtain an active session with a target host?

• A. Burpsuite
• B. Metasploit
• C. SOAP
• D. TCP

Answer: (B)

Gaining persistent control after finding a vulnerability relies on an exploitation framework that provides ready-made exploits and payloads to open an interactive connection on the target. An active session means you have an interactive foothold on the victim, such as a shell or Meterpreter, allowing you to run commands, upload/download files, and perform post-exploitation actions.

Metasploit is the standard choice here because it combines a large library of exploits with payloads and post-exploitation modules, and it automates delivering a payload and establishing that session. This makes it practical to move from vulnerability discovery to full control in a repeatable way, with tools to manage and maintain the session.

Burp Suite is primarily a web application testing tool used to identify and manipulate web traffic, not to deliver and maintain exploitation sessions. SOAP is a protocol for web services, not an exploitation framework, and TCP is a transport protocol used by many services, not a framework for post-exploitation.